If you're unsure how to use a particular Anti-rootkit (ARK) tool, then you should not
be using it. Some ARK tools are intended for advanced users
or to be used under the guidance
of an expert who can interpret the log results. Arks are powerful
tools and using them incorrectly could lead to disastrous problems with your operating system
. Most of the more effective ARK tools like RootRepeal should only be utilized by advanced users or under the guidance of an expert as they generate logs which must be interpreted and investigated before taking any removal action. Why? Not all hidden components detected by ARKs are malicious
. It is normal for a Firewall, some Anti-virus and Anti-malware software (ProcessGuard, Prevx1, AVG AS), sandboxes, virtual machines and Host based Intrusion Prevention Systems (HIPS) to hook into the OS kernal/SSDT in order to protect your system. SSDT (System Service Descriptor Table) is a table that stores addresses of functions that are used by Windows. Whenever a function is called, Windows looks in this table to find the address for it. Both Legitimate programs and rootkits can hook into and alter this table. You should not be alarmed if you see any hidden entries created by legitimate programs after performing a scan.
There are many free ARK tools but some of them require a certain level of expertise and investigative ability to use. These are a few of the easier ARKS for novice users:
Malwarebytes Anti-Malware uses a proprietary low level driver (similar to some ARK detectors) to locate hidden files and special techniques which enable it to detect a wide spectrum of threats including active rootkits. SUPERAntiSypware offers technology to deal with rootkit infections as well.