Solved

ComboFix?  Rootkit solution?

Posted on 2009-07-09
3
1,351 Views
Last Modified: 2013-11-22
Lots of people have been offering ComboFix as an antivirus solution, I see no problem with that as its features are rather useful for such a thing.  After all, it seems to be an automated version of your typical guide on the steps on how to remove an antivirus.  But recently I came across a person who offered this program as a solution for a rootkit.  Now I don't have much knowledge with this particular program's internals, but from their website information on how it works, features, and etc. I see absolutely no benefit from using this as a rootkit finder/killer.  Does anyone have any insight into this program as a rootkit solution?  This is, by all means, a discussion.  I will award points to the people who can provide the most informative information.  I tried to put this in an "ask the experts" section, but they told me to place it here.
0
Comment
Question by:TurboBorland
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 20

Accepted Solution

by:
IndiGenus earned 500 total points
ID: 24818766
The quick answer is yes, it will automatically remove many of the most recent nasty rootkits. The routine that cf runs is very thorough and extremely complex from my understanding. You would have to get inside of the head of the developer, sUBs, to know exactly what's going on.

To serve as an example, here is a link to a thread where cf removed the TDSSserv rootkit nicely. See post #9 for cf log.

http://www.geekstogo.com/forum/Google-Redirect-Virus-t241078.html&p=1550329

Hope that helps. It also offers the "Rootkit::" directive for removing them with a script, as you can see later in the thread.

Hope that helps you.

Regards,
Dave
0
 
LVL 4

Author Comment

by:TurboBorland
ID: 24818887
Thanks!  That link actually did answer my question.  It appears ComboFix incorporated a Windows rootkit detection system called GMER, http://www.gmer.net/.
0
 
LVL 20

Expert Comment

by:IndiGenus
ID: 24819601
Great, glad I could help to clarify.
0

Featured Post

IoT Devices - Fast, Cheap or Secure…Pick Two

The IoT market is growing at a rapid pace and manufacturers are under pressure to quickly provide new products. Can you be sure that your devices do what they're supposed to do, while still being secure?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The purpose of this Article is to provide information for a newly released variant of malware – with the assumption that many EE Members will have need of the information. According to “Computerworld”, well over one million web sites have been co…
By the time you finish reading this article, you may have already lost all your money because you don't know the simple steps to securing your BitCoin wallet. BitCoin is an incredible invention. It is a decentralized currency system, which is the…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question