UBCD4Win Forums: anybody55 - Viewing Profile

Thank you for the replies.

I trust Rootkit revealer for what it does. I don't fully trust any anti-malware software, though. And given what rootkits do, rootkitty's approach makes a lot of sense to me.

I decided to run rootkitty again so I could post the log here, which is as follows:

C:\Documents and Settings\Administrator\ Application Data

C:\Documents and Settings\Administrator\ Local Settings

C:\Documents and Settings\Administrator\ NetHood

C:\Documents and Settings\Administrator\ NTUSER.DAT

C:\Documents and Settings\Administrator\ NtUser.dat.LOG

C:\Documents and Settings\Administrator\ ntuser.ini

C:\Documents and Settings\Administrator\ PrintHood

C:\Documents and Settings\Administrator\ SendTo

C:\Documents and Settings\Administrator\ Templates

C:\Documents and Settings\Administrator\ Application Data\desktop.ini

C:\Documents and Settings\Administrator\ Application Data\Microsoft\Protect\ CREDHIST

C:\Documents and Settings\Administrator\ Local Settings\Application Data

C:\Documents and Settings\Administrator\ Local Settings\desktop.ini

C:\Documents and Settings\Administrator\ Local Settings\Application Data\IconCache.db

C:\Documents and Settings\Administrator\ Local Settings\Application Data\Microsoft\Windows\ UsrClass.dat

C:\Documents and Settings\Administrator\ Local Settings\Application Data\Microsoft\Windows\ UsrClass.dat.LOG

C:\Documents and Settings\Administrator\ SendTo\desktop.ini

C:\Documents and Settings\Administrator\ Start Menu\desktop.ini

C:\Documents and Settings\Administrator\ Start Menu\Programs\desktop. ini

C:\Documents and Settings\Administrator\ Start Menu\Programs\Accessories\ desktop.ini

C:\Documents and Settings\Administrator\ Start Menu\Programs\Accessories\ Accessibility\desktop. ini

C:\Documents and Settings\Administrator\ Start Menu\Programs\Accessories\ Entertainment\desktop. ini

C:\Documents and Settings\Administrator\ Start Menu\Programs\Startup\ desktop.ini

I recognize almost all the entries except for a few, and I'm not an expert, but they all seem normal for windows. So I'm not sure why they show up when I hit compare? Could I be using the program wrong? This doesn't look like anything to worry about, but the fact that I know I'm ignorant about the program and that it did find differences is troublesome to me. What do you think?

Just wanted to weigh in and say that the new rootkitty is also not working for me, either. Same problem. The win file is fine, the pe builder file is blank. I'm using UBCD4WinV303 w/patch.

But since I'm already posting here, I'm gonna throw out a question.

I ran the older version of rootkitty (forget the number) that comes on UBCD4WinV303. And it did indeed find differences between windows and pe.

However, everything that showed up was well...Normal. Common entries I'd expect to see in a healthy windows...Nothing sounded suspicious at all.

I looked all around the internet for documentation for root kitty and couldn't find any, so I'm at a loss as to how to interpret the output.

I'd love to post the log but it was overwritten when I ran the new version, I think.

But what does this mean? Does it tend to spit out normal sounding entries that actually aren't an indication of anything wrong, or does having anything at all show up in the compare field mean you're infected with something?

I've ran rootkit revealer, which finds nothing, and this is a pretty fresh wipe/reinstall of windows (I'm using XP SP2), so
I don't know what to think. I'd hate to re-flash the bios/wipe the drive just because I misunderstood the program. Thank you for your time.