lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: billybobknob at (BillyBob)
Subject: Help, possible rootkit

I have ran Process Explorer, Code Stuff Starter but nothing shows up in the
list as using this 25-30% of my CYP.  I also updated and ran PestPatrol,
NortonAV, etc but nothing  is detected which is why I think I have a rootkit
that has patched the kernel and therefore not allowing any of these programs
to detect it.

Anything else ?

----- Original Message -----
From: "Alan Melia (Melmac)" <>
To: "'BillyBob'" <>; "'Full Disclosure'"
Sent: Saturday, October 23, 2004 4:47 PM
Subject: RE: [Full-Disclosure] Help, possible rootkit

> First check to see what processes are running.  TaskList is built in but I
> would recommend.
> Get to know your machine and what processes are running normally.  With
> 25-30% CPU it should stick out like a sore thumb.
> Oh yeah don't run as admin (see )
> Alan
> -----Original Message-----
> From:
> [] On Behalf Of BillyBob
> Sent: 23 October 2004 17:05
> To: Full Disclosure
> Subject: [Full-Disclosure] Help, possible rootkit
> I have noticed that my XP system is behaving like I have a rootkit.
> - My mouse is jumpy (it freezes for a second when I move it around the
> desktop) and the minimized Taskmanager in the systray shows I have around
> 25 - 30 % usage, but when I open it, there is no process listed using this
> much.
> - I did a netstat, fport, openports and none of these show that I have any
> odd ports open or any connections established.
> - even when I disconnect from the Internet these symptoms do not stop.
> stop if I reboot, but then start again.
> I have ran VICE, Klister, PatchFinder and RkDetect from and
> could not find anything.
> Any more suggestions ?
> Any more rootkit finding tools for Windows ?
> Thanks
> Bill
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:

Powered by blists - more mailing lists