IT 4 Offices

COVID-19 - Our business is operating as normal and our team is working remotely from home. Call 0333 332 6600

Root kits from Hell

Just had one of them days today, I have a pretty good grasp of windows and spotting the odd trojan or virus however rootkits are harder to spot.

I generally run good old combofix on a pc when I get a call from a user saying there is an issue, but what happens when that wont run?

Most of the manufacturers of antivirus product have their own rootkit program to discover the problem but not always to fix them.


A few good ones are:

FSecure blacklight


AVG/Avast Cloudcare

My favourite Free antivirus/trojan products at the moment (this will probably change next week) are:

Microsoft Security Essentials


AVG (Free)

The rootkit to get me working late again was called Watermark.exe, Avira detected it initially as did Microsoft Security Essentials but as two different issues. Both unable to remove it. The client had a total of 2370 dll/exe infected files. This was probably the highest amount of infections I’d seen in years. Considering the client had a new hard drive installed 2-3 days prior to my visit it was pretty alarming.

Starting up in safe mode and clearing the files worked however I noticed my trusty usb flash had some unexpected and unwanted files (autorun.inf and 4 shortcuts and copy to shortcuts.lnk ) added every few seconds. The A drive also kept lighting every few seconds.

However – None of the applications touched the watermark.exe file. I tried XP recovery mode but got an access denied message. So to remove this I had two options….boot to dos via a trust ntfs disk and locate the file c:\program files\microsoft\watermark.exe or connect the disk as a slave onto another pc. I luckily had a hiren’s recovery cd in my collection and was able to get into dos and remove the file.

Hope this helps someone spot the same issue and resolve it quickly.

Follow up – having returned the pc to the client – we agreed it was safer to wipe the entire pc thus ensuring there was little or no chance of the trojan resurfacing.

SMB IT Support

If you are a business owner/manager and would like to discuss outsourcing your IT support, give us a call and speak to one of our team

SMB IT Support   Ad-hoc Support

IT Supply

If you have a hardware or software requirement or have a project you would like to discuss, give our team a call

Hardware   Software   Hosting


At IT 4 Offices, we have formed strong relationships with industry recognised businesses to provide our clients with the best systems that they require to run their daily business tasks.

 HP Cisco
Draytek Synology

Contact Us

Call on 0333 332 6600

52 Halcyon Close
Essex. CM8 1GY

follow us on twitter follow us on google+ view our youtube channel like you facebook