14 replies to this topic

[Icedrake]

Anyone know of a good freeware anti-rootkit program?

[Andavari]

These are currently freeware from reputable companies:
* Panda Anti-Rootkit
* Avira Anti-Rootkit

Do note that if you switch to either Avast Antivirus Home Edition, or AntiVir PersonalEdition Classic that they include rootkit detection build-in.

[Coronagold]

The Avira AntiRootKit Tool (beta) finds more rootkit entries than AntiVir free does.

[Anthony A]

Here are two more. Both are no install apps.

F-Secure Black Light. Link is at the bottom of the page http://www.f-secure....ecurity_center/

Trend Micro Rootkit Buster http://www.trendmicr...oad/rbuster.asp

[Tom AZ]

Just downloaded and tried to install Avira Anti-Rootkit Tool. However, couldn't get the Setup.exe file to open. Anyone else have that problem? Or, is there possibly another way to install it?

[Anthony A]

Tom AZ, on Apr 26 2008, 10:46 PM, said:

Just downloaded and tried to install Avira Anti-Rootkit Tool. However, couldn't get the Setup.exe file to open. Anyone else have that problem? Or, is there possibly another way to install it?

Go with the two I linked or the Panda one. All 3 do not require an install.

[davey]

Tom AZ, on Apr 26 2008, 10:46 PM, said:

Just downloaded and tried to install Avira Anti-Rootkit Tool. However, couldn't get the Setup.exe file to open. Anyone else have that problem? Or, is there possibly another way to install it?

Is it an executable also?As a matter of fact, aren't they all?
davey

[Andavari]

Tom AZ, on Apr 26 2008, 08:46 PM, said:

Just downloaded and tried to install Avira Anti-Rootkit Tool. However, couldn't get the Setup.exe file to open. Anyone else have that problem? Or, is there possibly another way to install it?

Maybe it was corrupted during the download. I've used it and removed it.

The one I really like is Panda Anti-Rootkit, it will even check for an update before scanning.

Many of the free anti-rootkit scanners haven't been updated for months!

[login123]

IceSword is pretty good, but detects many processes that are harmless. Info and a download link:
http://www.castlecops.com/t165203-IceSword...llustrated.html

SpyBot S&D is getting into rootkit finding; they describe their present app as "a work in progress". Info and a download link:
http://forums.spybot...ead.php?t=24185

Sophos has a good one. You have to register to download it:
http://www.sophos.com/products/free-tools/...ti-rootkit.html

Sysinternals has a good one: RootKit Revealer. Info and a download link:
http://technet.microsoft.com/en-us/sysinte...s/bb897445.aspx

None of the above require installation, all are free. I just use them to find out whats going on in my computer...never have found anything ugly, thank goodness. Would have to get expert help if an actual rootkit showed up. You have to be careful, a lot of processes that look scary are really legitimate.

Also I think you do have to install the Avira RKD, but no reboot is required.

[Andavari]

login123, on Apr 27 2008, 07:37 PM, said:

Also I think you do have to install the Avira RKD, but no reboot is required.

It does have to be installed.

Some of those others that claim they can just be ran without installing are actually adding stuff onto the system like adding a line into a Windows .ini file like win.ini, etc.,, or writing stuff into the registry.

[Anthony A]

login123, on Apr 27 2008, 09:37 PM, said:

IceSword is pretty good, but detects many processes that are harmless. Info and a download link:
http://www.castlecops.com/t165203-IceSword...llustrated.html

SpyBot S&D is getting into rootkit finding; they describe their present app as "a work in progress". Info and a download link:
http://forums.spybot...ead.php?t=24185

Sophos has a good one. You have to register to download it:
http://www.sophos.com/products/free-tools/...ti-rootkit.html

Sysinternals has a good one: RootKit Revealer. Info and a download link:
http://technet.microsoft.com/en-us/sysinte...s/bb897445.aspx

None of the above require installation, all are free. I just use them to find out whats going on in my computer...never have found anything ugly, thank goodness. Would have to get expert help if an actual rootkit showed up. You have to be careful, a lot of processes that look scary are really legitimate.

Also I think you do have to install the Avira RKD, but no reboot is required.

Some of those ones you mentioned are for advanced users. You need to know what you are doing with them. Panda and Blacklight are very easy to use.

[login123]

Andavari, on Apr 27 2008, 08:54 PM, said:

It does have to be installed.

Some of those others that claim they can just be ran without installing are actually adding stuff onto the system like adding a line into a Windows .ini file like win.ini, etc.,, or writing stuff into the registry.

You are quite right, Andavari. But none of those I listed change the registry very much as far as I can tell, nor compromise performance after they are run. Sophos does add a stubborn key: HKLM\...\LEGACY_MEMSWEEP2, but no harm done as I can tell.

Anthony_A is right too. You gotta know what you're doing. Expert help is called for if you think you have found a rootkit. If it was easy everybody would be doin' it.

[Coronagold]

Like me!

[LUSHER]

A couple more tools here http://wiki.castlecops.com/Lists_of_freewa...al_AV_companies

Bitdefender, Mcafee, Sophos , AVAST, Spybot all also provide standalone antirootkits ...

[hazelnut]

Looks like DiamondsCS may be back up and running.

A new beta from them is Deep System Explorer for finding new and future rootkits
Info here
http://www.diamondcs.../detections.php

Some of you may recognise some of their windows freeware
http://www.diamondcs...eeutilities.php