AVAST detected a rootkit, help please

aliEnRIK

latest virus defitions are 5990, yours is 5962 which suggests it wasnt up to date when you ran it

poppie123

aliEnRIK wrote: »

Looks like theres still something in the root

Please open malwarebytes, goto LOGS and post the WHOLE of the last log

reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)
If you get a message that you cant write to the hosts file then Press the SHIFT key, and whilst holding it RIGHT CLICK and select RUN AS (admin)

............................................................

run SOPHOS ANTI ROOTKIT
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

then rerun combofix and post the log

Do i have to register to run the SOPHOS ANTI ROOTKIT? and then hit submit?

aliEnRIK

Yep, go for it

poppie123

Its currently still scanning (sophos anti rootkit) and so far underneath description it has found 5 unknown hidden files. Am i going to be asked to do anything with these? and if i am what should i do?
Thanks

aliEnRIK

As ive never had it find anything myself im really not sure

Just press whatever is required to remove everything (Sorry I cant help better than that, but its not like I can give you a run down of what to press)

poppie123

aliEnRIK wrote: »

As ive never had it find anything myself im really not sure

Just press whatever is required to remove everything (Sorry I cant help better than that, but its not like I can give you a run down of what to press)

god i am getting worried now, one of the hidden files is C:\windowssystem32\config\regback\default.....(cant see the rest)

Thats sounds important:eek:

aliEnRIK

Poppie

Please calm down

Just let it run and do its thing

poppie123

aliEnRIK wrote: »

Poppie

Please calm down

Just let it run and do its thing

Sorry i accidentally stopped the scan so i have got to start again.

poppie123

Right i have updated Malwarebytes and here is my latest log.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 5990
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019
08/03/2011 18:24:12
mbam-log-2011-03-08 (18-24-12).txt
Scan type: Quick scan
Objects scanned: 170930
Time elapsed: 7 minute(s), 38 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

aliEnRIK

Poppie

please keep to running sophos