Windows antirootkit tools that run in Linux

Today I just finished repairing someone's Windows Vista installation. The person in question had come across a hacked website while browsing with UAC and Protected Mode turned off, relying solely on McAfee AV and Windows Defender for their protection.
I was (apparently) able to clean up the aftermath using the Kaspersky live CD, Malwarebytes Antimalware, and HijackThis. However, several Windows based antirootkit tools I tried to run - Gmer, Avira Antirootkit, and Rootkit Revealer - all failed, leading me to suspect a rootkit infection. The (generally poor quality) antirootkits I could get running didn't turn up anything, but I was still suspicious.
I wound up abandoning the rootkit search after scanning with SuperAntiSpyware and ClamAV and Avira live CDs, as well as Sophos Antirootkit and Trend Micro RootkitBuster, all of which turned up nothing. But I'm still annnoyed that I wasn't able to get in a dedicated antirootkit scan from a live CD.
Now normally my solution would be to create a BartPE live CD with Gmer or something on it. Unfortunately though, I don't feel like forking out a day's worth of work for Windows 7 or Vista SP2, and the security situation on XP SP3 has gotten so vile that I feel it's simply no longer viable as a personal OS. So my netbook has only Linux partitions now, and all the other computers in the house are either Ubuntu LTS, Windows 2000, or G3s running MacOS 9.x. (No I'm not kidding.) In other words, BartPE would be a real pain to set up.
So...
Does anyone know of dedicated software for detecting Windows rootkits, that can run in a live Linux environment? It looks like I got lucky this time, but next time I'd rather not rely so much on luck.

ckrootkit and rkhunter are both good, but neither are dedicated to Windows.

Similar Messages

  • Can anyone suggest a windows XP emulator that runs on OS 10.6 on my iMac?

    It would seem a simple request but I cannot find, and maybe it is me being a Mac-dufus, an emulator, that runs on my mac, such that I can run a 32 bit windows XP software application.   
    Can anyone suggest a solution?  thanks

    Sincerely, thanks for the amazingly quick reply/post.
    FYI - VMware fusion only works with 10.7 and higher, Virtualbox is clunky and I think you need a compute science degree to operate it.
    New virtual machine when I tried to ijnstall the trail version offers a migrate from PC or install windows from a DVD or image.......and I don't ewant to do that, I just want to run an emulator, install 2 XP 32 bit applications and be able to run them in the emulator is all.    AM I missing something?   thanks again for any help in advance

  • How to deploy an ADF RC application to any OC4J that running on Linux?

    I developed an application with the latest Jdev 11gTP3. The team has a linux server that I want to install an OC4J and deploy my application.
    I tried the following:
    1. OC4J standalone 11g. Followed the installation instruction, with the command:
    $ORACLE_HOME/bin/oc4j -start
    I can initiate a server connection from Jdev, even passed test. But when deployment failed, I even tried to install ADF runtime library by following an Oracle official document. However, I can't get it work.
    2. I tried to start the Jdev embedded OC4J with command:
    java -jar oc4j.jar
    I believe something has to be set before the application can work on this OC4J
    Has anyone ever made it? Can you please share the steps of accomplishing it?
    Many thanks in advance.

    Thanks Frank for your reply
    This can not be done with TP1 OC4J even with proper configuration and amendment?
    How about WebSphere and Weblogic servers?
    So at this stage, a TP3 ADF application could only run on JDev Embedded OC4J?
    Regards,
    William

  • Can executable VI compiled using Windows version AppBuilder be run on Linux OS

    Hi, has anyone tried running executable VI, created in Windows version LV, on Linux or other operating systems. Please share your experience...thx
    Regards

    duplicate post: http://forums.ni.com/ni/board/message?board.id=170​&message.id=209592#M209592
    Message Edited by altenbach on 10-10-2006 08:56 PM
    LabVIEW Champion . Do more with less code and in less time .

  • Connecting cannon printer HP Slatebook 12 with Audio Beats that runs on Linux?

