Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A list of rootkit detection and/or removal tools from publicly trusted sources:

Name, Vendor, Latest release

RootkitRevealer, Sysinternals, November 1 2006

Rootkit Unhooker, ep_x0ff (now working at Microsoft according to Rootkit.com), December 2007

F-Secure Blacklight, F-Secure, Unknown

GMER, GMER, March 2009

Microsoft Malicious Software Removal Tool, Microsoft, April 2009

IceSword, Unknown, September 2005

Please add any trusted tools that you know of to the list.

share|improve this question

8 Answers 8

RootkitRevealer

RootkitRevealer is an advanced rootkit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys).

share|improve this answer

F-secure blacklight (free, Windows)

share|improve this answer

GMER, GMER, March 2009

One of the most complete and updated scanner/fixer, I found that it could find the most rootkits, and has a steady stream of updates.

share|improve this answer

I have had occasional success using the Ultimate Boot CD for Windows so that I can run an "offline" scan of the infected system. The Achilles Heel of most well-known root kit scanners is that the root kits know about them as well. See: http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=359

share|improve this answer

Rootkit Unhooker, ep_x0ff (now working at Microsoft), December 2007

share|improve this answer

For Linux:
chkrootkit, Pangeia Informatica (BSD Open Source) 12/17/2007
rkhunter, Rootkit.nl (GPL Open Source project) 12/31/2008

share|improve this answer

"ThreatExpert is an advanced automated threat analysis system designed to analyze and report the behavior of computer viruses, worms, trojans, adware, spyware, and other security-related risks in a fully automated mode." -- www.threatexpert.com/default.aspx

"Our free software, Sophos Anti-Rootkit scans, detects and removes any rootkit that is hidden on your computer using advanced rootkit detection technology." -- www.sophos.com/products/free-tools/sophos-anti-rootkit.html

"SuperAntiSpyware. Detect and Remove Spyware, Adware and Remove Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers, Parasites, Rootkits, Rogue Security Products and many other types of threats." -- www.superantispyware.com/

('sorry, new users aren't allowed to add hyperlinks'. Can someone edit this and activate the links please)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.