Junk

Ask something
Question Locked

hacktool.rootkit

0 helpful
8 replies

by wesley.chin

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I did a search on here and see a suggestion of using unhackme from greatissoftware to get rid of the rootkit. Has anyone had success with it?

8 replies

by seanferd

and though I've never used it, Greatis has had some good stuff I've used in the past, like WinDowse (unrelated to malware removal).

Trojan Remover is usually pretty good.
http://www.simplysup.com/

I have had to remove these things manually sometimes, due to rootkits.

But there is Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

There are quite a few free tools out there, good ones. It all depends on the infection as to what tool to use. Sometimes it comes down down to manual removal or an OS re-installation.

http://forums.techguy.org/malware-removal-hijackthis-logs/410146-solved-hacktool-rootkit-virus-moved.html

For a DIY solution (read the whole thing)

Very interesting bit here:
http://www.techspot.com/vb/topic34006.htm

Even from Symantec:
http://www.symantec.com/security_response/writeup.jsp?docid=2002-011710-0057-99&tabid=3

Or just search hacktool.rootkit. You'll get a bunch of hits.

by wesley.chin

I had googled it prior to posting and had tried to remove it manually. Strangely, the keys should be present with infection were not there. Symantec Corporate AntiVirus detected the rootkit initially....

by seanferd

Try other tools if you think you're infected.
Manual removal usually is done best by 1, visually finding files, and 2, removing them at a CLI without booting off the HDD (no net connection while doing this). I usually only use tools to help ID files and reg entries.

by wesley.chin

What other tools do you suggest? I didn't shutdown the net connection, but I did go to safe mode...

by seanferd

Various malware removal applications & general cleaners & utilities.
More powerful and specific tools listed further down, to be used under the direction of experts.
Also a listing of some computer help sites with malware help forums.
Many links to other tools and sites available when visiting the listed sites. Look around.
_______________________________________________________________________________________

Knoppix: Linux Live CD with tools
http://www.knopper.net/knoppix/index-en.html

C(rap)Cleaner: Cleans up junk files and registry entries
http://www.ccleaner.com/

Spybot Search & Destroy (Pepi MK / Safer Networking)
http://www.spybot.info/

Spyware Doctor
http://www.pctools.com/spyware-doctor/version4/

Spyware Blaster
http://www.wilderssecurity.net/spywareblaster.html

Ad-Aware 2007 Free
http://lavasoft.com/products/ad_aware_free.php

Adware Alert
http://www.adwarealert.com/index.php

StartUpList: What really starts at boot time?
http://www.merijn.org/files/startuplist.zip

CWShredder: removes a search hijacker
http://www.trendmicro.com/cwshredder/

HiJackThis: Info gathering utility
http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Trojan Remover
http://www.simplysup.com/

VundoFix: Removes some specific trojans. Updated/expanded fairly often.
http://vundofix.atribune.org/

Atribune Home page: vundofix & some other tools
http://www.atribune.org/component/option,com_frontpage/Itemid,1/

a-squared free: malware remover
http://www.emsisoft.com/en/software/free/

AVG Anti-spyware
http://www.ewido.net/

AVG Anti-virus
http://www.Grisoft.com

Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

UnHackMe
http://greatis.com/unhackme/

Sysinternals: Tons of great tools and info. Now at Microsoft TechNet.
http://www.microsoft.com/technet/sysinternals/

Avira: Anti-virus for Linux and Windows, & some other tools like NTFS4DOS!
http://www.avira.com/en/pages/index.php

>>>>>>>>>>>>>>>>Do not use these tools without direction<<<<<<<<<<<<<<<<<<

ComboFix: Info gathering utility NOTE: Never click on this prog when it's running. It may freeze the system.
http://download.bleepingcomputer.com/sUBs/combofix.exe

Killbox: Delete files on reboot
http://www.killbox.net/downloads/KillBox.exe

SmitFraudFix: For cleaning some trojans
http://siri.urz.free.fr/Fix/SmitfraudFix.zip

_______________________________SITES__________________________________________________

http://www.geekstogo.com/

http://www.bleepingcomputer.com/

http://www.majorgeeks.com/

http://www.techguy.org/

http://www.techspot.com/

http://ensilage.blogspot.com/

http://www.5starsupport.com/

_____________________________________________________________________________________

ADS Spy: A small tool to list, view or delete Alternate Data Streams
http://www.merijn.org/files/adsspy.zip

edit: I kinna believe I forgot Knoppix!

by wesley.chin

I'll take a look at that. S&D was running on the system, but the user had turn Tea Timer off and did not schedule any scans.

There is one that I came across. Called Hazard Shield. Have to tried it extensively, but seems it leaves a small footprint from description on website.

by seanferd

it doesn't matter if they are scheduled or not. User just needs to remember.

With no scans, and Tea Timer off, what was the point of having it? :^0

Tea timer will keep anything from writing to the reg, unless allowed by the user.

This discussion is closed to new replies.