5

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with Malwarebytes, and both came up more or less clean. I downloaded RKR, unzipped, ran as admin, but it would not open. I opened the task manager to check and tried reopening the program. Sometimes the process wouldn't even show. Sometimes it would show for ~10s with a fixed amount of memory listed, and then die. Once, I got to the Sysinternals licence agreement, but it died after that. Tried renaming the EXE, no dice. Tried safe mode, no dice.

One thing I haven't done is check the event logs, which I should probably do. Besides that, what mechanism could potentially cause RKR to fail to start? Or is my system likely compromised, requiring a nuke from orbit?

Bigbio2002
  • 2,763
  • 11
  • 34
  • 51
  • I don't want to know how to deal with it (I'm aware of the linked post and I know the proper course of action), I want to know whether my suspicions are true, which would subsequently require me to take those steps. – Bigbio2002 May 10 '13 at 13:34
  • 3
    If even suspect it, I'll nuke the motherfscker. – Tom O'Connor May 10 '13 at 14:19

2 Answers2

11

If you suspect a rootkit, don't waste time trying to find it. Wipe and reinstall the system.

Dennis Kaarsemaker
  • 18,793
  • 2
  • 43
  • 69
  • +1 because it's good advice, though it didn't exactly answer my question. – Bigbio2002 May 10 '13 at 17:54
  • @Bigbio2002 May not be your answer, but ultimately the route your gonna have to take. – Chad Harrison May 10 '13 at 18:47
  • @Bigbio2002 It answers your question -- it says "You're *doing it wrong*! Stop pussyfooting around with stuff like Rootkit Revealer and blow the suspect machine away before the problem spreads". Just because the answer isn't what you want doesn't mean it's not the right answer... – voretaq7 May 10 '13 at 20:15
  • 3
    @voretaq7 My main suspicion of the existence of a rootkit was that RKR wasn't running (because a rootkit could be blocking it). Prior to that, the suggestion of a rootkit was just sheer speculation from me trying to narrow down the cause of the slowness. As it stands now, the rootkit possibility is back to being a remote one, as there is no evidence. It would be ridiculously inefficient to "nuke from orbit" every single machine every time someone mentions the R-word out of speculation. – Bigbio2002 May 10 '13 at 20:37
9

Rootkit Revealer does not support and does not run on 64-bit Operating Systems. The fact that Rootkit Revealer fails to run on a windows 7 x64 system tells you nothing.

It was never written to support 64 bit and is no longer being developed. Last version was published in 2006-ish? I believe. Notes on the download page state:

It runs on Windows XP (32-bit) and Windows Server 2003 (32-bit)

Rex
  • 7,815
  • 3
  • 28
  • 44