troubleshooting Question
Windows 7 Hit with a RootKit
asked on
One if my client's employees running Win 7 has been hit with a rootkit. Her system still runs but it's slow. It's had Symantec Endpoint Protection on it which is reporting numerous Trojans being caught throughout the day.
When she called me, my first thought was a backup of her data followed by a clean install of Windows but she is running all the financial apps for the company. A clean install would take her down for a few days at a very busy time of the year.
Monday evening, I installed Malwarebytes and ran it with the Scan for Rootkits option. It found a ton of modules, quarantined them and Windows was restarted. I know the system is still infected and I decided not to connect to it remotely to stop any transmission of her problem to my system. I haven't been able to look at it again but plan on picking up the system tomorrow to clean it over the weekend (without connecting it to my network).
I've working on spyware and rootkits before and know the tools are always changing and being upgraded. If you have removed a rootkit lately and have any tools that have worked well, that feedback would be appreciated.
Even if I can get the system clean, I'm going to recommend a new anti-virus, a browser anti-exploit and a clean install later on.
When she called me, my first thought was a backup of her data followed by a clean install of Windows but she is running all the financial apps for the company. A clean install would take her down for a few days at a very busy time of the year.
Monday evening, I installed Malwarebytes and ran it with the Scan for Rootkits option. It found a ton of modules, quarantined them and Windows was restarted. I know the system is still infected and I decided not to connect to it remotely to stop any transmission of her problem to my system. I haven't been able to look at it again but plan on picking up the system tomorrow to clean it over the weekend (without connecting it to my network).
I've working on spyware and rootkits before and know the tools are always changing and being upgraded. If you have removed a rootkit lately and have any tools that have worked well, that feedback would be appreciated.
Even if I can get the system clean, I'm going to recommend a new anti-virus, a browser anti-exploit and a clean install later on.
Learn from the best
Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.
Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 4 Answers and 13 Comments.
Try for 7 days”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.
Our community of experts have been thoroughly vetted for their expertise and industry experience.
The Most Valuable Expert award recognizes technology experts who passionately share their knowledge with the community, demonstrate the core values of this platform, and go the extra mile in all aspects of their contributions. This award is based off of nominations by EE users and experts. Multiple MVEs may be awarded each year.