Security Incidents mailing list archives
Re: Help, possible rootkit
From: Harlan Carvey <keydet89 () yahoo com>
Date: Sun, 24 Oct 2004 14:21:15 -0700 (PDT)
Sounds more like a process or driver problem than anything else. In a nutshell, you really haven't presented any information showing that you *do* have a rootkit. Outside of pure speculation, you do not have anything that shows that you have a rootkit. Did you find an open port via nmap that does not show up on netstat or openports? Did you find some traffic on your network coming from a port that doesn't show up in the netstat output? Did you run pslist against the system (or a WMI-based program or script) that turned up processes running that don't show up when you run the tools locally? Did you find Registry entries (in the ubiquitous Run key) that show up when the system is booted to Safe Mode, but not when it's booted normally? Harlan --- BillyBob <billybobknob () hotmail com> wrote:
I have noticed that my XP system is behaving like I have a rootkit. - My mouse is jumpy (it freezes for a second when I move it around the desktop) and the minimized Taskmanager in the systray shows I have around 25 - 30 % usage, but when I open it, there is no process listed using this much. - I did a netstat, fport, openports and none of these show that I have any odd ports open or any connections established. - even when I disconnect from the Internet these symptoms do not stop. They stop if I reboot, but then start again. I have ran VICE, Klister, PatchFinder and RkDetect from rootkit.com and they could not find anything. Any more suggestions ? Any more rootkit finding tools for Windows ? Thanks Bill
===== ------------------------------------------ Harlan Carvey, CISSP "Windows Forensics and Incident Recovery" http://www.windows-ir.com http://groups.yahoo.com/group/windowsir/ "Meddle not in the affairs of dragons, for you are crunchy, and good with ketchup." "The simplicity of this game amuses me. Bring me your finest meats and cheeses." ------------------------------------------
Current thread:
- Help, possible rootkit BillyBob (Oct 24)
- Re: Help, possible rootkit Glenn Sieb (Oct 24)
- Re: Help, possible rootkit Harlan Carvey (Oct 24)
- Re: Help, possible rootkit Arias Hung (Oct 24)
- Re: Help, possible rootkit Marcus Merrin (Oct 24)
- RE: Help, possible rootkit Benjamin Tomhave (Oct 24)
- RE: Help, possible rootkit Leif Ericksen (Oct 25)
- <Possible follow-ups>
- Re: Help, possible rootkit Ralph W. Reid (Oct 24)
- RE: Help, possible rootkit Tony Langdon (ATC) (Oct 25)
- RE: Help, possible rootkit k levinson (Oct 25)
- RE: Help, possible rootkit Bowes, Ronald (EST) (Oct 25)