Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1356
  • Last Modified:

ComboFix? Rootkit solution?

Lots of people have been offering ComboFix as an antivirus solution, I see no problem with that as its features are rather useful for such a thing.  After all, it seems to be an automated version of your typical guide on the steps on how to remove an antivirus.  But recently I came across a person who offered this program as a solution for a rootkit.  Now I don't have much knowledge with this particular program's internals, but from their website information on how it works, features, and etc. I see absolutely no benefit from using this as a rootkit finder/killer.  Does anyone have any insight into this program as a rootkit solution?  This is, by all means, a discussion.  I will award points to the people who can provide the most informative information.  I tried to put this in an "ask the experts" section, but they told me to place it here.
0
TurboBorland
Asked:
TurboBorland
  • 2
1 Solution
 
IndiGenusCommented:
The quick answer is yes, it will automatically remove many of the most recent nasty rootkits. The routine that cf runs is very thorough and extremely complex from my understanding. You would have to get inside of the head of the developer, sUBs, to know exactly what's going on.

To serve as an example, here is a link to a thread where cf removed the TDSSserv rootkit nicely. See post #9 for cf log.

http://www.geekstogo.com/forum/Google-Redirect-Virus-t241078.html&p=1550329

Hope that helps. It also offers the "Rootkit::" directive for removing them with a script, as you can see later in the thread.

Hope that helps you.

Regards,
Dave
0
 
TurboBorlandAuthor Commented:
Thanks!  That link actually did answer my question.  It appears ComboFix incorporated a Windows rootkit detection system called GMER, http://www.gmer.net/.
0
 
IndiGenusCommented:
Great, glad I could help to clarify.
0

Featured Post

New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now