Hardware

Ask something
Question Locked

How do I Idetify & remove a Rootkit?

0 helpful
4 replies

by trono

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi All,

Someone assembled a Win Xp Pro disc with n-lite and inserted a lot of drivers,

Now the problem comes when I install the xp disc on a pc, It tales forever to detect a flash drive when you insert one compared to a standard Microsoft factory disc, and after a few days there are Malware that appear on the system,

I scanned the system with Combofix and it removed the rootkit, but we are using the disc on the companies systems and I am unable to use Combofix as it is not allowed for corporate use, If I can identify it and remove it this nightmare can come to an end,

Regards

4 replies

by oh smeg

It's available here

http://www.nliteos.com/download.html

And it's user Guide is here

http://www.nliteos.com/guides.html

Run nLite on a uninfected system and then when you make the ISO burn it to a CD on the same system.

The most likely reason why it's taking so long to recognize the Flash Drive is because the wrong USB Drivers are installed. Have you looked in Device Manager to see what it is actually showing?

As for fighting Rootkits I prefer Rescue Disc's like F Secure and there is a good article on TR here about Rescue Disc's

https://www.techrepublic.com/blog/security/rescue-cds-tips-for-fighting-malware/3803

Col

by trono

I am unable to use any other disc's than that one "It's because it's the Head IT's standard that must be kept"...i'm getting depressed just thinking about it

I will try that rescue disk

PS: have you worked with Gmer rootkit scanner before?

by oh smeg

Yep it works quite well. No real issues but again it's a Personal Preference as to what you like. ;)

Col

This discussion is closed to new replies.