said by ZZZZZZZ :

..........a popup says that there is a malicious entry in the hosts file and that it can't start until it's deleted and then it gives you a choice to delete it,but doesn't show you the actual entry?

said by spy1 :

Well, if nothing else, at least PrevX CSI agrees with everything else I have here that checks for rootkits. Pete

said by Blackbird :

To clarify: I'm not accusing them. It's just that when you make, sell, and use hammers intensively, everything can start to look like a nail.

said by qrkx :

...I thought it is agreed upon the fact that once root-ed zee boxen needs to be incinerated. ...

said by qrkx :

Well - nine out of seven dentists believe scotch is better than Novocain.

Anyway, is SysInternals RootkitRevealer sufficient, or should one be using more/different tools?

said by lefty1 :

While running SystInternals RootkitRevealer, it stops every minute or so and gives me an error message about only having partial compatibility with Vista. Now why am I not surprised by that?

said by Blackbird :

Well, if one were to take the 1-in-5 rootkit infection stats at face value, one would naturally expect that infection rate to carry through pretty much across the spectrum. So are we seeing rootkits at that level across the board... in repair shops, at the consultant/guru level, at corporate IT departments, amongst home users, etc, etc?

said by daveinpoway :

Remember that infection statistics from those of us in the know does not give the true picture, since many more PC's are owned by John and Jill (Clueless) Public. Given the fog in which many of these users operate, I have no doubt that many of their systems (quite possibly considerably more than 20%) have some sort of infection(s), and these folks would have no way of knowing what sort of "guests" have hitched a ride inside of their Windows installation, nor would they understand how to evict the "guests", even if they knew they were present.

said by Elite :

Prevx CSI and the their full-blown HIPS both have shitty rootkit detection.

I don't know if CSI any any at all, actually.

Full product has very weak detection.

said by Elite :

Prevx CSI and the their full-blown HIPS both have shitty rootkit detection.

I don't know if CSI any any at all, actually.

Full product has very weak detection.

said by fatdcuk :

But still FWIW i have samples in the zoo such as Nulprot,TR-inject(Allinone)that bypass this tool and have other samples that bypass Kaspersky7 series the last time i tested it.

said by Elite :

RkU, but that's a bit too advanced for some.

said by odreian615 :

I use AVG Anti-Rootkit free
»www.grisoft.com/doc/products-avg···1.1.0.42
works just fine IMO

said by Elite :

GMER and DarkSpy are both very reputable anti-rootkits.

IceSword is also very good.

However, none of these 3 anti-rootkits are very user-friendly. As with RkU, you really need to know what you're looking for.

said by Bubba17 :

Obviously, too, there must be something inherently difficult associated with anti that I don't understand, else, I would think, some security company would have already created "the" (if not one of "the") program(s) that could reliably, definitively, perform anti while being "user friendly".

said by Bubba17 :

As for "really need to know what you're looking for" ... do you have a couple of links you might share where one could attempt rootkit self education, for dummies, like myself? Or, is knowing what to look for beyond the average users ability?

said by Bubba17 :

Notice ... I didn't announce I was clean.

said by AB :

I think I owe a debt of gratitude to SipSizurp's and the others' clients though, that shouldered the burden and helped to keep me in that other 75 or 80% percentile.
Whew! Close one!

said by Bubba17 :

You found something?