They're definitely getting nastier. Last week we had our first client system that required a format-and-reinstall. Fortunately, this was a relatively new machin

They're definitely getting nastier. Last week we had our first client system that required a format-and-reinstall. Fortunately, this was a relatively new machine and the client didn't care about any of the data on it. (We have a strict "format-and-reinstall as a last resort only" policy on our flat-rate infected machine cleanups.) If you can still get the machine to boot, I've had very good luck with ComboFix. (Make sure you get it from bleepingcomputer.com [1], not combofix.org, which is an unauthorized re-distribution.) Most of the rootkits I'm seeing still aren't working directly on existing system files, a la the computer viruses of old. Instead, they're modifying ini files and then installing some cleverly hidden files in system directories. So, you can use tools like RootKit Revealer [2] to sniff them out. Actually removing any hidden files or hidden registry keys may require some expertise and serious effort -- we have a dedicated diagnostic system set up that we use to handle some of these things, with the drive removed from the client computer. [1]: http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe [2]: http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx http://technet.microsoft.com/en-us/sysinternals/bb897445.asp...