Rootkit

ssplal wrote:

>
> Hi
> Today i scanned my system and got the following notification.
> "The On-Demand Scan found alterations to code or data which may
> indicate that a rootkit is attempting to hide files, registry keys,
> processes or other items. If this scan fails to find anything then the
> computer should be scanned with McAfee PreScan or booted into Safe Mode
> and this scan run again"

McAfee isn't very good (and I'm being polite about it by saying only that).
It would be wise to scan with another antivirus/malware product to get a
"second opinion" first before you panic. I'd use David Lipman's Multi_AV:

http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

If McAfee reported a particular file as the rootkit, you can also send it to
Virus Total for identification.

http://www.virustotal.com/

If your alternate scan comes up clean, I'd consider replacing McAfee with a
betteer security solution such as NOD32, Kaspersky, or even Avast if you
want something free.

Malke
--
MS-MVP
Elephant Boy Computers
www.elephantboycomputers.com
Don't Panic!