Avast aswMBR, Sophos Anti-Rootkit, Free Rootkit Scanners
Windows XP systems are more prone to being infected with rootkits as Microsoft's latest operating system Windows 7. That's the result of a study conducted by Avast that surveyed more than 600,000 Windows PCs. Reasons for this higher infection rate are systems that are running the now unsupported service pack 2 and better protection of the Windows 7 operating system, and there especially the 64-bit versions.
While one could argue that the figures are also explainable by the factors time and the fact that most rootkits target 32-bit systems, it is undeniable that rootkits pose a serious security risk.
The two free rootkit scanners Avast aswMBR and Sophos Anti-Rootkit can be used to scan a PC system for rootkits. There are other tools that can be used for the purpose, like the previously reviewed Codewalker, AVG Anti-Rootkit Free or the incredibly useful TDSSKiller by Kaspersky.
Avast aswMBR is a portable program for Windows. The program offers to download the latest antivirus definitions from Avast servers on first start. Those definitions are then used to scan and identify potentially dangerous files that have been discovered by the rootkit scanner.
A click on the Scan button starts the scan of the system. Potentially dangerous files are highlighted in yellow and red colors on the screen. Suspicious or infected files are declared as those directly in the interface. The Fix or Fix MBR buttons are used to disinfect the system and remove the rootkit from it. Avast aswMBR can be downloaded directly from the Avast website. The rootkit module is part of all Avast antivirus solutions.
Sophos Anti-Rootkit is another portable rootkit scanner for Windows. The download becomes available after filling out a two page form on the Sophos website. The rootkit scanner comes as a rar archive that you need to unpack on the system. The program displays a minimalistic interface on startup. The Windows Registry and local hard drives are automatically selected for the scan next to the running processes. A click on Start Scan opens a new window that highlights the scan progress.
The anti-rootkit software lists all suspicious or unknown hidden files in the log. Not all those files are rootkits, and it pays to scan the listed files with another rootkit scanner or an online scanner such as Virus Total.
Both rootkit scanners are portable and free for personal use. This makes them ideal for a admin toolset on DVD or USB stick.
Advertisement
Here’s kinda direct link to Sophos Anti-Rootkit (without forms, only eula).
https://secure.sophos.com/products/free-tools/sophos-anti-rootkit/eula
If XP PCs running Avast had 74% rootkit contamination, it means that Avast anti-virus let those rootkits in.
The conclusion does not make sense Ilev. Avast is not running on 100% of all Windows XP systems.
Reread that ….makes perfect sense.
If you are running avast and get a rootkit…. avast failed.
But there was no mentioning in the article that all the PCs analyzed were running Avast at the time of infection, right? Avast could have picked up the rootkits on first scan and used that data to determine the infection rates.
I just downloaded Sophos Anti-Rootkit. It does not come as a RAR archive, but an EXE, specifically “sar_15_sfx.exe”. It also has an install process, presenting a EULA, and then installing to the C:Program FilesSophosSophos-Antirootkit directory.
This is not what is commonly meant as “portable”. You can, however, install it, then copy the files to a USB key, uninstall it from the system, and it will run independently.
You also don’t need to fill out a “two page form” at the site. You can check, “I am a home user”, and just fill in a (fake) phone number and indicate what country, state and zip code you’re in, and you can then download the product.
It looks like AVG Anti-rootkit free is no longer available
http://www.avg.com/us-en/90821.scn-2