root kit results

  • Thread starter Thread starter no one
  • Start date Start date
N

no one

Hi,

I ran root kit revealer. How do I know what is not a false positive?
URL protocol I have heard was an AOL thing. It came with the computer
but I uninstalled it. I was also surfing the web while it was running.
Just an FYI.

Now microsoft is saying that they may not be able to recover from
rootkit that was put there by malware.

What's a poor user to do?
Note: I am writing this email from FC5 :-)


thanks in advance



it showed the following:
HKLM\SOFTWARE\Classes\webcal\URL Protocol 1/1/2005 1:58 PM 13 bytes Data
mismatch between Windows API and raw hive data.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\0D42BCE3d01 4/2/2006
4:22 AM 25.06 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\0FF2AE85d01 4/10/2006
12:17 AM 104.36 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\11BA3773d01 4/10/2006
12:13 AM 33.53 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\1C83FC3Fd01 4/10/2006
12:13 AM 152.11 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\1F5620CAd01 4/10/2006
12:13 AM 18.50 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\277F77AEd01 4/10/2006
12:11 AM 17.86 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\2ADC0998d01 3/28/2006
2:27 AM 17.84 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\2CED41BEd01 4/2/2006
4:24 AM 18.61 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\2DF541BEd01 4/2/2006
4:23 AM 21.51 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\38BE6C4Ed01 4/10/2006
12:11 AM 32.90 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\38D6BD0Dd01 4/10/2006
12:11 AM 32.44 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\4364DA0Cd01 4/2/2006
4:23 AM 42.76 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\51DD0B34d01 4/10/2006
12:13 AM 32.44 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\52B3DD53d01 4/2/2006
4:48 AM 16.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\550C6FA3d01 4/10/2006
12:14 AM 41.58 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\556658EDd01 4/10/2006
12:15 AM 28.54 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\5C979EFDd01 4/2/2006
4:22 AM 18.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\610C0A81d01 4/2/2006
4:48 AM 31.22 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\6238DDA1d01 4/10/2006
12:14 AM 28.59 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\62836C4Ed01 4/10/2006
12:11 AM 57.42 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\658D5057d01 4/10/2006
12:14 AM 35.68 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\6D98DE6Ed01 4/10/2006
12:17 AM 41.25 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\802DB036d01 4/2/2006
4:23 AM 29.57 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8236B74Dd01 4/2/2006
4:22 AM 53.40 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\845500C8d01 4/2/2006
5:14 AM 123.42 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\85D0DA12d01 4/2/2006
4:24 AM 26.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8793A8CDd01 4/10/2006
12:15 AM 100.11 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\88CB780Dd01 4/2/2006
5:12 AM 95.52 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\88CB780Ed01 4/2/2006
5:12 AM 80.24 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8D426C4Bd01 4/10/2006
12:11 AM 56.25 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8F0BBA69d01 4/2/2006
4:25 AM 40.91 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9973A8BEd01 4/10/2006
12:13 AM 20.00 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9989ECDFd01 4/10/2006
12:17 AM 17.78 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9CA76BBDd01 4/2/2006
4:23 AM 21.97 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9E30043Cd01 4/10/2006
12:11 AM 154.88 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\A1F2DC24d01 4/10/2006
12:11 AM 19.89 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\A6496C18d01 4/10/2006
12:11 AM 41.14 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\AD0CC906d01 4/10/2006
12:13 AM 28.69 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\ADCF74D9d01 4/2/2006
4:23 AM 53.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\BE896C18d01 4/10/2006
12:11 AM 49.48 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C21D2E01d01 4/2/2006
4:24 AM 19.58 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C68D912Ed01 4/10/2006
12:17 AM 16.13 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C9403D67d01 4/10/2006
12:15 AM 28.19 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C9433D67d01 4/10/2006
12:15 AM 21.87 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CA563936d01 4/2/2006
4:26 AM 34.10 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CA5AD7ECd01 4/10/2006
12:17 AM 48.35 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CE9806DEd01 4/2/2006
4:25 AM 31.35 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\D6263C66d01 4/10/2006
12:12 AM 22.58 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\DAB485B1d01 4/10/2006
12:17 AM 30.45 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\DC1D6C1Bd01 4/10/2006
12:11 AM 40.88 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E02F6C4Bd01 4/10/2006
12:11 AM 19.74 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E60301C7d01 4/2/2006
4:26 AM 35.40 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E6BE27A5d01 4/2/2006
5:12 AM 56.64 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E8FB6C4Bd01 4/10/2006
12:11 AM 18.67 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\F27E6C18d01 4/10/2006
12:11 AM 56.90 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\F3486C18d01 4/10/2006
12:11 AM 82.92 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FB453837d01 4/2/2006
5:08 AM 16.30 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FB5639C0d01 4/10/2006
12:17 AM 26.98 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FE76FE3Ad01 4/10/2006
12:17 AM 61.85 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Local Settings\Temp\~DFCAE8.tmp
4/10/2006 12:07 AM 16.00 KB Visible in Windows API, but not in MFT or
directory index.
C:\Documents and Settings\owner\Local Settings\Temp\~DFCB2B.tmp
4/10/2006 12:07 AM 512 bytes Visible in Windows API, but not in MFT or
directory index.
C:\Documents and Settings\owner\Local Settings\Temporary Internet
Files\Content.IE5\0JB7O9V7\google[1].htm 4/10/2006 12:16 AM 3.57 KB
Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Local Settings\Temporary Internet
Files\Content.IE5\G1I34DUJ\google[2].htm 4/9/2006 11:41 PM 3.57 KB
Visible in Windows API, MFT, but not in directory index.
 
no one said:
Hi,

I ran root kit revealer. How do I know what is not a false positive?
URL protocol I have heard was an AOL thing. It came with the computer but
I uninstalled it. I was also surfing the web while it was running. Just
an FYI.

Now microsoft is saying that they may not be able to recover from rootkit
that was put there by malware.

What's a poor user to do?
Note: I am writing this email from FC5 :-)
Click to expand...
[snip]

Look here, and follow the instructions:
http://castlecops.com/check130470next.html

HTH,
-jen
 
Back
Top