Gizmos Needs You

Gizmo's Freeware is Recruiting

 We are looking for people with skills or interest in the following areas:
 -  Mobile Platform App Reviews for Android and iOS
 -  Windows, Mac and Linux software reviews       Interested? Click here

                  

 

Best Free Rootkit Scanner and Remover

 
Introduction

My co-worker John C from our east coast office came across a page on Malwarebytes' forums and thought I would share since we are putting together our tools for threat removal. The use of italics is my clumsy way of differentiating what I'm writing to Gizmo's readers and what I published to colleagues. Here is the page Malware Removal Guides and Self Help Guides.

If you read the first post it refers to Chameleon. This is a tool within Malwarebytes that can find and stop running processes form malware and is very useful on fake alert threats. Chameleon is in a sub folder within the Malwarebytes' main folder.

Below are my testing results that I published to my colleagues with some edits in order to present this to you in an easier to understand language. We are all IT folk so I tend to write to them differently than I would write to Gizmo's readers. Below I speak about System Check which is a rather nasty fake alert. In my next upcoming post I am going to present some methods for removal of these threats along with reviews of Rootkit Scanners. It has been very busy at work and I perform testing in my spare time, of which there has been very little. But I wanted to share this with you so you can add Chameleon to your USB stick.

Below, MBAM is short for Malwarebytes' Anti-Malware. And Rkill is another tool for stopping processes which I will comment on later. The next two paragraphs are from my letter to co-workers:

I tested Chameleon on System Check which is worse than most of the fake alerts in that it hides, everything. I stepped through the instructions listed in the first post of the link provided. I clicked the first box and it opened a small DOS window and then proceeds to kill processes and then update and run MBAM. All of this worked great, and had an unexpected side effect. When it killed the process I think it also killed the ability of this ‘New and Improved’ System Check from deactivating your partitions. I rebooted and came right back into Windows albeit with a black desktop and everything hidden, but it booted!! (But keep in mind, I ran this right after infection, your user will have rebooted probably. More on this below.) I didn’t clean it when MBAM ran this first time because John found that you can run Chameleon as a standalone from your USB stick, and I wanted to test. Sure enough, I copied the whole Chameleon folder over and ran the file from there. Chameleon worked just as it did before, perfect.

So this will be a permanent addition to my USB stick. This will give us the ability to stop the processes fake alerts are running right from your USB and then be able to install and run MBAM without it being compromised. Rkill works much the same way, but is a bit dicey when it runs. In order to shutdown what’s running it will actually rename files. This can be bad however because now MBAM or whatever is being used may not find the renamed file. I would always note the path from Rkill and rename it back to original so MBAM could find it.

I have other news I wanted to share with you about a tool I'm building that will reverse the damage done by the these fake alerts like System Check I refer to above, when they hide all of your menus and folders. I had posted it here but it was too lengthy. I will post a link to it so that you can read it at your leisure. Until than please check out Chameleon as it will be a good addition to any USB stick.

  Read this article in Spanish (Español)

 
In a Hurry?

Go to details...  Go straight to the Quick Selection Guide

 
Discussion

There are a lot of anti-rootkit programs available, a lot of this software is very advanced and requires an experienced and technical minded user who is familiar with computers and operating systems. However, there are a couple of options that do not require much technical ability and are also very effective.

Kaspersky TDSSKillerThe new Top pick is Kaspersky TDSSKiller. It has an easy to use GUI, fast scan times, great detection rate and is user friendly.

TDSS Killer managed to detect and remove all modern rootkits tested (TDSS, Zeus, TDLV4, etc). The only down side is TDSS Killer seems to have a narrow range of the rootkits it detects but hopefully more types will be added over time. If more strains are added this may become the definitive tool for removal of rootkits.

In my testing what it’s designed to scan for it finds every time and removes it easily and positively. The positives far outweigh the negatives on this one. TDSS Killer also includes 64 bit functionality which is a huge plus.

