Warning on stealthy Windows virus

[rjfvillarosa]

Another one to look out for:
http://news.bbc.co.uk/1/hi/technology/7183008.stm

[shadowpr]

Wow. That seems like a scary one.

Not to go off topic, but what is a good program to scan for rootkits?

[rjfvillarosa]

There are a few out there, I'll have a look around and see what I can find.
glc recommended one to me a while back, I used it and it found some stuff but I didn't know how to tell if it was malicious or genuine...:o

Edit.. I am going to watch this one because they say in the article that it appears to have only affected computers in Europe and even though I am back in Puerto Rico I still access my bank account in the UK online.
I received my PinSentry card reader a few days ago.:
http://www.newsroom.barclays.co.uk/content/Detail.asp?ReleaseID=1013&NewsAreaID=2

[hudson80]

http://free.grisoft.com/doc/download-free-anti-rootkit/us/frt/0

I use this one

[rjfvillarosa]

From what I have seen and read most rootkit scanners are initialised from a boot disk. This one from Panda is run from Windows and requires a reboot of the system (remember the initial scan of the MBR is made before Windows starts)
http://research.pandasecurity.com/archive/New-Panda-Anti_2D00_Rootkit-_2D00_-Version-1.07.aspx

Hudson. How does the AVG scanner run? from Windows or a boot disk?

[usnavyretired]

Here's one I use that runs from Windows and has been very effective.
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

[shadowpr]

Thanks for the suggestions everyone.

[Negeva]

Was only a matter of time before we started seeing rootkits going into full production for nefarious means; Sony's was just the catalyst 'they' needed.

Time to make sure you're fully updated with Windows patches and maybe even move over to a 'safer' browser, as it seems this infection targets IE.

For rootkit removal/scanning check: http://www.gmer.net/index.php