Jump to content
CCleaner Community Forums

AVG Anti-Rootkit


JohnDemolition

Recommended Posts

  • Moderators

I don't like the fact that it has to be installed(and required a reboot). True its a very small file but none of the other rootkit scanners require a install/reboot. Its hard to say which one of the rootkit programs is the best, the most widely used is still blacklight but there seems to be new ones every month.

 

Hopefully someone will do some extensive tests over at spywareinfo or spywarewarrior soon.

Link to post
Share on other sites
  • Moderators

Here's what I found out:

  • Installation doesn't create a System Restore point!
  • Installation requires a reboot because it installs a couple of drivers
    in 'C:\Windows\System 32\drivers'
    The two files are: 'anti_rkt.sys' and 'cleandrv.sys'
  • It writes registry data into:
    'HKEY_LOCAL_MACHINE\Software\AVGAntiRootKitBeta'
    'HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVG_ANTI-ROOTKIT'
    'HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVG_CLEAN_DRIVER'
  • The default scan is fast, even the thorough in-depth scan which checks
    all hard disks is rather fast.
  • The GUI is probably too big at it's default size for some monitors and/or
    display settings.
  • It can be uninstalled from 'Add or Remove Programs' in the Control Panel.
  • In order to remove the registry data it writes into
    'HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root' you have to use a
    System Restore point from before the installation, or use an ERUNT backup.

 

I would much prefer it didn't write any data into the registry or require the installation of drivers.

 

Screenshot (click to enlarge):

aar1bss.png.xs.jpg

Link to post
Share on other sites
  • Moderators

Yeah it's still a beta. But what I don't understand is why are allot of the AV developers starting these anti-rootkit programs when they could just add the detection into their already available anti-virus and anti-spyware software versus needing yet another program.

Link to post
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...