 

GMERRootRepealI have two top choices for all the experienced and technical users GMER and RootRepeal. These are very popular applications, but it takes someone pretty knowledgeable about computer systems to be able to interpret the results. You can find a lot of documentation on both programs but if you are the type of person (like me) who likes to click the scan button and simply wait for the results, you would be better served with TDSS Killer.

For the average user I cannot recommend either of these as without comprehensive computer knowledge the results would be very hard to interpret. I even have a hard time understanding the data. In my work I usually have no time to refer to the documentation and must move quickly to restore a computer to working condition. However, if a particularly difficult infection is present these tools are invaluable because of the wealth of information. I prefer GMER as I find the initial scanning process easier to use and it had a better detection rate han RootRepeal.

 

Avast Anti-Rootkit Avast Anti-Rootkit resembles a command prompt window but is fairly easy to use. It lets you scan your computer and MBR for rootkits and even fixes any issues. Understanding the output from Avast Anti-rootkit may be a little hard for some users but it does the job well. I tested it against TDSS and several other modern rootkits and it found all of them. Removal on the other hand was not as good as some of the other tools. But what it does have is a very useful tool that I personally would not be without; the ability to perform FixMBR right from within Windows. Normally one would have to boot to a Windows XP disc or Windows 7 recovery disc to perform this command but Avast Anti-Rootkit has a built in ‘FixMBR’ button that with one click will write a new Master Boot Record which is often necessary in the removal of rootkits. This is very useful as you may not always have a Windows disc on hand in the field. I keep this on my USB drive at all times.

 

Dr.Web CureIt!The next product that I looked at is one that I always keep in my toolkit. Dr.Web CureIt! is not a standalone anti-rootkit tool like the other tools I recommended, rather it is a free malware scanner and removal tool that happens to be pretty effective at removing some rootkits but doesn’t detect the modern threats in my testing. It is always a good idea to have more than one tool capable of removal, so Dr. Web's freeware scanner is a great addition to anybody's arsenal. What I have found useful is the sandbox environment it creates when it’s run. This is good as it stops all processes  that some malware may try to run. It is also able to deep scan your drive and you can reboot back into this environment for further scanning and removal.

 
Other Rootkit Scanners and Removers

Sophos Anti-Rootkit Sophos Anti-Rootkit has a small but easy to use interface with no options other than choosing where you want to scan. As it scans it opens up to a slightly larger interface where it lists the results of the scan and gives you information about each result as well as a recommendation for them. Additionally, a small help file is available that explains the program in a little more detail and gives directions on how to use the command line anti-rootkit tool which is also included. This would be a great tool if it was kept up-to-date but in my testing it failed to find or remove any of the modern threats I tested.

 

F-Secure BlacklightF-Secure Blacklight is another great tool for rootkit removal. Unfortunately, support for it ended a couple of years ago. However, you can still download it on the F-Secure web site and it is compatible with Windows Vista and XP.

Still works well for older rootkits but gives "Incompatible" error if ran on Windows 7. Blacklight is also unable to detect most modern rootkits and therefore, I recommend one of the other tools for now.

 

Prevx FreePrevx Free, the free version of Prevx, offers the same class leading real time detection of the full version but unfortunately it doesn't offer much more than this. Prevx Free is only capable of cleaning select infections, such as Adware, the ZEUS banking trojan, and MBR rootkits. When dealing with rootkits detection is definitely very important, so even if you can't clean all infections you might at least be alerted, enabling you to take further action and manually remove the rootkit or seek help in doing so. As hard as it is to detect the newer, ever evolving rootkits and viruses, Prevx can be a very powerful and informative addition to your regular anti-virus software.

Additionally, Prevx Free can run customized scans from the context menu and also gives you the ability to schedule scans. Another plus is that it scans quickly. The free version also offers protection of stored cookies as well as protection for all of your saved credentials. There is also a browser protection component in the free version but it only offers custom protection on only one web site of your choice. It does however, give the full Prevx Safe Online protection, which includes anti-phishing, protection against hijacks, keyloggers, and cookie stealers for a number of popular websites such as PayPal, or Amazon and of course the one website of your choice.

