Re: Help, possible rootkit

From: Harlan Carvey (
Date: 10/24/04

  • Next message: Arias Hung: "Re: Help, possible rootkit"
    Date: Sun, 24 Oct 2004 14:21:15 -0700 (PDT)
    To: Incidents <>

    Sounds more like a process or driver problem than
    anything else.

    In a nutshell, you really haven't presented any
    information showing that you *do* have a rootkit.
    Outside of pure speculation, you do not have anything
    that shows that you have a rootkit.

    Did you find an open port via nmap that does not show
    up on netstat or openports?

    Did you find some traffic on your network coming from
    a port that doesn't show up in the netstat output?

    Did you run pslist against the system (or a WMI-based
    program or script) that turned up processes running
    that don't show up when you run the tools locally?

    Did you find Registry entries (in the ubiquitous Run
    key) that show up when the system is booted to Safe
    Mode, but not when it's booted normally?


    --- BillyBob <> wrote:

    > I have noticed that my XP system is behaving like I
    > have a rootkit.
    > - My mouse is jumpy (it freezes for a second when I
    > move it around the
    > desktop) and the minimized Taskmanager in the
    > systray shows I have around
    > 25 - 30 % usage, but when I open it, there is no
    > process listed using this
    > much.
    > - I did a netstat, fport, openports and none of
    > these show that I have any
    > odd ports open or any connections established.
    > - even when I disconnect from the Internet these
    > symptoms do not stop. They
    > stop if I reboot, but then start again.
    > I have ran VICE, Klister, PatchFinder and RkDetect
    > from and they
    > could not find anything.
    > Any more suggestions ?
    > Any more rootkit finding tools for Windows ?
    > Thanks
    > Bill

    Harlan Carvey, CISSP
    "Windows Forensics and Incident Recovery"

    "Meddle not in the affairs of dragons, for
    you are crunchy, and good with ketchup."

    "The simplicity of this game amuses me.
    Bring me your finest meats and cheeses."

  • Next message: Arias Hung: "Re: Help, possible rootkit"