    I just purchase the new HP Slatebook 12 laptop with Audio Beats a few days ago and I would like to connect my Canon Pixma Printer/Scanner which is brand new to my laptop, but my problem is that my laptop has Linux not Windows which means the Canon printer setup software can't be uploaded in its drives because my HP Slatebook comes with Cloud for storage of my files. I also have a headset with mic that has a usb flash rather than the usual basic headphone jack. I really need assistance in connecting both for my online classes at Concordia University Texas which start the 1st of next week.
    Can someone please give me some assistance with this?
    Thanks

    I would suggest you ask your question in a Canon Forum.  
    Sorry, but I have no idea what a "headset with mic that has a usb flash" means!
    WyreNut
    I am a Volunteer here, not employed by HP.
    You too can become an HP Expert! Details HERE!
    If my post has helped you, click the Kudos Thumbs up!
    If it solved your issue, Click the "Accept as Solution" button so others can benefit from the question you asked!

  • I have lost the tool bar that runs along top of your web page, the one that has your bookmarks on it ,how do i get it back, i unticked it in error !

    how do i reinstate the tool bar/menu bar that runs along top of web page, the one that has your bookmarks on it plus others if required , i unticked it in error and cannot get it back, help!
    == User Agent ==
    Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

    In Firefox 3.6 on Windows you can hide the menu bar via "View > Toolbars" or via the right click context menu on a toolbar.
    Press and hold the Alt key down to bring up the menu bar.
    Go to "View > Toolbars" or right-click the menu bar or press Alt+V T to select which toolbars to show or hide.
    See also [[Menu bar is missing]]

  • I have iTunes 11 on my PC that runs windows 8. I can't use home sharing? What do I do?

    I have iTunes 11 on my PC that runs windows 8. I can't use home sharing? What do I do?

    Not sure about the CD burning issue but you can turn off the listing of your past purchases. Edit > Preferences > Store > Untick Show iTunes in the Cloud purchases.
    tt2

  • IPhone 5 running ios7.1.1 is no longer recognised by iTunes on my pc that runs windows 7

    iphone 5 running ios 7.1.1 is no longer recognised by itunes on my pc that runs windows 7 and i cannot sync.

    This is a common issue and a solution could have easily been found by searching the forums or google.
    Device not detected in iTunes for Windows

  • Windows not recognizing my time capsle - I just purchased a new computer that runs windows 8 and it doesn't want to recognize the time capsule as an external hard drive (ie doesn't show up under my compter).  I've downloaded airport utility...

    I just purchased a new computer that runs windows 8 and it doesn't want to recognize the time capsule as an external hard drive (ie doesn't show up under my compter).  I've downloaded and run airport utility, but it seems to have a hard time finding the time capsule...maybe one out of 10 times it will find it.
    What's more, when I look under network infrastructure under the control panel, it shows my Broadcom ADSL centurylink Router...so I'm wondering if my modem/router combo is overriding the router function on my timecapsule and the time capsule is not being used as a router...
    Any help much appreciated!

    In this case the TC should be in bridge mode.
    Win8 is still problematic. Try using ethernet instead of wireless. I think the drivers are poor still and it is well worth having a try via ethernet if you haven't already.
    Otherwise you will need to wait for apple to release bonjour for windows 8 and airport utility.. which is not out yet.
    Also make sure the windows is set to home, not work or public.. even turn off the firewall.
    Open windows explorer and type the TC ip address into the address bar.. (none of which is perhaps the same.. I gave away windows at vista.. shudder)
    \\TCIPadderss.

  • HT4410 If I install Windows 7 on my MacBook Pro using Bootcamp, now having 2 start up drives, do I select the Windows drive, then I can install a software program that runs only on a PC?

    If I install Windows 7 on my MacBook Pro using Bootcamp, now having 2 start up drives, do I select the Windows drive, then I can install a software program that runs only on a PC?

    Thank you

  • Hi. Whenever I go through one of the menus in firefox, the links remain highlighted after my mouse passes over them. Is there a bug fix for this or is there something wrong with my computer? I am running windows 7 if that helps.

    Hi. Whenever I go through one of the menus in firefox, the links remain highlighted after my mouse passes over them. Is there a bug fix for this or is there something wrong with my computer? I am running windows 7 if that helps. This problem started ever since I upgraded to version 5.

    I have downloaded and used the iPod Reset Utility, alot that did. My current state is iTunes on my XP Home with SP3 sees the iPod. When I drag a song to the iPod, the Sync message appears for about 5 minutes, then the Apple symbol appears. But no song has been transferred to the iPod.
    I tried to tap into the XP iTunes database from my iBook, but although it acted like it would add the XP library to the iBook library, it did not. I've got 19 Gs of songs on the XP. If I have to load each song from its original CD to get it on my iBook I'm going to start looking for some other app or device so that I can listen to my music.
    It is a shame, in the old days, Apple techs use to look at what was going on, now it appears they don't, so they never know they have problems until Apple's profits fall.

