38 replies to this topic

[Anthony A]

How important are these programs? I currently don't have any installed but looking at two right now. AVG Anti-Rootkit and Panda Anti-Rootkit. Anybody use these two and are these types of programs something we should all have like an AV or AS program? I don't see any mention of them on here.

[CeeCee]

I just few days ago installed that AVG Anti-Rootkit program. There's also i.e. F-Secure Blacklight and RootkitRevealer.

I think it's good to scan for rootkits once a while, just to be sure.

[Tarq57]

I have the AVG one, seems alright. Also have Blacklight available, and Rootkit revealer.
Some of the results do need a bit of knowledge to action correctly, not everything flagged is necessarily a rootkit. Help files definitely worth reading.

[Anthony A]

CeeCee, on Jul 11 2007, 07:01 PM, said:

I just few days ago installed that AVG Anti-Rootkit program. There's also i.e. F-Secure Blacklight and RootkitRevealer.

I think it's good to scan for rootkits once a while, just to be sure.

I installed and tried the AVG Anti-Rootkit. Didn't find anything which is a good thing. Not much to it. I will keep this one just to be sure.

Also tried the Panda Anti-Rootkit. This was recommended on the 46 Best Ever Free Ware List as the guys first choice for Anti-Rootkit programs. This one requires no install. Unzip and run. Also found nothing.

[CeeCee]

AVG Anti-Rootkit installs two driver (.sys) files to system32/drivers folder and they are loaded to memory every time when Windows is booted. I don't like it very much. I scanned once with AVG AR and then stopped them from loading with AutoRuns.

[Andavari]

AntiVir PE Classic also has a root-kit scanner. For people using it they have anti-virus and anti-rootkit all in one app, I'd use it too if it weren't for the update problems I keep having with AntiVir.

[Tom AZ]

CeeCee, on Jul 11 2007, 11:40 PM, said:

I scanned once with AVG AR and then stopped them from loading with AutoRuns.

Could you elaborate on this procedure of stopping them from loading? Thanks.

[CeeCee]

Tom AZ, on Jul 12 2007, 12:12 AM, said:

Could you elaborate on this procedure of stopping them from loading? Thanks.

Just download AutoRuns. Launch Autoruns.exe and go to "Drivers" tab. Uncheck "AVG Anti-Rootkit driver" and "AVG7 Clean Driver". Then just close AutoRuns program. Of course you can't use AVG Anti-Rootkit after that. When you want use it again, just check those drivers and reboot Windows.

[Anthony A]

The Panda Anti-Rootkit seems decent. It's really simple to use has a clean GUI and no install. Even has a option to run the scan on start up. You check the option and reboot. The scan starts at start up. It's a more thorough scan the regular one. Here is the help file with some screen shots in it. Only takes 5 min to go through.

http://www.pandasoftware.com/download/docu...c_en.htm#20.htm

[CeeCee]

Panda Antirootkit crashes on me, when it's scanning registry. I get error "memory could not be written". ?? I got XP SP2.

EDIT: Others got also problems with 1.08. http://research.pandasoftware.com/blogs/re...rsion-1.07.aspx

Andrew, cham44, Jack, Sam and the rest of you running into problems with 1.08 during the registry scan, I have uploaded version 1.07 to http://research.pandasoftware.com/blogs/im...ootkit-1.07.zip. Please try running 1.07 but still send me the details of your machine and installed applications to pbustamante'at'pandasoftware.com.

That 1.07 works fine.

[Anthony A]

CeeCee, on Jul 11 2007, 09:07 PM, said:

Panda Antirootkit crashes on me, when it's scanning registry. I get error "memory could not be written". ?? I got XP SP2.

EDIT: Others got also problems with 1.08. http://research.pandasoftware.com/blogs/re...rsion-1.07.aspx

Andrew, cham44, Jack, Sam and the rest of you running into problems with 1.08 during the registry scan, I have uploaded version 1.07 to http://research.pandasoftware.com/blogs/im...ootkit-1.07.zip. Please try running 1.07 but still send me the details of your machine and installed applications to pbustamante'at'pandasoftware.com.

That 1.07 works fine.

Wher did you get 1.08? The download from the Panda site is 1.07. This is the download I used.
http://www.pandasoft...ts/antirootkit/

[mfenech]

Andavari, on Jul 11 2007, 06:50 PM, said:

AntiVir PE Classic also has a root-kit scanner. For people using it they have anti-virus and anti-rootkit all in one app, I'd use it too if it weren't for the update problems I keep having with AntiVir.

You're still having them? I haven't had any update trouble nor have I heard complaints in a while now.

[Anthony A]

Just tried the "in depth scan" that requires a restart and it scanned with no problems.

[Andavari]

mfenech, on Jul 11 2007, 10:46 PM, said:

You're still having them? I haven't had any update trouble nor have I heard complaints in a while now.

Yes I'm still having update issues. I recently got sick of Avast again and decided to switch back to either AntiVir or AVG. I would've preferred AntiVir but it just sits there and doesn't want to update, therefore I had to go with AVG.

Edit:
Supposedly my network settings are "borked" according to several software titles, however upon checking them and even reinstalling my ISP software that enables my DSL modem I find nothing out of the ordinary.

[CeeCee]

Anthony A, on Jul 12 2007, 03:14 AM, said:

Wher did you get 1.08?

From this link: http://research.pandasoftware.com/blogs/im...AntiRootkit.zip

Site: http://research.pandasoftware.com/blogs/re...t-Released.aspx

Andavari, on Jul 12 2007, 06:18 AM, said:

I recently got sick of Avast again

Why? What it was about Avast, that you got sick of?

[Anthony A]

Well spent several hours researching and trying out several of these Anti-Rootkit programs. I like the Panda one the best so far and I have tried Blacklight, Sophos, AVG, and Panda. Panda is getting good reviews. It's tiny and no install required. I had no issues with it like CeeCee did but I ran 1.07 not 1.08. It has a scan on start up option to check for things that might not get detected in a normal scan. Very simple clean GUI and easy to use. From the reviews I have read Panda is much more thorough compared to some of the others. It scans the registry AVG and Blacklight do not. AVG didn't get good reviews. Blacklight is only free until October.
Here is a review of Panda http://www.pcmag.com...,2119254,00.asp

[CeeCee]

Anthony A, on Jul 12 2007, 01:51 PM, said:

Well spent several hours researching and trying out several of these Anti-Rootkit programs.

You are hellofatester.

[Anthony A]

CeeCee, on Jul 12 2007, 10:57 AM, said:

You are hellofatester.

All I could really test is how smooth they ran and how easy to use and install they were. I had to rely on reviews about how well they cleaned since I don't have anything to clean

[Anthony A]

CeeCee, on Jul 11 2007, 08:18 PM, said:

Just download AutoRuns. Launch Autoruns.exe and go to "Drivers" tab. Uncheck "AVG Anti-Rootkit driver" and "AVG7 Clean Driver". Then just close AutoRuns program. Of course you can't use AVG Anti-Rootkit after that. When you want use it again, just check those drivers and reboot Windows.

Hey Cee Cee are you sure the AVG7 Clean Driver is for the Anti-Rootkit and not the Anti Virus or Anti Spyware? I have that driver in two machines that never had AVG Anti rootkit installed.

[CeeCee]

Anthony A, on Jul 12 2007, 04:25 PM, said:

Hey Cee Cee are you sure the AVG7 Clean Driver is for the Anti-Rootkit and not the Anti Virus or Anti Spyware?

I don't got AVG Antivirus -or Spyware. Those two files came for me with that AVG Anti-rootkit. Of course i cannot say, if those other AVG programs uses that same file also...