8
votes

A list of rootkit detection and/or removal tools from publicly trusted sources:

Name, Vendor, Latest release

RootkitRevealer, Sysinternals, November 1 2006

Rootkit Unhooker, ep_x0ff (now working at Microsoft according to Rootkit.com), December 2007

F-Secure Blacklight, F-Secure, Unknown

GMER, GMER, March 2009

Microsoft Malicious Software Removal Tool, Microsoft, April 2009

IceSword, Unknown, September 2005

Please add any trusted tools that you know of to the list.

8 Answers 8

Reset to default
3
votes

RootkitRevealer

RootkitRevealer is an advanced rootkit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys).

2
votes

F-secure blacklight (free, Windows)

1
vote

GMER, GMER, March 2009

One of the most complete and updated scanner/fixer, I found that it could find the most rootkits, and has a steady stream of updates.

1
vote

I have had occasional success using the Ultimate Boot CD for Windows so that I can run an "offline" scan of the infected system. The Achilles Heel of most well-known root kit scanners is that the root kits know about them as well. See: http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=359

0
votes

Rootkit Unhooker, ep_x0ff (now working at Microsoft), December 2007

0
votes

I like Prevx

0
votes

For Linux:
chkrootkit, Pangeia Informatica (BSD Open Source) 12/17/2007
rkhunter, Rootkit.nl (GPL Open Source project) 12/31/2008

0
votes

"ThreatExpert is an advanced automated threat analysis system designed to analyze and report the behavior of computer viruses, worms, trojans, adware, spyware, and other security-related risks in a fully automated mode." -- www.threatexpert.com/default.aspx

"Our free software, Sophos Anti-Rootkit scans, detects and removes any rootkit that is hidden on your computer using advanced rootkit detection technology." -- www.sophos.com/products/free-tools/sophos-anti-rootkit.html

"SuperAntiSpyware. Detect and Remove Spyware, Adware and Remove Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers, Parasites, Rootkits, Rogue Security Products and many other types of threats." -- www.superantispyware.com/

('sorry, new users aren't allowed to add hyperlinks'. Can someone edit this and activate the links please)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .