This question already has an answer here:
- How do I deal with a compromised server? 13 answers
On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with Malwarebytes, and both came up more or less clean. I downloaded RKR, unzipped, ran as admin, but it would not open. I opened the task manager to check and tried reopening the program. Sometimes the process wouldn't even show. Sometimes it would show for ~10s with a fixed amount of memory listed, and then die. Once, I got to the Sysinternals licence agreement, but it died after that. Tried renaming the EXE, no dice. Tried safe mode, no dice.
One thing I haven't done is check the event logs, which I should probably do. Besides that, what mechanism could potentially cause RKR to fail to start? Or is my system likely compromised, requiring a nuke from orbit?