Results 1 to 8 of 8
  1. #1
    3 Star Lounger
    Join Date
    Jan 2001
    Posts
    297
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Rootkit Problems

    Ridiculously large screenshot placed in zip file to avoid horizontal scrolling on all but the largest displays.

    I just ran RootkitRevealer and came up with the all the entries in the attachment. Is there any solution to this OTHER THAN reinstalling windows ??? Thanks in advance for any help !!!

  2. #2
    Platinum Lounger
    Join Date
    Nov 2001
    Location
    Melbourne, Victoria, Australia
    Posts
    5,016
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Rootkit Problems

    I don't know anything about this software (or rootkits) but would I be correct in assuming that you have some PC Magic Software installed? The advice given on Sysinternals Freeware - RootkitRevealer says:

    "You should examine all discrepancies and determine the likelihood that they indicate the presence of a rootkit. Unfortunately, there is no definitive way to determine, based on the output, if a rootkit is present, but you should examine all reported discrepancies to ensure that they are explainable. If you determine that you have a rootkit installed, search the web for removal instructions. If you are unsure as to how to remove a rootkit you should reformat the system's hard disk and reinstall Windows. "

    I'd do a bit of searching before deleting anything. My guess is that the discrepancies revealed aren't related to any malware.

    Alan

  3. #3
    5 Star Lounger
    Join Date
    May 2003
    Location
    Pittsburgh, Pennsylvania, USA
    Posts
    629
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Rootkit Problems

    A lot of people feel that if you find out that your computer has been succesfully attacked and compromised, and you aren't exactly sure what happened and where and when, then you can't really be sure your system still isn't compromised. You might have missed something.

    In this case: "Take off and Nuke it from orbit. It's the only way to be sure"

    (i.e., delete your entire hard drive, reinstall/restore from know good image, and reload your data files from archive.)

  4. #4
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Rootkit Problems

    I ran RootkitRevealer on my XP Pro box, and found about 100 entries in the Firefox cache which were described as "inaccessible via the Windows API". I have no idea whether this is correct, but it worries me not in the slightest.

    Do you recognise the software directories and files that Alan has identified? Or do you remember installing "something" on the most common date indicated?

    Most importantly, are you experiencing any problems that could be put down to the presence of a Rootkit? If not, I would simply keep the matter in mind and be wary. There seems little point recreating everything unless there is a good factual reason for doing this.

    Please note that the attached cartoon is not directed at anyone...!

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  5. #5
    Uranium Lounger viking33's Avatar
    Join Date
    Jun 2002
    Location
    Cape Cod, Massachusetts, USA
    Posts
    6,308
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Rootkit Problems

    See joeperez post.

    <post#=456,135>post 456,135</post#>
    BOB
    http://lounge.windowssecrets.com/S/flags/USA.gif http://lounge.windowssecrets.com/S/f...sachusetts.gif


    Long ago, there was a time when men cursed and beat on the ground with sticks. It was called witchcraft.
    Today it is called golf!

  6. #6
    3 Star Lounger
    Join Date
    Jan 2001
    Posts
    297
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Rootkit Problems

    Ok ... I've gotten everything from "blow up the whole thing" to "do nothing" and in between ... quite the concensus but as I am having no problems (that I can notice), I think I will opt for the watchful eye approach. Thanks for ALL the suggestions. As for the GREAT cartoon, I am wondering which member of the Lounge that really is <img src=/S/grin.gif border=0 alt=grin width=15 height=15>

  7. #7
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: Rootkit Problems

    It does very much appear (based on Googling some file names) that your computer has the Magic Folders or Encrypted Magic Folders software installed (see http://www.pc-magic.com/des.htm). If you installed this, or someone else intentionally installed it, then most of the files are probably there properly. The registry keys with the word "Reinstall" in the path are interesting. I'm not sure why they exist or what they do. I believe Sysinternals offers a tool that will let you access these keys (RegEdit might not be able to see them) so you can determine whether you want them or not. The cookies and cache entries could have changed while you were running the scan. If you had closed your browser, maybe close all running programs and try the scan again to see if there are still discrepancies.

  8. #8
    Platinum Lounger
    Join Date
    Nov 2001
    Location
    Melbourne, Victoria, Australia
    Posts
    5,016
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Rootkit Problems

    > As for the GREAT cartoon, I am wondering which member of the Lounge that really is

    It's not. Nobody here gets paid as well as a Waste Management Specialist!

    Alan

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •