[solved] Rootkit Detection

JohnGreen1407

After getting a real virus which stopped the bitdefender update and access to all other AV software sites, I downloaded and ran ComboFix which has cleared up the virus, however, ComboFix reported that the file Leak test.m32 was a root kit. I cannot remember and do not have to hand the actual directory this file was in, but i was burried deep in Bitdefender directory.

I have seen several other postings on various sites relating to this, can BD or other users confirm that this is a false detection or could it be a real rootkit which has burried itself within BD.

Kind regards

John

alexcrist

Hello John,

First of all, the file BitDefender_installation_directory\BitDefender 2010\Active Virus Control\midasXX-v2_YY\leaktests.m32 (XX is either 32 or 64, YY is midas engine version) is a perfectly clean file, which belongs to BitDefender 2010 products

Second of all, my personal opinion about Combofix is that it is a collection of somehow dangerous tools, with no official support page, no way of contacting the author, no way of reporting bugs/false alarms/whatever. It's a collection of tools that does a lot of automated things, with no way of configuring and/or approving any of it's "cleanings" and no way of reverting any changes it does. Also, it does not have any public documentation whatsoever (apart from a few directions on how to run it, which is pretty straight-forward, since you only have to open it and the rest is done automatically).

It's not the first time Combofix targets BitDefender files. There was at least one other case (that I know of) when Combofix targeted the BitDefender filesystem driver and removed it on sight, which basically rendered BitDefender useless and you had to reinstall it to make it work again.

Combofix might be good, it might even be extraordinary at some things that it does. But until it meets the above conditions (at least a way of contacting some support for it), I suggest you stay away from this tool.

The separate analysis tools recommended by BitDefender can be found on this page: http://kb.bitdefender.com/KB490

Cris.