Posted: Sun Sep 24, 2006 10:37 pm Post subject: any of these rootkits need removal??
these were found when I did a rootkit reveal scan:
C:\Documents and Settings\fred\Application Data\Aim\almrpuiw\QUIK82REGAL\urlcache\aim4F.tmp 9/24/2006 1:57 PM 438 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\fred\Application Data\Aim\almrpuiw\QUIK82REGAL\urlcache\aim50.tmp 9/24/2006 2:27 PM 438 bytes Hidden from Windows API.
C:\Documents and Settings\fred\Local Settings\Temporary Internet Files\Content.IE5\0P2F09AF\USKS0002[8].xml 9/24/2006 2:32 PM 25.23 KB Hidden from Windows API.
C:\Documents and Settings\fred\Local Settings\Temporary Internet Files\Content.IE5\0P2F09AF\USKS0002[9].xml 9/24/2006 2:42 PM 1.35 KB Hidden from Windows API.
C:\Documents and Settings\fred\Local Settings\Temporary Internet Files\Content.IE5\TI1HIJQ6\USKS0002[7].xml 9/24/2006 2:22 PM 1.35 KB Hidden from Windows API.
C:\Documents and Settings\fred\Local Settings\Temporary Internet Files\Content.IE5\TI1HIJQ6\USKS0002[8].xml 9/24/2006 2:32 PM 1.35 KB Hidden from Windows API.
C:\Documents and Settings\fred\Local Settings\Temporary Internet Files\Content.IE5\TI1HIJQ6\USKS0002[9].xml 9/24/2006 2:51 PM 1.35 KB Hidden from Windows API.
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP433\A0086106.ini 9/24/2006 1:35 PM 2.63 KB Hidden from Windows API.
C:\System Volume Information\catalog.wci\00010002.ci 9/24/2006 2:37 PM 148.00 KB Hidden from Windows API.
C:\System Volume Information\catalog.wci\00010002.dir 9/24/2006 2:37 PM 1.54 KB Hidden from Windows API.
C:\System Volume Information\catalog.wci\CiFLfffc.000 9/24/2006 2:14 PM 240 bytes Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\catalog.wci\CiFLfffc.001 9/24/2006 2:14 PM 960.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\catalog.wci\CiFLfffc.002 9/24/2006 2:14 PM 960.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\catalog.wci\CiFLfffd.000 9/24/2006 2:37 PM 240 bytes Hidden from Windows API.
C:\System Volume Information\catalog.wci\CiFLfffd.001 9/24/2006 2:37 PM 960.00 KB Hidden from Windows API.
C:\System Volume Information\catalog.wci\CiFLfffd.002 9/24/2006 2:37 PM 960.00 KB Hidden from Windows API.
should these be removed??
Security Expert Premium Member Joined: Mar 10, 2004 Posts: 5394
Posted: Mon Sep 25, 2006 2:56 am Post subject:
There is no indication of a rootkit in your results. The entries are due to activity during the scan, which is easy to see from the time progression noted in your scan results. You must make sure all programs are closed while scanning, or you will get false positives.
The system restore entries were created by your operating while the scan was in progress and are nothing to be concerned about either.
So you are clear - nothing to remove!
_________________ Negster22 - MS MVP - Consumer Security 2006-2008
You can post new topics in this forum You can reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
