root kit results

N

no one

Hi,

I ran root kit revealer. How do I know what is not a false positive?
URL protocol I have heard was an AOL thing. It came with the computer
but I uninstalled it. I was also surfing the web while it was running.
Just an FYI.

Now microsoft is saying that they may not be able to recover from
rootkit that was put there by malware.

What's a poor user to do?
Note: I am writing this email from FC5 :)


thanks in advance



it showed the following:
HKLM\SOFTWARE\Classes\webcal\URL Protocol 1/1/2005 1:58 PM 13 bytes Data
mismatch between Windows API and raw hive data.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\0D42BCE3d01 4/2/2006
4:22 AM 25.06 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\0FF2AE85d01 4/10/2006
12:17 AM 104.36 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\11BA3773d01 4/10/2006
12:13 AM 33.53 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\1C83FC3Fd01 4/10/2006
12:13 AM 152.11 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\1F5620CAd01 4/10/2006
12:13 AM 18.50 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\277F77AEd01 4/10/2006
12:11 AM 17.86 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\2ADC0998d01 3/28/2006
2:27 AM 17.84 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\2CED41BEd01 4/2/2006
4:24 AM 18.61 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\2DF541BEd01 4/2/2006
4:23 AM 21.51 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\38BE6C4Ed01 4/10/2006
12:11 AM 32.90 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\38D6BD0Dd01 4/10/2006
12:11 AM 32.44 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\4364DA0Cd01 4/2/2006
4:23 AM 42.76 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\51DD0B34d01 4/10/2006
12:13 AM 32.44 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\52B3DD53d01 4/2/2006
4:48 AM 16.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\550C6FA3d01 4/10/2006
12:14 AM 41.58 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\556658EDd01 4/10/2006
12:15 AM 28.54 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\5C979EFDd01 4/2/2006
4:22 AM 18.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\610C0A81d01 4/2/2006
4:48 AM 31.22 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\6238DDA1d01 4/10/2006
12:14 AM 28.59 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\62836C4Ed01 4/10/2006
12:11 AM 57.42 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\658D5057d01 4/10/2006
12:14 AM 35.68 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\6D98DE6Ed01 4/10/2006
12:17 AM 41.25 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\802DB036d01 4/2/2006
4:23 AM 29.57 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8236B74Dd01 4/2/2006
4:22 AM 53.40 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\845500C8d01 4/2/2006
5:14 AM 123.42 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\85D0DA12d01 4/2/2006
4:24 AM 26.53 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8793A8CDd01 4/10/2006
12:15 AM 100.11 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\88CB780Dd01 4/2/2006
5:12 AM 95.52 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\88CB780Ed01 4/2/2006
5:12 AM 80.24 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8D426C4Bd01 4/10/2006
12:11 AM 56.25 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\8F0BBA69d01 4/2/2006
4:25 AM 40.91 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9973A8BEd01 4/10/2006
12:13 AM 20.00 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9989ECDFd01 4/10/2006
12:17 AM 17.78 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9CA76BBDd01 4/2/2006
4:23 AM 21.97 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\9E30043Cd01 4/10/2006
12:11 AM 154.88 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\A1F2DC24d01 4/10/2006
12:11 AM 19.89 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\A6496C18d01 4/10/2006
12:11 AM 41.14 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\AD0CC906d01 4/10/2006
12:13 AM 28.69 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\ADCF74D9d01 4/2/2006
4:23 AM 53.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\BE896C18d01 4/10/2006
12:11 AM 49.48 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C21D2E01d01 4/2/2006
4:24 AM 19.58 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C68D912Ed01 4/10/2006
12:17 AM 16.13 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C9403D67d01 4/10/2006
12:15 AM 28.19 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\C9433D67d01 4/10/2006
12:15 AM 21.87 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CA563936d01 4/2/2006
4:26 AM 34.10 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CA5AD7ECd01 4/10/2006
12:17 AM 48.35 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\CE9806DEd01 4/2/2006
4:25 AM 31.35 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\D6263C66d01 4/10/2006
12:12 AM 22.58 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\DAB485B1d01 4/10/2006
12:17 AM 30.45 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\DC1D6C1Bd01 4/10/2006
12:11 AM 40.88 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E02F6C4Bd01 4/10/2006
12:11 AM 19.74 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E60301C7d01 4/2/2006
4:26 AM 35.40 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E6BE27A5d01 4/2/2006
5:12 AM 56.64 KB Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\E8FB6C4Bd01 4/10/2006
12:11 AM 18.67 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\F27E6C18d01 4/10/2006
12:11 AM 56.90 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\F3486C18d01 4/10/2006
12:11 AM 82.92 KB Hidden from Windows API.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FB453837d01 4/2/2006
5:08 AM 16.30 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FB5639C0d01 4/10/2006
12:17 AM 26.98 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Application
Data\Mozilla\Firefox\Profiles\default.tyc\Cache\FE76FE3Ad01 4/10/2006
12:17 AM 61.85 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Local Settings\Temp\~DFCAE8.tmp
4/10/2006 12:07 AM 16.00 KB Visible in Windows API, but not in MFT or
directory index.
C:\Documents and Settings\owner\Local Settings\Temp\~DFCB2B.tmp
4/10/2006 12:07 AM 512 bytes Visible in Windows API, but not in MFT or
directory index.
C:\Documents and Settings\owner\Local Settings\Temporary Internet
Files\Content.IE5\0JB7O9V7\google[1].htm 4/10/2006 12:16 AM 3.57 KB
Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\owner\Local Settings\Temporary Internet
Files\Content.IE5\G1I34DUJ\google[2].htm 4/9/2006 11:41 PM 3.57 KB
Visible in Windows API, MFT, but not in directory index.
 
J

jen

no one said:
Hi,

I ran root kit revealer. How do I know what is not a false positive?
URL protocol I have heard was an AOL thing. It came with the computer but
I uninstalled it. I was also surfing the web while it was running. Just
an FYI.

Now microsoft is saying that they may not be able to recover from rootkit
that was put there by malware.

What's a poor user to do?
Note: I am writing this email from FC5 :)
Click to expand...
[snip]

Look here, and follow the instructions:
http://castlecops.com/check130470next.html

HTH,
-jen
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Rootkit ? 5
Avast Positives: What Now? 8
new file fragmentation 1
batch backups/ exclude command 5
Confusing scan results 5
excessive hard disc activity 4
Any point to backing up prefetch files 3
Virus check question 4

Top