Solved

ComboFix?  Rootkit solution?

Posted on 2009-07-09
3
1,345 Views
Last Modified: 2013-11-22
Lots of people have been offering ComboFix as an antivirus solution, I see no problem with that as its features are rather useful for such a thing.  After all, it seems to be an automated version of your typical guide on the steps on how to remove an antivirus.  But recently I came across a person who offered this program as a solution for a rootkit.  Now I don't have much knowledge with this particular program's internals, but from their website information on how it works, features, and etc. I see absolutely no benefit from using this as a rootkit finder/killer.  Does anyone have any insight into this program as a rootkit solution?  This is, by all means, a discussion.  I will award points to the people who can provide the most informative information.  I tried to put this in an "ask the experts" section, but they told me to place it here.
0
Comment
Question by:TurboBorland
  • 2
3 Comments
 
LVL 20

Accepted Solution

by:
IndiGenus earned 500 total points
Comment Utility
The quick answer is yes, it will automatically remove many of the most recent nasty rootkits. The routine that cf runs is very thorough and extremely complex from my understanding. You would have to get inside of the head of the developer, sUBs, to know exactly what's going on.

To serve as an example, here is a link to a thread where cf removed the TDSSserv rootkit nicely. See post #9 for cf log.

http://www.geekstogo.com/forum/Google-Redirect-Virus-t241078.html&p=1550329

Hope that helps. It also offers the "Rootkit::" directive for removing them with a script, as you can see later in the thread.

Hope that helps you.

Regards,
Dave
0
 
LVL 4

Author Comment

by:TurboBorland
Comment Utility
Thanks!  That link actually did answer my question.  It appears ComboFix incorporated a Windows rootkit detection system called GMER, http://www.gmer.net/.
0
 
LVL 20

Expert Comment

by:IndiGenus
Comment Utility
Great, glad I could help to clarify.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

HOW TO REMOTELY CLEAN MEROND.O WITH ESET SILENTLY PROBLEM       If you have the fortunate luck to contract the Merond.O virus on your network, it can be quite troublesome to remove as it propagates to network shares on your network. In my case, the …
Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now