Archive for Computer Forensics

Tracing an Undetectable RootKit

The information and the computers we own are very important in our daily lives. To have a virus, worm or rootkit wipe out the computer entirely clean is a great problem. Having a anti-virus never truly ensures your computer’s security 100%, but it helps. But sometimes, it couldn’t detect an entity in your computer that’s still causing you trouble. A rootkit is a sneaky program that could conceal itself from most computer security programs. Here are ways to detect them.

1. Run a Full Scan With Your Anti-Virus

Running a full computer scan along with your boot records is important. Make sure that you include all hidden files as well. One reason why some anti-virus programs cannot detect the virus is because it is a hidden file, named as a system file or has corrupted a file in your computer.

2. Check For Rogue Processes

Using Windows’ task manager, look at the processes that your computer is currently running. Usually in Windows Vista and 7, you’ll find a description for each of these processes and what they do. If you find a program without a description, suspect it as a virus. Search its filename and locate its location. If your anti-virus can’t find a virus on it, send a sample of the file to your anti-virus company’s email.

3. Getting Rid of the Trash

Be careful never to double click these executable files. Also, if you find that you can’t delete the rootkit or virus yet, check your task manager again, remove the process the virus uses and then delete the virus. Sometimes, the viruses restart their program in a few seconds once you terminate them. Be sure to take swift action.

4. Corrupted Files

If the virus corrupted a crucial system file, before deleting it, find an updater or an exact duplicate of the file type from another computer or through the Internet. Instead of deleting, replace the corrupted file with the fresh one. This should ensure that your computer still functions properly while terminating the virus.

Recent Posts:

Mobile Computing Can Still Be Improved