Re: Help, possible rootkit

[Glenn Sieb <ges () wingfoot org>]

BillyBob said the following on 10/23/2004 12:06 PM:

> I have noticed that my XP system is behaving like I have a rootkit.
>
> - My mouse is jumpy (it freezes for a second when I move it around the
> desktop) and the minimized Taskmanager in the systray shows I have around
> 25 - 30 % usage, but when I open it, there is no process listed using this
> much.
> - I did a netstat, fport, openports and none of these show that I have any
> odd ports open or any connections established.
> - even when I disconnect from the Internet these symptoms do not stop.  They
> stop if I reboot, but then start again.
>
> I have ran VICE, Klister, PatchFinder and RkDetect from rootkit.com and they
> could not find anything.
>
> Any more suggestions ?
> Any more rootkit finding tools for Windows ?
>  
http://www.lavasoft.de/  http://security.kolla.de/

Grab AdAware and Spybot Search & Destroy.

My bet is spyware--this is the usual behaviour I've seen on PCs infected 
therein.

Best,
Glenn

--
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
         ~Benjamin Franklin, Historical Review of Pennsylvania, 1759