I have included the previous editor’s information above but would note that given the limited functionality of Prevx Free, I mainly use it for detection. Often I need to not only detect but to remove in one scan using one tool.

As I mentioned above I will leave links to the applications mentioned here as they might work for you and be your favorites. I don’t want to discourage the use of any of them but the ones I haven’t had much success with are in the Other Scanners section; so I cannot recommend them. If they work for you that’s great and I would love to hear of your successes in the comments section.

Along with my goal to provide help is also to give you only what I have found that works. I am always open however to learning of new methods and tools. I love tools and am a firm believer that you cannot have too many. In the ever changing world of threat removal we need many tools to detect and remove.

 
Related Products and Links

You might want to check out these articles too:

 
Quick Selection Guide

Kaspersky TDSSKiller
5
 
Gizmo's Freeware award as the best product in its class!

Runs as a stand-alone program on a user's computer
Easy to use GUI, high detection rate, removed all infected files in tests and is 64 bit compatible.
Limited scope and range of types of rootkits detected.
3.0.0.14
1870 KB
32 bit but 64 bit compatible
Unrestricted freeware
Windows
GMER
4
 
Runs as a stand-alone program on a user's computer
Considered class-leading technology.
No help file, but information online. Not suitable for average users.
http://www.gmer.net/
http://www.gmer.net/
2.1.19163
369 KB ZIP
Unrestricted freeware
A portable version of this product is available from the developer.
Windows 2000 to 8
Avast Anti-Rootkit
4
 
Runs as a stand-alone program on a user's computer
Works well. Detects most rootkits, easy to use. ‘FixMBR’ function within Windows is invaluable; a must have on any USB flash drive.
Results sometimes hard to interpret and removal failed on some rootkits.
http://www.avast.com/
0.9.9
1870 KB
Unrestricted freeware
There is no portable version of this product available.
Tested on Windows 7
Dr.Web CureIt!
3
 
Runs as a stand-alone program on a user's computer
Sandbox environment useful for halting processes and scanning MBR.
Unable to detect some of the modern rootkits.
6.00.4
115 MB
32 bit but 64 bit compatible
Unrestricted freeware
This product is portable.
All Windows Platforms

 
Editor

This software category is in need of an editor. If you would like to give something back to the freeware community by taking it over, check out this page for more details. You can then contact us from that page or by clicking here

anti-rootkit, rootkit scanner, rootkit remover, free rootkit scanner, free rootkit remover, freeware, rootkit eliminator, rootkit detection

Back to the top of the article.

 

Share this
4.217055
Average: 4.2 (129 votes)
Your rating: None

Comments

by Spruce (not verified) on 15. August 2010 - 18:03  (56077)

I do not have the expertise to answer any of your questions; I'm just an amateur. But I'd like to share a similar problem.

Hitman Pro did not identify a file as a threat, but PrevX did! It might be because the other engines in Hitman Pro told PrevX' module, "Listen! You're giving a false-positive...skip it at once!" ;-)

N.B. I'm just guessing.
:-)

by rudyg (not verified) on 10. August 2010 - 8:52  (55732)

Can you please test out vba32 antirootkit. I have heard great things about this little known product.

by Jason H. (not verified) on 10. August 2010 - 8:23  (55726)

Is Avast's integration with GMER just as good as GMER by itself?

by AntiSpywaregirl! (not verified) on 23. July 2010 - 20:29  (54820)

To dl50,
Thanks for such a good website!
I was just wondering why you didn't include Hijack This.

by Anupam on 23. July 2010 - 20:36  (54821)

HiJackThis is not a scanner, or a remover. It simply shows the registry and files settings on the computer. It does not show whether they are good or bad. It just shows them. Therefore, it has not been included here.

by Denzel (not verified) on 23. July 2010 - 15:43  (54809)

Can anyone explain why when I try to update Prevx Safeonline it states it is already up to date when I have version 3.0.5 179? Does this apply only to the definitions? How do I obtain the newest version 3.0.5 182? Thanks

by Anupam on 23. July 2010 - 17:34  (54815)

You can download the program from its site. The links are given in the article itself.

by MidnightCowboy on 28. June 2010 - 21:27  (53402)

In the end, we decided to award eight of the ten licenses donated by Immunet for our "how to stay safe online" competition winners here:

http://www.techsupportalert.com/freeware-forum/security/4430-win-license...