  • I want to install a learn software that runs normally in windows?

    I am trying to instal a lern software for my kid on a mac that runs only on windows. is there a possibilty to download it and make it run?

    Have your cake and eat it too!   With the Intel Macs, you can run windows in a virtual machine. You will need our own copy of Windows.
    Don't miss the free VirtualBox.
    "VirtualBox is a general-purpose full virtualizer for x86 hardware. " Runs Windows on Mac OS.
    http://www.virtualbox.org/
    Parallels:
    http://www.parallels.com/en/products/desktop/
    & some catalog order places sell Parallels for 9.99 when you buy a mac.
    With VMware Fusion, run the most demanding Mac and Windows applications side-by-side at maximum speeds without rebooting
    http://www.vmware.com/products/fusion/
    Wine emulates the windows api's on an intel Mac.
    "Wine lets you run Windows software on other operating systems. With Wine, you can install and run these applications just like you would in Windows."
    http://www.winehq.org/
    Robert

  • I work in a High School and I am looking for a new library system that runs on the mac and is not windows based, can anyone recommend anything?

    I work in a High School and I am looking for a new library system that runs on the mac and is not windows based, can anyone recommend anything?

    That's a very broad question and difficult to answer without knowing more about you requirements.
    Try starting on this page Category review: library management software for the Mac |Part I  and part II  to get a starting point.
    regards

  • How to install or attach or add the plugins '.mnu and .vlx' to autocad 2012 or 2013 (mac version). In windows, its 'menuload' and express tools, that helps for it. But this command doesn't exist in mac version. so is there any other command or solution?

    How to install or attach or add the plugins '.mnu and .vlx' to autocad 2012 or 2013 (mac version). In windows, its 'menuload' and express tools, that helps for it. But this command doesn't exist in mac version. so is there any other command or solution?

    Please see autocad support at autodesk.com
    http://docs.autodesk.com/ACD/2014/ENU/index.html?url=files/GUID-5E50A846-C80B-4F FD-8DD3-C20B22098008.htm,topicNumber=d30e484012

  • I have an epson T50 shared network, which is connected to a computer that runs on Windows 7 64-bit. The 10 days Apple has updated the printer drive and since then has been trying to print the following message: / Library/Printers/EPSON/InkjetPrinter2/Filt

    I have an epson T50 shared network, which is connected to a computer that runs on Windows 7 64-bit. The 10 days Apple has updated the printer drive and since then has been trying to print the following message: / Library/Printers/EPSON/InkjetPrinter2/Filter/rastertoescpII.app/Contents/MacOS/ rastertoescpII failed.
    What should I do?

    The first thing you should do is re-write your post to make it a bit more understandable. I got you have an Epson printer connected to your PC, however after that  your post doesn't make any sense. Are you attempting to print from your iMac, if so then you need to download and install Bonjour for Windows on your Windows machine. Then set Windows so it has printer sharing turned on and then on the iMac simply follow Apple's instructions for adding a printer.
    http://support.apple.com/kb/DL999
    http://support.apple.com/kb/HT4670

Maybe you are looking for

  • How to send email notifications to customers?

    Hi All, We have a requirement to send 'Order Acknowledgement' email notification to customers when their order is booked. My question is how do you set up the workflow to pick up the email address of the customer. Any help is appreciated! Thanks

  • Partial Payment

    Hi Gurus I have got a query if anybody help me out in this. After entering the invoice in the system i want to clear it with partial payment and system does that and generates a clearing document against each other. Both invoice and partial payment r

  • Runtime error(Time limit exceeds)after executing select query

    Dear experts, whenever i executing the select query in this zprogram i am getting runtime error that time limit exceeds.i am using inner join and into table.after that also i am geetting error. how can i resolve it?? SELECT LIKP~VBELN LIKP~WADAT_IST

  • NO ACCOUNTING DOC in GI

    Created Sales Order (SO) with ItCat = TAB PR is created in SO. Created Purc Req (PR) Created Purc Ord (PO) Acnt Assign Cat = M GBB VKA = A Goods Receipt NO PROBLEM debit A credit GRIR Account Goods Issued Material Document created BUT NO ACCOUNTING D

  • What do you mean by extracting the setting of the UAT/ prod db

    I am curious how do i go about extracting the setting of a db. There is a request from client that they want to compard the difference between the uat and the production. Please further advise.