Security Incidents mailing list archives

Re: Help, possible rootkit


From: Marcus Merrin <marcus.merrin () emptyair com>
Date: Sun, 24 Oct 2004 18:53:42 -0700

BillyBob wrote:

I have noticed that my XP system is behaving like I have a rootkit.

- My mouse is jumpy (it freezes for a second when I move it around the
desktop) and the minimized Taskmanager in the systray shows I have around
25 - 30 % usage, but when I open it, there is no process listed using this
much.
- I did a netstat, fport, openports and none of these show that I have any
odd ports open or any connections established.
- even when I disconnect from the Internet these symptoms do not stop.  They
stop if I reboot, but then start again.

I have ran VICE, Klister, PatchFinder and RkDetect from rootkit.com and they
could not find anything.

Any more suggestions ?
Any more rootkit finding tools for Windows ?

Thanks
Bill



I had similar symptoms on an XP notebook.... turned out one of two memory cards had got dislodged and the box was running on half its normal memory. Took me a couple of days to figure it out (Duh!)

Marcus


Current thread: