full-disclosure - Help, possible rootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: alanme at melmac.co.uk (Alan Melia (Melmac))
Subject: Help, possible rootkit

Sorry but something MUST show up.  Enable 'Context Switch Delta' and I/O
stuff. Then inspect the process/thread with the highest Context Switch.

The most probable cause if it shows up against system is some faulty
hardware generating high hardware interrupts.  You do not have any evidence
that a rootkit is involved.  IMHO never overlook the obvious.

Alan

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of BillyBob
Sent: 23 October 2004 21:30
To: Alan Melia (Melmac); 'Full Disclosure'
Subject: Re: [Full-Disclosure] Help, possible rootkit

I have ran Process Explorer, Code Stuff Starter but nothing shows up in the
list as using this 25-30% of my CYP.  I also updated and ran PestPatrol,
NortonAV, etc but nothing  is detected which is why I think I have a rootkit
that has patched the kernel and therefore not allowing any of these programs
to detect it.

Anything else ?


----- Original Message -----
From: "Alan Melia (Melmac)" <alanme@...mac.co.uk>
To: "'BillyBob'" <billybobknob@...mail.com>; "'Full Disclosure'"
<full-disclosure@...ts.netsys.com>
Sent: Saturday, October 23, 2004 4:47 PM
Subject: RE: [Full-Disclosure] Help, possible rootkit


> First check to see what processes are running.  TaskList is built in 
> but I would recommend.
> http://www.sysinternals.com/ntw2k/freeware/procexp.shtml
>
> Get to know your machine and what processes are running normally.  
> With 25-30% CPU it should stick out like a sore thumb.
>
> Oh yeah don't run as admin (see )http://blogs.msdn.com/aaron_margosis.
>
> Alan
>
>
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of BillyBob
> Sent: 23 October 2004 17:05
> To: Full Disclosure
> Subject: [Full-Disclosure] Help, possible rootkit
>
> I have noticed that my XP system is behaving like I have a rootkit.
>
> - My mouse is jumpy (it freezes for a second when I move it around the
> desktop) and the minimized Taskmanager in the systray shows I have 
> around
> 25 - 30 % usage, but when I open it, there is no process listed using 
> this much.
> - I did a netstat, fport, openports and none of these show that I have 
> any odd ports open or any connections established.
> - even when I disconnect from the Internet these symptoms do not stop.
They
> stop if I reboot, but then start again.
>
> I have ran VICE, Klister, PatchFinder and RkDetect from rootkit.com 
> and
they
> could not find anything.
>
> Any more suggestions ?
> Any more rootkit finding tools for Windows ?
>
> Thanks
> Bill
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html