Is there a rootkit problem?
First, you need to determine if there is a problem. To determine if there is truly a rootkit operating behind the scenes, use a system process analyzer such as Sysinternals’ ProcessExplorer or, better yet, a network analyzer. By using these tools, you’ll likely be surprised to find what programs are doing and what’s going in and out of your network adapter. You may also discover that you simply have an over-taxed system running with too little memory or a severely fragmented hard drive. With that in mind, I recommend checking your system configuration and defragmenting your drive(s). Remember, though, that it’s better to be safe than sorry, so run a rootkit scan as well. Choosing the right rootkit detection tool To get started scanning, you need the right tools. There are several rootkit scanning tools available. A popular free scanner I mention often is Sysinternals’ RootkitRevealer. It works by comparing the services running at the Windows API level with what’s showing up at the raw
