full-disclosure - Help, possible rootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200410231947.i9NJlFe23111@netsys.com>
From: alanme at melmac.co.uk (Alan Melia (Melmac))
Subject: Help, possible rootkit

First check to see what processes are running.  TaskList is built in but I
would recommend.
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Get to know your machine and what processes are running normally.  With
25-30% CPU it should stick out like a sore thumb.  

Oh yeah don't run as admin (see http://blogs.msdn.com/aaron_margosis).

Alan

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of BillyBob
Sent: 23 October 2004 17:05
To: Full Disclosure
Subject: [Full-Disclosure] Help, possible rootkit

I have noticed that my XP system is behaving like I have a rootkit.

- My mouse is jumpy (it freezes for a second when I move it around the
desktop) and the minimized Taskmanager in the systray shows I have around
25 - 30 % usage, but when I open it, there is no process listed using this
much.
- I did a netstat, fport, openports and none of these show that I have any
odd ports open or any connections established.
- even when I disconnect from the Internet these symptoms do not stop.  They
stop if I reboot, but then start again.

I have ran VICE, Klister, PatchFinder and RkDetect from rootkit.com and they
could not find anything.

Any more suggestions ?
Any more rootkit finding tools for Windows ?

Thanks
Bill

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html