Rootkit - please help

  • Thread starter Thread starter TW
  • Start date Start date
T

TW

Hi,

I'm using WindowsXP Pro SP2.
Programs RootkitRevealer and Gmer shown that
c:\Windows\System32\antiak.sys is a rootkit.
How to get rid of it? Should I simply delete the file
from the system or ought I to do anything else?
What are general rules of removing rootkits from
Windows systems?

Regards,
TW
 
TW said:
Hi,

I'm using WindowsXP Pro SP2.
Programs RootkitRevealer and Gmer shown that
c:\Windows\System32\antiak.sys is a rootkit.
How to get rid of it? Should I simply delete the file
from the system or ought I to do anything else?
What are general rules of removing rootkits from
Windows systems?

Regards,
TW
Click to expand...

Do you have an anti-keystroke logger installed? Googling for that file name
suggests it may be part of a anti-keystroke logger program. If you have
never installed any of these programs and it is a rootkit the only sure way
to get rid of it is a clean install of Windows. This means formatting your
hard drive so back up your data first.
 
Thank you very much for your reply.
Do you have an anti-keystroke logger installed? Googling for that file name
suggests it may be part of a anti-keystroke logger program.
Click to expand...
I think I don't have and I didn't ever have any anti-keystroke logger installed
but I'm not absolutely sure.
I'd like to avoid formatting disk and installing Windows again (especially if it's
not necessary) so is there any method to check if I have or had such anti-keylogger installed?

Regards,
TW
 
TW said:
Thank you very much for your reply.


I think I don't have and I didn't ever have any anti-keystroke logger
installed but I'm not absolutely sure.
I'd like to avoid formatting disk and installing Windows again
(especially if it's not necessary) so is there any method to check if I
have or had such
anti-keylogger installed?
Regards,
TW
Click to expand...

Not that I know of. In another newsgroup it was suggested that you try
renaming the file. Have you tried this?
 
Thank you very much for your reply.
In another newsgroup it was suggested that you try
renaming the file. Have you tried this?
Click to expand...
Yes I have, after trobles with getting the Safe Mode.
Eventually I did it and it seems to be helpful.
At least the Gmer program doesn't show any rootkit
anymore.

Regards,
TW
 
Back
Top