Sysinternals Rootkit Revealer

I just scanned my pc with the Sysinternals Rootkit Revealer and its found a few "discrepancies". Just wondering, how do I delete them.

 

It depends what was found. How many problems were identified and, of those, how many are real rootkit malware?

I usually try at least two rootkit scanners to make sure I don't have false positives, then I take action on what remains- either addressing the discrepancies directly, or by reformat and reinstall of Windows.

Icesword is a good scanner and also allows you to clean many nasties too. As does F-Secure's Blacklight.

 

Be careful! Rootkit Revealer (RR) should only really if you can interpret and understand its results. 'Discrepancies' it reports are not necessarily issues that need to be (or even should be) addressed. RR understands the raw binary format of the registry hive files, and what it does is to (a) parse the registry hives directly and (b) parse the registry using the Windows API (this is what normal apps do, incl. regedit). RR then reports any discrepancies between the two. This can lead to discrepancies for at least the following reasons:

- Any changes made to the registry between the two scans will become 'discrepancies'. It is common that legitimate registry updates will take place between the two scans, and so they need to be filtered out before fixing.

- Some applications use unusual techniques for copy protection which can lead RR to report discrepancies (for instance, some apps embed zero-bytes into registry key names, or value names). If you delete the entries concerned, you might find one of your other apps no longer works.

- Of course, some rootkits may make registry changes which RR will detect, too.

PS: RR also scans so-called NTFS meta-files, and some security apps (and other legitimate apps) use these. Older versions of Kaspersky are an example.

So, I would suggest you post your detailed RR logs to the "Rootkit Revealer logs" section of SysInternals' forums - they are still open as I speak), and you should receive some expert help.

 

I would also be very careful about deleting stuff if you have little knowledge about it.
Just because it finds something doesn't mean it's malicious.

On a side note, you could also try GMER (made by GMER here on Wilders)
http://www.gmer.net