Anti-Rootkit from Panda – Free Program

This post was written by admin on October 6, 2008
Posted Under: PC Security, Rootkits, Technology

Panda Anti-Rootkit Free is a free program for Windows 2000/XP and shows hidden system resources, identifying known and unknown rootkits. It analyzes hidden drivers, processes, modules, files, registry entries, SDT modifications, EAT hooks, modification to the IDT, non standard INT2E and SYSENTER, IRP hooks. Unlike other anti-rootkit utilities which only ‘reveal’ hidden objects, Panda Anti-Rootkit searches deeper and identifies known and unknown rootkits giving users the option of removing them, including their associated registry entries, processes and files.

Panda Anti-Rootkit (PAR) searches through the files and Registry items in your computer looking for traces of rootkit activity. It shows its findings in as much detail as you want. It distinguishes rootkits it recognizes from unknown ones and will remove both kinds.

There is no need to install this tool, just download and run it.You have the option to run an in-depth scan which requires a reboot so the program can search for rootkits during the boot process. This I would recommend as not all rootkits can be found during a normal scan.

This program scans quickly as it checks processes, drivers, Registry entries, file system and any ADS (Alternate Data Streams) that it may find.

The scan window cannot be resized, and if it has detected many items it is difficult to get a full overview of the results, with some path names being cut off, but if you click the Advanced Report button you will get an in-depth report on what has been found.

For each item, this report lists exactly what it considers to be suspicious and also indicates the relationships between items. You can save the report for later analysis.

PAR makes a distinction between unknown rootkits, which it detects solely by their behaviour, and known rootkits, which it also matches to known signatures. This version won’t touch any file that has a legitimate signature from Microsoft, so removing the non-Microsoft files should be sufficient. And if Microsoft files have been modified, which invalidates the signature, it is a danger and should be removed.

There is an option to send any unknown files to Panda’s labs for analysis which will make removal much safer
Download, and how to use video: