Re: Help, possible rootkit

[Harlan Carvey <keydet89 () yahoo com>]

Sounds more like a process or driver problem than
anything else.  

In a nutshell, you really haven't presented any
information showing that you *do* have a rootkit. 
Outside of pure speculation, you do not have anything
that shows that you have a rootkit.

Did you find an open port via nmap that does not show
up on netstat or openports?

Did you find some traffic on your network coming from
a port that doesn't show up in the netstat output?

Did you run pslist against the system (or a WMI-based
program or script) that turned up processes running
that don't show up when you run the tools locally?

Did you find Registry entries (in the ubiquitous Run
key) that show up when the system is booted to Safe
Mode, but not when it's booted normally?

Harlan


--- BillyBob <billybobknob () hotmail com> wrote:

> I have noticed that my XP system is behaving like I
> have a rootkit.
>
> - My mouse is jumpy (it freezes for a second when I
> move it around the
> desktop) and the minimized Taskmanager in the
> systray shows I have around
> 25 - 30 % usage, but when I open it, there is no
> process listed using this
> much.
> - I did a netstat, fport, openports and none of
> these show that I have any
> odd ports open or any connections established.
> - even when I disconnect from the Internet these
> symptoms do not stop.  They
> stop if I reboot, but then start again.
>
> I have ran VICE, Klister, PatchFinder and RkDetect
> from rootkit.com and they
> could not find anything.
>
> Any more suggestions ?
> Any more rootkit finding tools for Windows ?
>
> Thanks
> Bill


=====
------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://groups.yahoo.com/group/windowsir/

"Meddle not in the affairs of dragons, for
you are crunchy, and good with ketchup."

"The simplicity of this game amuses me. 
Bring me your finest meats and cheeses."
------------------------------------------