Start a Conversation

Unsolved

This post is more than 5 years old

7632

April 5th, 2007 06:00

Rootkit revealer log

I have a log from the program rootkit revealer, I would go to the offical forum, but it seems that the place has been revieving a lot of spam so I can't post a new topic there. The log is listed below, is there anything that I should be concerned about?
 
HKU\.DEFAULT\Control Panel\International 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKU\.DEFAULT\Control Panel\International\Geo 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKU\S-1-5-21-2745831510-1764736546-1148512468-1006\Control Panel\International 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKU\S-1-5-21-2745831510-1764736546-1148512468-1006\Control Panel\International\Geo 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKU\S-1-5-21-2745831510-1764736546-1148512468-1006\Software\Microsoft\Command Processor 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKU\S-1-5-18\Control Panel\International 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKU\S-1-5-18\Control Panel\International\Geo 1/30/2007 2:23 PM 0 bytes Security mismatch.
HKLM\SECURITY\Policy\Secrets\SAC* 9/3/2002 7:18 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 9/3/2002 7:18 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\webcal\URL Protocol 8/18/2004 12:13 PM 13 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Command Processor 1/30/2007 2:23 PM 0 bytes Security mismatch.
C:\Documents and Settings\The Boone Family\My Documents\sharp1025\Small Business\Personal\Songs\Please Mr Postman....:Zone.Identifier 4/4/2007 9:27 PM 26 bytes Hidden from Windows API.

20.5K Posts

April 6th, 2007 02:00

HKLM\SOFTWARE\Classes\webcal\URL Protocol is a common false positive. The timestamp is probably when the PC was built. Common with Dells.
The rest look normal.

If you still have questions, you can post at either of these forums:

http://forum.sysinternals.com/forum_topics.asp?FID=17
http://www.castlecops.com/f233-Rootkit_Revelations.html

1.1K Posts

April 6th, 2007 03:00

I'll your word on it.
No Events found!

Top