PLEASE READ BEFORE POSTING

   Use of RootkitRevealer (RKR) and this forum

Please study the RKR web page carefully. 

It contains essential information about what RKR does, how to use it and how to interpret the results.

Don't use your computer while RKR is scanning. 

Start RKR, wait about 10 seconds, click Scan, then leave computer untouched until it completes. An idle machine will minimise the possibility of false positive reports caused by changes to the system during the scan. Background processes may still make intermittent changes, but resulting discrepancies tend to be obvious from their registry or filesystem branch; on a re-scan many may not recur.

Save the discrepancy list to text file as needed. 

Using the File->Save dialog, select "My Computer" and work down to a suitable folder. The "My Documents" and "Desktop" buttons point to a System user's folders.

Use the search feature in the RKR forums. 

For questionable discrepancies, search using a distinctive part of the registry key or path name. Very frequently the same item has appeared before and been commented upon. Often they turn out to be innocuous.

Search Google. 

Googling a distinctive part of the registry key, especially the CLSID, can often lead to forum reports of the application responsible. Similarly, googling filenames may lead to removal advice if malicious. If using long strings copied from posts, ensure that no extra blanks have become embedded in the search string. 

If these options don't help, please post on the RKR forums. 

If you have problems with RKR usage or suspect an RKR malfunction, post on RootkitRevealer Usage
If you suspect an infection, post on RootkitRevealer Logs

When posting a log, paste either the full text log or a representative subsection if it's too large. Screen images are less helpful as they're not searchable. Unless you're commenting on an existing thread, please open a new topic with your issue; don't hijack someone else's.
Thanks. 

Edited by molotov - 13 August 2007 at 8:11am

Author	Message Share Topic Printable Version Delicious Digg Facebook Furl Google MySpace Newsvine reddit StumbleUpon Translate Twitter Windows Live Yahoo Bookmarks Topic Search Topic Options Post Reply Create New Topic
namrehto Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 23 June 2005 Location: Scotland Online Status: Offline Posts: 3861	Topic: PLEASE READ BEFORE POSTING Posted: 15 November 2005 at 7:53am
	Use of RootkitRevealer (RKR) and this forum Please study the RKR web page carefully. It contains essential information about what RKR does, how to use it and how to interpret the results. Don't use your computer while RKR is scanning. Start RKR, wait about 10 seconds, click Scan, then leave computer untouched until it completes. An idle machine will minimise the possibility of false positive reports caused by changes to the system during the scan. Background processes may still make intermittent changes, but resulting discrepancies tend to be obvious from their registry or filesystem branch; on a re-scan many may not recur. Save the discrepancy list to text file as needed. Using the File->Save dialog, select "My Computer" and work down to a suitable folder. The "My Documents" and "Desktop" buttons point to a System user's folders. Use the search feature in the RKR forums. For questionable discrepancies, search using a distinctive part of the registry key or path name. Very frequently the same item has appeared before and been commented upon. Often they turn out to be innocuous. Search Google. Googling a distinctive part of the registry key, especially the CLSID, can often lead to forum reports of the application responsible. Similarly, googling filenames may lead to removal advice if malicious. If using long strings copied from posts, ensure that no extra blanks have become embedded in the search string. If these options don't help, please post on the RKR forums. If you have problems with RKR usage or suspect an RKR malfunction, post on RootkitRevealer Usage If you suspect an infection, post on RootkitRevealer Logs When posting a log, paste either the full text log or a representative subsection if it's too large. Screen images are less helpful as they're not searchable. Unless you're commenting on an existing thread, please open a new topic with your issue; don't hijack someone else's. Thanks. Edited by molotov - 13 August 2007 at 8:11am
	Gil