Rootkit Revealer

Posted by John Carter on June 2, 2009, 11:07 pm

Please log in for more thread options

I ran Rootkit Revealer from the WIN SYSUTILS package I downloaded from
Microsoft TECHNET site.

It did find some suspect files, but only gave me a list of them which I
saved. I then looked at the info given with the software, but it
really doesn't give me a clue as to how to determine wheteher or not I
should delete the suspects.

My system is Windows XP Pro SP3 plus all auto updates. My system has
been stable not showing any signs of "funnies" going on, no strange
files, no strange activity, etc.

Being of the "If you don't know anything about it, don't mess with it"
philosophy, I haven't tried to tamper with anything given in the list.
Does anyone here have any guidance as to what to do with rootkit
suspect files?

Thanks for any and all replies.
John Carter

Posted by Johnw on June 2, 2009, 11:52 pm

Please log in for more thread options

John Carter wrote on 3/06/2009 :
show/hide quoted text

Google them.

Posted by Kayman on June 3, 2009, 2:39 am

Please log in for more thread options

On Tue, 02 Jun 2009 20:07:44 -0700, John Carter wrote:

show/hide quoted text

Join:
http://forum.sysinternals.com/

Good luck :)

Posted by David H. Lipman on June 3, 2009, 6:34 am

Please log in for more thread options

| I ran Rootkit Revealer from the WIN SYSUTILS package I downloaded from
| Microsoft TECHNET site.

| It did find some suspect files, but only gave me a list of them which I
| saved. I then looked at the info given with the software, but it
| really doesn't give me a clue as to how to determine wheteher or not I
| should delete the suspects.

| My system is Windows XP Pro SP3 plus all auto updates. My system has
| been stable not showing any signs of "funnies" going on, no strange
| files, no strange activity, etc.

| Being of the "If you don't know anything about it, don't mess with it"
| philosophy, I haven't tried to tamper with anything given in the list.
| Does anyone here have any guidance as to what to do with rootkit
| suspect files?

| Thanks for any and all replies.
| John Carter

IFF you have suspicions of a RootKit then the *better* anti rootkit scanner to
run is
Gmer.
http://www.gmer.net/

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Posted by 1PW on June 3, 2009, 6:26 pm

Please log in for more thread options

John Carter wrote:
show/hide quoted text

Hello John:

You could try uploading suspect files to:

show/hide quoted text

However, David H. Lipman's advice is very sound.

Pete
--
show/hide quoted text