BleepingComputer.com: Rootkit Scans

Hi all,

I run XP Professional SP3. My security is: Airport Extreme (hardware firewall), Sunbelt Personal Firewall, Windows Defender, BOClean, Spyware Blaster, and BitDefender Antivirus 2008 (BD). All of the software is running in real-time protection mode.

Last night before turning in, I manually initiated BD's full system scan, which is their highest level scan that inspects files, archives, and for rootkits. When I got up this morning and checked almost 8 hours later, BD was still performing the rootkit scan. I know from past experience that scanning everything else on my system, other than rootkits, only takes between one and two hours.

Is it normal in general for a rootkit scan to take six hours or more, or is BD's implementation just slow? Just curious. If it takes that long, I'll learn to live with it.

Thanks!

It sounds a bit long. Perhaps you should disable the all tools except for the firewall. Try running again from safe mode.

How to start Windows in Safe Mode

boopme, on Sep 6 2008, 06:31 PM, said:

Thanks for that advice; I'll give that a try tomorrow and see how it goes.

Most anti-rootkit scanners will not work in safe mode because they utilize a driver which is required for the scanning process and that driver will not load in safe mode. Further, there are rootkit variants (haxdoor) that run in safe mode so the usual reason for running a scan in that mode does not apply.

Before performing an ARK scan it is recommended to do the following to ensure more accurate results and avoid common issues that may cause false detections.

• Disconnect from the Internet or physically unplug you Internet cable connection.
  
• Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  
• Temporarily disable your anti-virus and real-time anti-spyware protection.
  
• After starting the scan, do not use the computer until the scan has completed.
  
• When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.

Note: Not all hidden components detected by ARKs are malicious. It is normal for a Firewall, some Anti-virus and Anti-malware software (ProcessGuard, Prevx1, AVG AS), sandboxes, virtual machines and Host based Intrusion Prevention Systems (HIPS) to hook into the OS kernal/SSDT in order to protect your system. You should not be alarmed if you see any hidden entries created by these software programs after performing a scan.

Forgot to mention, you should also Clean out your temporary files first.