I’m trying to find about 500 Gb on my C drive that I can’t account for and someone suggested it might be a rootkit. I ran CCE and it identified two of them:
====== System Information ====== Computer Name: OWNER-PC Log on User: Grampa Memory Size: 2.96 GB. Windows Directory: C:\Windows Windows Version: Xp (32bit) CCE Version: 2.5.242177.201 Virus database version: 18149 [09:37:25] Scan started. ====== Cleanup results ====== C:\Windows.old\Windows$NtUninstallKB31718$\3424892869@ Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\bckfg.tmp Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\cfg.ini Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\Desktop.ini Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\keywords Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\kwrd.dll Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\L Rootkit.HiddenDir HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\lsflt7.ver Rootkit.HiddenFile HIDDENFILE Clean UnKnown C:\Windows.old\Windows$NtUninstallKB31718$\3424892869\U Rootkit.HiddenDir HIDDENFILE Clean UnKnown C:\Windows\System32\mfc45.dat Heur.Corrupt.PE@4294967295 VIRUS Clean UnKnown
So I went ahead and “cleaned” it but when I rerun CCE, they’re still there. I tried going into this folder and got as far as the $NT… folder but was denied permission for access. Tried to change permissions and that didn’t seem to work either. I’m stymied. Any ideas?
Jerry