full-disclosure - Help, possible rootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: randallm at fidmail.com (RandallM)
Subject: Help, possible rootkit

Billy said:

--__--__--

Message: 1
From: "BillyBob" <billybobknob@...mail.com>
To: "Full Disclosure" <full-disclosure@...ts.netsys.com>
Date: Sat, 23 Oct 2004 13:05:29 -0300
Subject: [Full-Disclosure] Help, possible rootkit

I have noticed that my XP system is behaving like I have a rootkit.

-- -- --
 __ __

Billy,
1. Go directly to safe-mode
2. go to regedit and check start up processes in computer and user and
research each unfamiliar
3. run hijack this program
4. run spybot
5. upon start up use tcp-view and process viewer from sysinteral.com to see
connections

One person made mention of this once when I had this problem on a sales
laptop:

"If you have scripting enabled, it is possible that one of them is doing
this in the background.  Scripts can remain active after you have left
the page that started them.

Some PC programmers tend to use "busy waits" instead of calling a 
sleep() or hibernate() function.  This tends to kill performance on 
multiuser systems."

Optical mice also don't work well with certain colored pads and such. Make
sure you try
A different surface. 

Also of course clean the area very well. A piece of hair can cause problems.

Just some quick thoughts

thank you
Randall M