[tomdkat]

Is it common for rootkits to prevent the execution or installation of software on Windows? How do would you know if you were infected with a rootkit?

Peace...

[AKAJohnDoe]

I would probably run GMER or HiJackThis or manually look in the hidden PNP drivers in Device Manager. Secondarily I might use the SysInternals Suite. Beyond that there is MBAM and SAS.

[Imanuel4u]

I would use SAS.

[mrss]

My opinion is to run a fixmbr occasionally. Some of the badder rootkits can hide in the Master Boot Record and can't be easily seen/touched by windows applications.

However, their resultant actions are often caught by heuristic or HIPS scanners and the files they generate are sometimes caught by signature scanners after they have been detected in the field by the AV writers.




.

[tomdkat]

Thanks for the replies. I just found a link to the "Rootkit Revealer" by Microsoft. Has anyone here used this utility?

Peace...

[Elvandil]

Generally, I boot from another Windows installation (like UBCD4Win) and check my drivers. Each time I have found drivers in the Drivers folder (and services in the registry) that were hidden by the rootkit. They are easily removed this way, and then a scan cleans up the rest.