@ddcc_7: could you try the newer 0.1.2 link? The entries your screenshot shows look like... well, I'm not sure if it's a false positive, but it's not a rootkit
0.1.1 was quite harsh in testing for buffer overflow possibilities (buffer overflows are responsible for many of todays security holes). It does so by checking the maximum length the registry says a subkey might have against the lengths of all subkeys. Most systems come up clear, but after it has first been reported I've checked all our virtual machines I could get hold of and found a clean one that showed the same symptons.
Since it was just a theoretical concept and the chance of applications failing here and that an exploit for such failing could exist, that thing has been removed from 0.1.2 until we've learned more about the background.
I'll make sure the next version shows more in the "Details" column! (and maybe add the expected length to the popup window that contains more details)
As for W2k and the quick scan page, that's a limitation of Windows; the "tile view" mode with multiple columns per icon is a feature of the common controls library 6.0 or later, shipped since XP. W2k has a 5.x version of it that is not capable of that. Sure, modern GUIs would allow anything, but I prefer using standard controls because that allows for better accessibility support usually.
@SpeeDemon: RootkitRevealer mentions the #0 hiding trick which granted is not checked in RootAlyzer yet, but is on my immediate todo-list (we already cover that in Spybot-S&D).
Reply With Quote