|
|
|
|
![]() ![]() |
Sep 10 2007, 07:42 AM
Post
#1
|
|
|
Premium Member Group: [HOSTED] Posts: 286 Joined: 17-June 07 Member No.: 22,702 |
I ran a rootkit revealer scan on my Windows XP system, but I find it difficult to interpret the output.
![]() From what I can gather, the registry key discrepancies might indicate that the registry keys storing rootkit device drivers and service settings are not visible to the Windows API, but are present in the raw scan of the registry hive data, and that the files associated with the rootkit are not visible to Windows API directory scans, but are present in the scan of the raw file system data. The help file says that there is no definitive way to determine, based on the output, if a rootkit is present, but that you should examine all reported discrepancies to ensure that they are explainable. Can anyone with a trained eye look at the output and help me with either a thumbs up or thumbs down as far as a rootkit being present on my system? |
|
|
|
Sep 10 2007, 08:37 PM
Post
#2
|
|
|
Super Member Group: [HOSTED] Posts: 557 Joined: 25-April 05 Member No.: 4,374 myCENTs:17.04 |
I can give it a try but you will have to post the results.
As a side note, several legitimate programs use rootkit type technologies in their functionality. I know several years back Norton Antivirus hid its definition files from the OS. This worked really well to keep viruses from attacking the definition files directly. No one realized what was going on until programs such as rootkit revealer were created and a bunch of suspicious files were popping up. Since then I have heard of several non-rootkit files being detected. You could call them a false positive. Like I said before post the results and I am sure there are several individuals here that can help you. |
|
|
|
Sep 11 2007, 05:31 PM
Post
#3
|
|
|
Premium Member Group: [HOSTED] Posts: 286 Joined: 17-June 07 Member No.: 22,702 |
I have saved the results in jpg format and included the picture in the post above.
The results can also be viewed at: http://www.imagefilez.com/out.php/i162695_revealer.jpg |
|
|
|
Sep 11 2007, 05:36 PM
Post
#4
|
|
|
Premium Member Group: [HOSTED] Posts: 393 Joined: 9-March 07 From: Tucson, AZ Member No.: 20,794 |
If you don't know what something is, google it. There's legit reasons for hiding files from the API...some being to hide emulation software like Daemon Tools from the retarded protection schemes on game and software CDs, to hiding important antivirus engine files from potential attack from viruses. So just because it says "hidden from windows api" doesn't necessarily mean it's bad.
|
|
|
|
![]() ![]() |
Similar Topics
|
Lo-Fi Version | Time is now: 3rd December 2008 - 11:34 PM |