root kit results

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
Hi,

I ran root kit revealer.  How do I know what is not a false positive?
URL protocol I have heard was an AOL thing.  It came with the computer
but I uninstalled it.   I was also surfing the web while it was running.
  Just an FYI.

Now microsoft is saying that they may not be able to recover from
rootkit that was put there by malware.

What's a poor user to do?
Note:  I am writing this email from FC5 :-)


thanks in advance



it showed the following:
HKLM\SOFTWARE\Classes\webcal\URL Protocol    1/1/2005 1:58 PM    13 bytes    Data
mismatch between Windows API and raw hive data.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheD42BCE3d01    4/2/2006
4:22 AM    25.06 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheFF2AE85d01    4/10/2006
12:17 AM    104.36 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheBA3773d01    4/10/2006
12:13 AM    33.53 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheC83FC3Fd01    4/10/2006
12:13 AM    152.11 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheF5620CAd01    4/10/2006
12:13 AM    18.50 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache7F77AEd01    4/10/2006
12:11 AM    17.86 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheADC0998d01    3/28/2006
2:27 AM    17.84 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheCED41BEd01    4/2/2006
4:24 AM    18.61 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheDF541BEd01    4/2/2006
4:23 AM    21.51 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheBE6C4Ed01    4/10/2006
12:11 AM    32.90 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheD6BD0Dd01    4/10/2006
12:11 AM    32.44 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache64DA0Cd01    4/2/2006
4:23 AM    42.76 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheDD0B34d01    4/10/2006
12:13 AM    32.44 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheB3DD53d01    4/2/2006
4:48 AM    16.53 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache0C6FA3d01    4/10/2006
12:14 AM    41.58 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache6658EDd01    4/10/2006
12:15 AM    28.54 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheC979EFDd01    4/2/2006
4:22 AM    18.53 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache0C0A81d01    4/2/2006
4:48 AM    31.22 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache38DDA1d01    4/10/2006
12:14 AM    28.59 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache836C4Ed01    4/10/2006
12:11 AM    57.42 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache8D5057d01    4/10/2006
12:14 AM    35.68 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheD98DE6Ed01    4/10/2006
12:17 AM    41.25 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache2DB036d01    4/2/2006
4:23 AM    29.57 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache36B74Dd01    4/2/2006
4:22 AM    53.40 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache5500C8d01    4/2/2006
5:14 AM    123.42 KB    Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheD0DA12d01    4/2/2006
4:24 AM    26.53 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache93A8CDd01    4/10/2006
12:15 AM    100.11 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheCB780Dd01    4/2/2006
5:12 AM    95.52 KB    Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheCB780Ed01    4/2/2006
5:12 AM    80.24 KB    Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheD426C4Bd01    4/10/2006
12:11 AM    56.25 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheF0BBA69d01    4/2/2006
4:25 AM    40.91 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache73A8BEd01    4/10/2006
12:13 AM    20.00 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache89ECDFd01    4/10/2006
12:17 AM    17.78 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheCA76BBDd01    4/2/2006
4:23 AM    21.97 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\CacheE30043Cd01    4/10/2006
12:11 AM    154.88 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\A1F2DC24d01    4/10/2006
12:11 AM    19.89 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\A6496C18d01    4/10/2006
12:11 AM    41.14 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\AD0CC906d01    4/10/2006
12:13 AM    28.69 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\ADCF74D9d01    4/2/2006
4:23 AM    53.45 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\BE896C18d01    4/10/2006
12:11 AM    49.48 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C21D2E01d01    4/2/2006
4:24 AM    19.58 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C68D912Ed01    4/10/2006
12:17 AM    16.13 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C9403D67d01    4/10/2006
12:15 AM    28.19 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C9433D67d01    4/10/2006
12:15 AM    21.87 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CA563936d01    4/2/2006
4:26 AM    34.10 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CA5AD7ECd01    4/10/2006
12:17 AM    48.35 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CE9806DEd01    4/2/2006
4:25 AM    31.35 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\D6263C66d01    4/10/2006
12:12 AM    22.58 KB    Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\DAB485B1d01    4/10/2006
12:17 AM    30.45 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\DC1D6C1Bd01    4/10/2006
12:11 AM    40.88 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E02F6C4Bd01    4/10/2006
12:11 AM    19.74 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E60301C7d01    4/2/2006
4:26 AM    35.40 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E6BE27A5d01    4/2/2006
5:12 AM    56.64 KB    Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E8FB6C4Bd01    4/10/2006
12:11 AM    18.67 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\F27E6C18d01    4/10/2006
12:11 AM    56.90 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\F3486C18d01    4/10/2006
12:11 AM    82.92 KB    Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FB453837d01    4/2/2006
5:08 AM    16.30 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FB5639C0d01    4/10/2006
12:17 AM    26.98 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FE76FE3Ad01    4/10/2006
12:17 AM    61.85 KB    Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Local Settings\Temp\~DFCAE8.tmp
4/10/2006 12:07 AM    16.00 KB    Visible in Windows API, but not in MFT or
directory index.
C:\Documents and Settings\owner\Local Settings\Temp\~DFCB2B.tmp
4/10/2006 12:07 AM    512 bytes    Visible in Windows API, but not in MFT or
directory index.
C:\Documents and Settings\owner\Local Settings\Temporary Internet
Files\Content.IE5JB7O9V7\google[1].htm    4/10/2006 12:16 AM    3.57 KB
Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Local Settings\Temporary Internet
Files\Content.IE5\G1I34DUJ\google[2].htm    4/9/2006 11:41 PM    3.57 KB
Visible in Windows API, MFT, but not in directory index.

Re: root kit results

Quoted text here. Click to load it
[snip]

Look here, and follow the instructions:
http://castlecops.com/check130470next.html

HTH,
-jen



Site Timeline