The remaining two plus three more will be given away to the first five members to send me what I think are the funniest one sentence reasons why they should get one! Humorous personal abuse is acceptable so long as it's only directed at me :D

Entries by PM only please. Keep them clean as we need to publish the results!

by Anonymous on 28. June 2010 - 10:53  (53354)

What about Panda Antirootkit. Is it any good?

by DLC50 on 29. June 2010 - 19:13  (53445)

Panda Anti Rootkit was one of the top and one of my favorites for a long time. If it had been kept updated I would probably have it near the top now but as it is, without updates it is not a good choice.

by MidnightCowboy on 28. June 2010 - 11:39  (53359)

According to this, no, but please appreciate that this is just one opinion.

http://www.anti-malware-test.com/

As I understand it though, the more simple and popular scanners are much easier for malware developers to write workarounds for which may explain why they are not so effective.

by Anonymous on 30. June 2010 - 7:55  (53499)

Thanks for the feedback. It's interesting to read how this 'Anti-malware-test' site rates Avira 9. (It's a fail!)

by MidnightCowboy on 18. June 2010 - 10:10  (52390)

Win a License for Immunet Protect Plus!

Followers of Immunet Protect cloud based antivirus will be aware that the 2.0 version has just been released.

www.immunet.com/free/index.html

I have to say that I’ve been quite impressed with how Alfred Huger and the rest of his team have conducted this exercise. Their dedication and commitment to customer generated improvements is a sure fire lesson some other vendors would do well to copy. The net result is an effective antimalware solution which will continue to improve as development moves forward. A bonus is that the program will run alongside many of the traditional solutions. The official and unofficially supported programs are listed here:

http://support.immunet.com/tiki-read_article.php?articleId=4

In recognition of the feedback received from TSA members, Immunet have graciously made available 10 free licenses for the “Plus” version of Immunet Protect. In order to give everyone a fair shot at these we’ve decided to run a competition. All you need do to enter is to write a short piece about the steps you take to stay safe online, including the *programs you use and why you think these are the best solutions.

*Any entries containing references to commercial products will be disqualified.

Entries should be submitted to myself by using the “Contact Info” button which is accessible by clicking my user name (MidnightCowboy) in the forum.

If you are not already registered for the site please use the "register" button at the top of the forum page.

The ten winners will each receive a free license for the “Plus” version of Immunet Protect and their entries will be published in a special “Security” section forum thread.

Closing date for receipt of entries is Monday 28th June, 2010.

The judges decision will be final and no correspondence will be entered into concerning entries.

by Anonymous on 5. June 2010 - 15:59  (51415)

what about Rootkit Revealer? how is it compared?

by DLC50 on 5. June 2010 - 16:30  (51416)

Rootkit Revealer was a great and useful software when it was first developed but it is mostly useless with a lot of todays threats. Malware creators have progressed at a very alarming rate as far as complexities of these infections and now I see a lot of new antirootkit tools coming out that are being updated every week and sometimes more often just to keep up. So no I am afraid that Rootkit Revealer needs to be retired.

By the way everyon I have been super busy lately with all of this stupid search engine malware being caught up by FF and Chrome and I haven't had time to update this review. I am sorry but it will be a little while but I have compiled a list of some newer ARK's and some old and those on the review already, and I am going to test them before I update the review. I have a collection of wicked rootkits that I have acquired and it should be interesting. Thanks

Regards,
DLC50

by Anonymous on 9. April 2010 - 22:39  (47331)

Is the Prevx in HitManPro the same as the standalone Prevx?Or at least is the scanning ability as advanced/efficient? I am wondering if I need both programs...

by Anonymous on 10. April 2010 - 18:48  (47390)

probably not. personally, wouldn't go with either!

by Anonymous on 10. April 2010 - 20:20  (47398)

Why not?

