Hi, I'm new to the forum and I was wondering if I could get a little bit of clarity about rootkits. The other day, I was scanning my computer with my antispyware/malware tools, and even though my computer wasn't showing any symptoms of being infected by a rootkit, I thought about using a rootkit scanner. Well, I downloaded and installed the Rootkit Hook Analyzer program(with the ugly "bat" icon) and quite a feel hooked items(in red) showed up in my scan. Well, I couldn't make heads or tales as to what the meaning was to these hooked items, therefore, I registered at the Antirootkit.com Forum:

http://www.antirootkit.com/forums/index.php

to try and get some help, however, you have to wait and get approval from the administrator to join the forum, however, I never received an e-mail from them. But meanwhile, I had read how hackers can change and hide rootkits from scans, and several days later I scanned my computer again with the Rootkit Hook Analyzer program....however, this time, only one item showed up as being hooked. Well, that kind of concerned me, however, I also scanned my computer with the F-Secure Blacklight program, but it was shown that "No hidden items were found."

But anyway, if I'm not showing any symptoms of being infected and if the rootkit scans that I've performed didn't really show any infection, is it safe to say that I'm not infected by a rootkit....or can one ever really know? Also, I read a couple places on the internet that the only 100% surefire way of getting rid of a rootkit is to erase your hard drive and reformat. ....Now am I just being very cautious, or am I actually being overly cautious?

P.S. I also wanted to mention that unfortunately, I really don't have the time or the inclination to read the ton of material that it seems like a person has to read in order to be able to understand rootkits. And even if a person did read all the material, I read that there wasn't really a 100% full-proof method of detecting and getting rid of rootkits....

Rooting Out the Dangers: Rootkit Removal for Beginners

There are many things that can create false positives in rootkit analysis. Some of the most frequent are the ones listed above. Others will identify items in browser caches and other temporary files; or, files temporarily file protected by Windows while they are running, possibly invisibly in the background. It takes a lot of experience and training to learn what is a FP and what is not, as well as to identify and tell which programs create legitimate rootkit hooks required by the nature of the way they have to work (firewalls, for example).

Good questions, and I'm sorry for the delay in responding - we were under attack and off line for a while. I guess we are doing something right.

Anyway, your questions. It really all depends on what the rootkit is intended to do. A rootkit is like other malware, some intentionally create problems on the subject system, some intentionally do not, and are more or less invisible to the owner. Examples of the latter would be for systems that are zombied by the malware, and then used for DDoS attacks or spamming by the infection.

What makes malware a rootkit is the method it uses to infect the subject system, not what it does thereafter. Rootkits are usually harder to fix because the way they infect buries them deep into the operating system, although better tools to disinfect rootkits are coming available every day, or so it seems.

So, the answer is it may create problems and be noticed, or equally well, it may not.

In this context zombie means:

Thanks for reply, Ikeb, and sorry for taking so long to get back to this thread, however, what can I do to test my computer to see whether or not something is deeply hidden in my computer? Also, since I last posted here, I was doing some web searching and ever since I clicked on this one site, my pc has been responding slightly slower. Actually, I have more of a concern about the recent "delaying" of my computer than I do for a concern about a rootkit infection. Although I still would like to to know what to do to check for any type of deeply imbedded rootkit infection.

i would run through this to start with.
Malware Removal and Prevention
then see what the others recommend here allso.

what are your system spects,and what av, antimalware,antitrojin apps are you useing?

That message relates to a conflict arising from the "animated cursor handling" patch that was released out of sequence on April 3rd. Some Realtek HD Audio Control Panel users are reporting that user32.dll memory error. It's possible other applications may trigger it, as well. If you are experiencing this problem, Microsoft recommends that you install this Hotfix to correct it.
http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

Thanks much, Negster22. That Hotfix did the job. Also, does anyone know anything about Windows Live OneCare? The reason why I ask is because I believe that Windows Live OneCare has caused my system to drag slightly because it appears that it is a resource hog. By the way, I finally ran through the Malware Removal and Prevention and everything checked out okay.

I'm glad the Hotfix worked for you. I imagine that message was causing you some distress.

If you ran the MRP and it found nothing that is a good sign.

I haven't used Windows Live OneCare so I can not comment on the resource hog aspect, but here are some user comments:
http://utilities.software.merchanthound.com/reviews/32410429/Windows-Live-OneCare-1-5-Full-Product-PC

Also, here:
http://windowsonecare.spaces.live.com/?_c11_blogpart_blogpart=blogview&_c=blogpart&partqs=amonth%3d3%26ayear%3d2007

Here's a link that reveals the resources typical startup programs hog, including some familiar AVs, but Windows Live OneCare is not there:
http://www.thepcspy.com/articles/other/what_really_slows_windows_down/5

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

Thanks again, Negster22. Also, in the users' comments, I noticed that one person did say that, "You may find that the speed of opening files or web pages is decreased after installing the software." I have found that to be the case with my computer.

Yes, I saw that too, but other users - especially those that are running Vista, liked how it integrated very easily with that OS. Since you're running XP, that isn't an important consideration for you.

_________________
Negster22 - MS MVP - Consumer Security 2006-2008