Windows 7 Hit with a RootKit

One if my client's employees running Win 7 has been hit with a rootkit. Her system still runs but it's slow. It's had Symantec Endpoint Protection on it which is reporting numerous Trojans being caught throughout the day.  

When she called me, my first thought was a backup of her data followed by a clean install of Windows but she is running all the financial apps for the company. A clean install would take her down for a few days at a very busy time of the year.

Monday evening, I installed Malwarebytes and ran it with the Scan for Rootkits option. It found a ton of modules, quarantined them and Windows was restarted. I know the system is still infected and I decided not to connect to it remotely to stop any transmission of her problem to my system. I haven't been able to look at it again but plan on picking up the system tomorrow to clean it over the weekend (without connecting it to my network).

I've working on spyware and rootkits before and know the tools are always changing and being upgraded. If you have removed a rootkit lately and have any tools that have worked well, that feedback would be appreciated.

Even if I can get the system clean, I'm going to recommend a new anti-virus, a browser anti-exploit and a clean install later on.
LVL 25
Tony GiangrecoAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave BaldwinFixer of ProblemsCommented:
I recommend ComboFix which digs deeper into your system.  You may have to turn off your antivirus while it runs.  Download page is here:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Tony GiangrecoAuthor Commented:
Yes, I've used ComboFix before. Some systems have reported it to actually be malware. I'm not sure what criteria was used to report that classification.

Thanks for the suggestion.
Dave BaldwinFixer of ProblemsCommented:
They report it as malware because it digs deep into the system where the rootkits hide.  That's not where 'normal' programs go.
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

JohnBusiness Consultant (Owner)Commented:
Try running TDSS Killer (Kaspersky) which is decent for some root kits.

If you need to, back up, format and reinstall Windows can be done in a day, so you do not need to keep the client offline for "a few" days.
i have used roguekiller - worth a try also :
David Johnson, CD, MVPRetiredCommented:
I would spend my time flattening the pc or restoring from a backup (no backups right?) otherwise you really can't trust this computer.  Some education of the user is also in order here.
Tony GiangrecoAuthor Commented:
Thanks for all your suggestions.

in the last 12 hours, I compiled a list if about 20 anti-rootkit/spyware apps. I was already aware of the apps you have suggested.

Fortunately, this client will be closed next week so i plan to pickup the infected box today and run the apps to see if it can be cleaned. if not, I will have time to perform a clean install. The timing worked out well.
Thomas Zucker-ScharffSolution GuideCommented:
Yes - best to reimage when a rootkit is involved.  I haven't updated the article in a while (something I need to do now), but check out my article on rootkit software and rootkits with links to free software.
post results !
Tony GiangrecoAuthor Commented:
The system has been cleaned using krill, rogue killer, combofix, trend micro house call, malware bytes, the latest version or Symantec endpoint protection and a few other utilities.

It looks clean but I'm going to install malware bytes  premuim for better protection going forward.

Thanks for your suggestions.
NVITEnd-user supportCommented:
Also consider zero-day/exploit protection. Malwarebytes has Anti-Exploit (Free and Paid)
Tony GiangrecoAuthor Commented:
Thanks for your suggestions. The PC has been back in service since Monday and it's working well.

Happy New Year!
thanks, Tony - but you did not tell us what you used as solution?
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.