by Anonymous on 10. April 2010 - 20:54  (47399)

don't favour cloud at the moment. zero day baddies would be just as detectable by a decent firewall with a strong hips compared to that of a cloud that also uses heuristics!

by DLC50 on 11. April 2010 - 0:59  (47403)

Yes Prevs is in Hitman Pro but I agree with the comment above. Maybe I am old fashioned and I do love Prevx but I just can not trust cloud technology yet. The way I use prevx is to carry it around in a UFD and when a client calls it is the first thing I scan with because even if it can not do the cleaning it scans fast and gives me a great idea of what I am dealing with and what my next step is. It is indispensable to me in this role but I doubt I will ever spend a dime on it.

by Anonymous on 11. April 2010 - 3:37  (47408)

Considering that I am using Vista firewall which has no HIPS...In THIS case would Prevx whether standalone or in Hitman Pro be beneficial? I am somewhat of a newbie and still learning my way!

by DLC50 on 12. April 2010 - 3:39  (47468)

Well I would say that yes I am sure it would be useful to you even if you only used it once a month but I would not rely on it and it alone. Prevx is great and they are quickly changing the 'HIPS' category to a truly automated response HIPS that does not rely on the user for much at all. So yesh it would help you out. I only use Avast Free with just the file system shield installed and set to scan only on execution, but I also use MBAM, to scan on demand every couple of weeks and I can not even remember the last time I got an infection. My view of security is, the simpler the better.

by AntiSpywaregirl! (not verified) on 23. July 2010 - 2:54  (54778)

I disagree with you about Avast. Recently I had Avast for several months and it was updated frequently and all. But one day without my knowledge I got infected with Relevant Knowledge Spyware-Adware which managed to disable it and killed my Windows. I had to boot from XP after resetting my PC. So Avast is ZERO!
I have regretted not to have installed Avira instead as on my other computer it had been able to fight every attack successfully.
Regards,

AntiSpywaregirl!

by Anonymous on 8. April 2010 - 17:47  (47248)

I don't think much of Sophos Anti-Rootkit. I was doing a Root kit scan of my hard drive.

I am a programmer. It kept saying that executables that I had programed was unknown hidden files.

For one, I can see them in the directory. So how is that hidden ?

Two they are files I programmed myself.

I am also disappointed in Avira. It is also trying to claim that a executable of mine is TR/Downloader.Gen. Too many false positives !

by DLC50 on 11. April 2010 - 1:11  (47404)

Avira is slipping down the slope and facing a swift fall to the bottom if they do not shape up. I love avira and I hear they are having tuff times financially as everyone else so you might expect to see them a little weaker than usual right now. I expect them to be back on top pretty soon though.

Now I have heard people say that Sophos will detect unindexed files as hidden but this sounds ridiculous to me and I haven't tried to check it out. Sophos is my top pick for several reasons. It is regularly updated, almost anyone can interpret the results, and it is decent for what it does. Stand alone Anti Rootkits are almost history so one that is regularly updated is important. Now Sophos is touchy about anything unknown to it, just like your files, but I fail to see anything wrong with that. Most security programs are built to flag other programs and scripts that it does not recognize. You know what the files are, so there is no problem. Any way scan with Prevx if you think you are infected and find out.

by Anonymous on 8. April 2010 - 17:56  (47249)

imo, detecting your diy progs as a possible 'enemy' is a good thing! for obvious reasons.

by Anonymous on 8. March 2010 - 22:56  (45220)

Please excuse my ignorance, but Prevx Free is only for Rootkit detction? I noticed you added this product only in the Rootkit Section of this website.

by DLC50 on 12. March 2010 - 18:17  (45443)

I am not sure I understand your question exactly but I will give it a shot. Prevx Free will detect viruses, spyware, adware, rootkits, worms and pretty much all other malware there is. However, the free version only has limited removal capabilities. It is only able to remove MBR Rootkits, Zeus Trojans, and adware. I have added it to this review because it happens to be one of the best at detecting rootkits.

by Anonymous on 13. March 2010 - 3:29  (45466)

Got it, and thanks DLC50...You answered perfectly.