[dobbelina]

Ahh, I finally got it to work.
As Rootkitty still is in the "developing stage", I took the liberty to create an additional method that works similarly (unfortunately no md5's).
I've tried to simplify it as much as possible.
Here's how you do:
1. Download the Microsoft utility Windiff from here: http://www.grigsoft.com/windiff.zip,
copy it to some location on your BootCD.

2. Open up your text editor and copy and paste the following:

dir /s /b /ah >scan1.txt
dir /s /b /a-h >>scan1.txt

Save the file as "Scan1.cmd"

3. Open up your text editor and copy and paste the following:

dir /s /b /ah >scan2.txt
dir /s /b /a-h >>scan2.txt

Save the file as "Scan2.cmd"

You now have 3 files,WinDiff.Exe, Scan1.cmd and Scan2.cmd

Copy Scan1.cmd and Scan2.cmd to the root of your C: drive.
Run Scan1.cmd.
When finished, boot into UBCD and run Scan2.cmd.
Compare with WinDiff.

This post has been edited by dobbelina: 24 January 2007 - 12:40 AM

[anybody55]

Just wanted to weigh in and say that the new rootkitty is also not working for me, either. Same problem. The win file is fine, the pe builder file is blank. I'm using UBCD4WinV303 w/patch.

But since I'm already posting here, I'm gonna throw out a question.

I ran the older version of rootkitty (forget the number) that comes on UBCD4WinV303. And it did indeed find differences between windows and pe.

However, everything that showed up was well...Normal. Common entries I'd expect to see in a healthy windows...Nothing sounded suspicious at all.

I looked all around the internet for documentation for root kitty and couldn't find any, so I'm at a loss as to how to interpret the output.

I'd love to post the log but it was overwritten when I ran the new version, I think.

But what does this mean? Does it tend to spit out normal sounding entries that actually aren't an indication of anything wrong, or does having anything at all show up in the compare field mean you're infected with something?

I've ran rootkit revealer, which finds nothing, and this is a pretty fresh wipe/reinstall of windows (I'm using XP SP2), so
I don't know what to think. I'd hate to re-flash the bios/wipe the drive just because I misunderstood the program. Thank you for your time.

[LittlBUGer]

rootkitty is a home-grown rootkit application and I don't think it's nearly as advanced as, say, RootKit Revealer that you ran, so I wouldn't fully trust the results of rootkitty compared to a commercial product.

[rdsok]

Actually I do trust Rootkitty and what it reveals... but its setup for an advanced user that can recognise what is normal Windows files that may be listed and what is unusual.

[pcuser]

RootKitty shows you ALL differences and has no way of knowing whether it's good or bad.

[anybody55]

Thank you for the replies.

I trust Rootkit revealer for what it does. I don't fully trust any anti-malware software, though. And given what rootkits do, rootkitty's approach makes a lot of sense to me.

I decided to run rootkitty again so I could post the log here, which is as follows:

C:\Documents and Settings\Administrator\Application Data

C:\Documents and Settings\Administrator\Local Settings

C:\Documents and Settings\Administrator\NetHood

C:\Documents and Settings\Administrator\NTUSER.DAT

C:\Documents and Settings\Administrator\NtUser.dat.LOG

C:\Documents and Settings\Administrator\ntuser.ini

C:\Documents and Settings\Administrator\PrintHood

C:\Documents and Settings\Administrator\SendTo

C:\Documents and Settings\Administrator\Templates

C:\Documents and Settings\Administrator\Application Data\desktop.ini

C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\CREDHIST

C:\Documents and Settings\Administrator\Local Settings\Application Data

C:\Documents and Settings\Administrator\Local Settings\desktop.ini

C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG

C:\Documents and Settings\Administrator\SendTo\desktop.ini

C:\Documents and Settings\Administrator\Start Menu\desktop.ini

C:\Documents and Settings\Administrator\Start Menu\Programs\desktop.ini

C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\desktop.ini

C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\desktop.ini

C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\desktop.ini

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini

I recognize almost all the entries except for a few, and I'm not an expert, but they all seem normal for windows. So I'm not sure why they show up when I hit compare? Could I be using the program wrong? This doesn't look like anything to worry about, but the fact that I know I'm ignorant about the program and that it did find differences is troublesome to me. What do you think?