Does anybody know what the best Open Source rootkit removal software is for windows?

Avast free for windows. Not open sourced, but free with out the bs.

Here is a link avast to try erisian
http://www.techsupportalert.com/best-fr ... emover.htm

sysinternals has one: here

Thanks everybody. I'm thinking that if AVG can't remove it then Avast might not but I'll bear it in mind.

GMS - Do you know this to be safe? I'm always wary of free Antivirus tools unless I know the name. They quite often put viruses on your computer. I've downloaded it ready anyway. Thank you very much.

The site belongs to Microsoft, I've used their utilities for several years.

If it was some third party I would be wary too but I trust Microsoft as much as anyone else does (for what that's worth) They have a LOT of very handy utilities, all of which are helpful.

Sorry, I didn't read the web address. I've got a horrible habit of not reading things properly. If it's Microsoft, of course it's safe!

I use Threatfire as my sole protection in my XP VM. It's an anti-trojan only protector but it's built-in scanner does scan for rootkits too. It's not opensource either by the way. Only a few programs are such as Clam. Not sure how good Clam is and it's been years since I even toyed with it.

http://www.threatfire.com/

Out of interest Lyle, how do you "double-sandbox" your machine? Thanks for the info.

I run XP in a VM and within my XP VM, I run Sandboxie. That, in effect, double-sandboxes my Win7 system which I rarely if ever browse online with.

As a side note, below's a Sourceforge search for Clam; it's definitely been expanded upon since I looked at it. lol



http://sourceforge.net/directory/os:win ... ed/?q=clam

Clamwin is pretty good. This rootkit is persistent though. It keeps recreating itself at boot so even AVG can't remove it, that's why I'm looking at dedicated rootkit software. How do you create a VM?

I used Virtualbox to create an XP, Linux (Ubuntu), and Win98 OS (had the license and disks for XP and Win98 so why not; lol) virtual machines which I use Win98 and Ubuntu from time to time but daily use XP VM and IE for browsing. Typing this right now in my Sandboxie executed IE. Virtuabox is free for personal use (not sure if it's opensource anymore since it's changed hands more then a myriad of times over the years; Oracle owns Virtualbox right now). As for rootkits, they can be pervasive and very hard to remove. You can try Blacklight (granddaddy of the rootkit removal tools) too (believe it's free) but your best bet would be to back your data up and re-install the OS from a wiped drive. Click link below for a few more to try.

http://www.pchell.com/support/rootkitremovaltools.shtml

I am telling you from experience and from the it field that Avast will remove it. Avast makes AVG look like a video game not a virus scanner. It actually has one of the best track records when it comes to Root kits. If that doesn't work, which I doubt go to techguy.org for some help. Best computer help for everything (except gimp)

clam is a nice removal utility but it doesn't do real time protection. I keepit on a usb drive with the rest of my repair tools.

If you've not been to sysinternals before I very strongly recommend autoruns and process explorer, both are worth their weight in gold. How much does software weight anyway?

Just wondering: I understand the will to sandbox the OS, but why placing two barriers like this ? AFAIK, the first one is 100% secure.. no ?

I've used Autoruns before and it is good. I'll try a few recommended programs first and if they don't work I'll have to try and find a way to repair my CD drive so that I can format and re-install Windows.
Thank you everybody for your suggestions. In future I'll get all of my free software from Sourceforge or a personally recommended site.

Because I don't like deleting my OS but once a month whereas I delete my sandboxie sessions a few times a week. I delete my XP OS once a month or when I'm about to do a major program changes to a prestine (virgin if you will; i.e., rarely browsed) condition and add the changes and create a snapshot when I do). Also, because Yahoo and ATT email clients can't run together (when they joined), I can keep separate sessions so I can get both my emails without logging out one email to log in to get the other. Anyway, some say I'm overly protective but even this setup doesn't protect me completely as I recently got a taste of that. lol

Still, I've kept my Win7 OS pretty prestine and my XP VM too and, for the most part, have peace of mind so whatever gives you peace of mind, I recommend you do too.

Thanks Lyle. Maybe a brand new computer, this time properly defended, dual-booting Win7 and Fedora 17 will give me peace of mind. Failing that, a formatted drive with a clean XP install will run a lot smoother as well as removing any Malware.

Actually my response was to anarkhya (keep forgetting about the quote button; lol), but again, the peace of mind comment is for all. There really is no rock solid scheme to protect against all types of malware. Only thing my scheme will protect is the OS itself. Still, rebuilding your system is really the only way to 100% assure peace of mind since when you remove a virus by using scanners, you can only think you got rid of it; killing it you will know. lol

If you had an image of your harddrive, the recovery would have been quick (been nearly a year since I made one of my system; probably should do so soon. lol). Still, if your system is old and you have the money to purchase a new one, Win7 is a pretty good OS and it will give you the horsepower (64-bit OS can access a heck of a lot more memory; my system has 6Gs of RAM) to run VMs comfortably (but I did run VMs even when I had XP). Anyway, if you do plan on rebuilding your OS, then I suppose we won't be seeing you for about a day or so. lol

Take care Erisian.