Help with rootalyzer results please

[gordonw]

I run an FSC using Vista Home Premium and have just run a Rootalyzer deepscan and would like help with the results. (A quick scan came up with no problems.) Here is the log.

// info: Rootkit removal help file
// copyright: (c) 2008 Safer Networking Ltd. All rights reserved.

:: RootAlyzer Results
File:"No admin in ACL","C:\Windows\Internet Logs\tvDebug.log"
File:"Unknown ADS","C:\Users\Gordon\Desktop\To go to data drive\Malta 2007\December Holiday - MHB confirmation.eml:OECustomProperty:$DATA"
File:"Unknown ADS","C:\Users\Gordon\Desktop\To go to data drive\Malta 2007\Malta booking_files\December Holiday.eml:OECustomProperty:$DATA"
File:"Unknown ADS","C:\Users\Gordon\Desktop\To go to data drive\Malta 2007\Malta booking_files\Travel Confirmation EPUJZO.eml:OECustomProperty:$DATA"
File:"No admin in ACL","C:\Users\Gordon\AppData\Local\Temp\~DF64A8.tmp"
File:"Unknown ADS","C:\Users\Gordon\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\44D915DC-00000001.eml:OECustomProperty:$DATA"
File:"No admin in ACL","C:\Program Files\HP\HP Software Update\HpuFunction.dll"
File:"No admin in ACL","C:\Program Files\HP\HP Software Update\hpwuSchd2.exe"
File:"No admin in ACL","C:\Program Files\HP\HP Software Update\Session.dat"
File:"No admin in ACL","C:\Program Files\HP\HP Software Update\Updates.dat"
Directory:"No admin in ACL","C:\Windows\Internet Logs"
Directory:"No admin in ACL","C:\Users\All Users\Symantec\SRTSP\SrtETmp"
Directory:"No admin in ACL","C:\ProgramData\Symantec\SRTSP\SrtETmp"
Directory:"No admin in ACL","C:\Program Files\HP\HP Software Update"

Looking at other threads about Rootalyzer results, I assume that as I have an HP printer and use Norton, the entries referring to HP and Symantec can be ignored. I also recognise those referring to December holiday and Malta, which leaves the ones below:

File:"No admin in ACL","C:\Windows\Internet Logs\tvDebug.log"

File:"No admin in ACL","C:\Users\Gordon\AppData\Local\Temp\~DF64A8.tmp"
File:"Unknown ADS","C:\Users\Gordon\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\44D915DC-00000001.eml:OECustomProperty:$DATA"
Directory:"No admin in ACL","C:\Windows\Internet Logs"

Any help/advice would be appreciated. I'm using version 0.2

Thank you.

[debbieclord]

I myself had just downloaded the RootAlyzer late last night. My computer is a Vista Home Premium, a year old this August. I did a deep scan and I don't know how to annualized the results either. Could you please let me know when you find out.
Part of my results went like this:

File:"Unknown ADS","C:\Users\Debbie\AppData\Local\VirtualStore\ProgramData\TEMP:DFC5A2B2:$DATA"
File:"No admin in ACL","C:\Users\Debbie\AppData\Local\Temp\FFWSGINST\crawlersrch.xml"
File:"Unknown ADS","C:\Users\Debbie\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\03145043-00000001.eml:OECustomProperty:$DATA"
File:"No admin in ACL","C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat"
File:"No admin in ACL","C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crawler Toolbar\More Crawler Products.lnk"

I would appreciate it if you could let me know what the answer is. Thanks.

[PepiMK]

The second Unknown ADS looks somewhat regular, I've added OECustomProperty to the whitelist (Outlook Express email files also have a legit other data stream named OEStandardProperty).

The first one is imho a known legit one, too.

The Office Data file should be in the whitelist and not appear at all. Which version does RootAlyzer show?

Not sure about the two Crawler Toolbar entries.

[honda12]

Well Crawler Toolbar comes bundled with Spyware Terminator (http://www.spywareterminator.com/)

so @debbieclord if you have Spyware Terminator that would explain it