Log in

View Full Version : RootkitRevealer - should I worry?


trodas
18th September 2007, 21:19
I mean - with these results?

http://img64.imageshack.us/img64/7452/rootkitrevealertl2.gif

My Win2k SP4 is a "little" bit ficked up, true. For example windows positions and sizes are not remembered anymore and recently not even the powerbutton works, lol :lol: But can it be these weird registry entry things?

Shall I remove them? Shall I worry?

foxyshadis
19th September 2007, 02:01
The LSA (secrets) is always hidden. d347 is Daemon tools, but it's an old version, newer ones use sptd. The first may or may not mean something, impossible to tell from there. The temporary files are most likely some driver (rootkit) screwing around with the filesystem, though, unless you were browsing while you ran the scan, then it'd be expected.

Check the tool Rootkit hook analyzer as well.

Of course, it doesn't take a rootkit to screw up ACPI and the rest of windows' workings, user-mode junk and programs that screw with system registry settings will do that. Sounds like a time you have to suck it up and just reinstall.

trodas
20th September 2007, 10:11
So you say the SAC* and SAI* policy registres are nothing to worry about? Good :D
I already figured by myself, that the d347prt registers are my old good DeamonTools - but the rest 4 things still do worry me a little :(

Rootkit hook analyzer is running... right now.

http://img440.imageshack.us/img440/6971/rootkithookanalyzerma2.gif

Nothing suspicious, except DeamonTools here :)