Sounds more like a process or driver problem than
anything else.
In a nutshell, you really haven't presented any
information showing that you *do* have a rootkit.
Outside of pure speculation, you do not have anything
that shows that you have a rootkit.
Did you find an open port via nmap that does not show
up on netstat or openports?
Did you find some traffic on your network coming from
a port that doesn't show up in the netstat output?
Did you run pslist against the system (or a WMI-based
program or script) that turned up processes running
that don't show up when you run the tools locally?
Did you find Registry entries (in the ubiquitous Run
key) that show up when the system is booted to Safe
Mode, but not when it's booted normally?
Harlan
--- BillyBob <billybobknob@hotmail.com> wrote:
I have noticed that my XP system is behaving like I
have a rootkit.
- My mouse is jumpy (it freezes for a second when I
move it around the
desktop) and the minimized Taskmanager in the
systray shows I have around
25 - 30 % usage, but when I open it, there is no
process listed using this
much.
- I did a netstat, fport, openports and none of
these show that I have any
odd ports open or any connections established.
- even when I disconnect from the Internet these
symptoms do not stop. They
stop if I reboot, but then start again.
I have ran VICE, Klister, PatchFinder and RkDetect
from rootkit.com and they
could not find anything.
Any more suggestions ?
Any more rootkit finding tools for Windows ?
Thanks
Bill
=====
------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://groups.yahoo.com/group/windowsir/
"Meddle not in the affairs of dragons, for
you are crunchy, and good with ketchup."
"The simplicity of this game amuses me.
Bring me your finest meats and cheeses."
------------------------------------------
