Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Thistledown on October 05, 2009, 06:29:49 AM
-
Avast keeps telling me that I have a rootkit and every time I've tried to move it to the chest it tells me that it can't because the program is being used. I downloaded a rootkit specific program and the most its done is tell me that its in the master boot record but it can't remove it. Any suggestions?
-
Boot time Avast Antivirus Scanning
http://www.digitalred.com/avast-boot-time.php
http://forum.avast.com/index.php?topic=46018.0
-
Can you please post the name of the rootkit, and any filename and path information.
What rootkit program did you download? You might be able to run it in safe mode.
-
The boot time scan doesn't work. I used the Trend Micro rootkit buster and the rootkit itself is called Win32:Alureon-DA and its under the file C:\\Windows\System32\gasfkyphtttxw.dll I don't know about the path information, where would I find it?
-
Welcome Thistledown
Using Search I found:
http://forum.avast.com/index.php?topic=49215.0
http://forum.avast.com/index.php?topic=49203.0
Looks like a bit of a nasty infection so its best to include operating system and Service Pack level to aid in infection removal.
-
I used rootrepeal but it keeps giving me an error code. Suggestions?
-
C:\\Windows\System32\gasfkyphtttxw.dll
actually contains the path information (C, windows, system etc...it's the route to the folder) and this is indeed a nasty infection.
The dll will be likely recreated and renamed each time it's removed.
Haven't got time myself to help right now, a forum search- plus looking at YoKenny's links -could give you some more info. (Unfortunately that info is not likely to be totally reassuring.)
Anyway, we'll do what's possible.
If you have any important data that isn't backed up yet, I'd back it up now, just in case.
-
I just noticed that I put this on the wrong forum, sorry about that. I'll post the question again in the correct area later.
-
Just leave it where it is as this would just generate more posts responding to what has already been said. Try the boot-time scan as suggested first and report the findings.
Also read the other related topics that were given.
-
I've done multiple scans with a few of the suggested programs in other posts but it hasn't worked. They have either been inefective or haven't even found the rootkit. On the plus side I've managed to get a lot of other types of malware off my computer. I have my computer backed up so if worst comes to worst I can reformat it if I need to.
Again I apologize for posting this in the wrong area.
-
I did a safe boot and tried a virus scan then. When I attempted to move the rootkit to the chest I got the message "The maximum number of secrets that may be stored in a single system has been exceded". What does that mean?
-
First can I just say what a great program Avast is and a big thank you toeveryone on the team - I promote it to everyone I know and have used it for 7 yrs now and have cleaned lots of pc's that have other antivirus software on that failed to clean.
Bootscan rocks... Or did untill the below
Root kit problem
I encountered this problem on a friends system that did not have protection: On loading Avast it detected a virus when testing the memory, this is not something I have ever encountered. Avast let me down on this instance, it would nt detect it usingthe boot scan nor could it delet it when it detected it on the memory test the problem was called gasfkykwvtyaqf
After about 6 hrs of frustration I found an article on bleepingcomputer.com
Please download Sophos Anti-rootkit & save it to your desktop.
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html
Note: If using the vendor's download site you will be asked to register with MySophos so an email
containing an activation link can be sent to your email address.
Be sure to print out and read the Sophos Anti-Rookit User Manual and Release Notes.
Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click
Accept.
Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now".
Click Yes and allow the driver and its randomly named .tmp file (i.e. F.tmp) to load if asked.
If the scan did not start automatically, make sure the following are checked:
Running processes
Windows Registry
Local Hard Drives
Click Start scan.
Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper
panel.
When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK
to continue.
Click on the suspicious file to display more information about it in the lower panel which also
includes whether the item is recommended for removal.
Files tagged as Removable: No are not marked for removal and cannot be removed.
Files tagged as Removable: Yes (clean up recommended) are marked for removal by
default.
Files tagged as Removable: Yes (but clean up not recommended) are not marked for
removal because Sophos did not recognize them. These files will require further
investigation.
Select only items recommended for removal, then click "Clean up checked items". You will be
asked to confirm, click Yes.
A pop up window will appear advising the cleanup will finish when you restart your computer.
Click Restart Now.
After reboot, a dialog box displays the files you selected for removal and the action taken.
Click Empty list and then click Continue to re-scan your computer a second time to ensure
everything was cleaned.
When done, go to > Run..., then copy and paste this command into the open box:
%temp%\sarscan.log
This should open the log from the rootkit scan. Please post this log in your next reply. If you have
a problem, you can find sarscan.log in C:\Documents and Settings\<username>\Local
Settings\Temp\.
Important: Before performing an anti-rootkit (ARK) scan it is recommended to do the following to ensure
BleepingComputer.com > infected with gasfky, loo... http://www.bleepingcomputer.com/forums/loļ¬versi...
3 of 6 01/10/09 20:39andrewmrobbins
more accurate results and avoid common issues that may cause false detections.
Disconnect from the Internet or physically unplug you Internet cable connection.
Clean out your temporary files.
Close all open programs, scheduling/updating tasks and background processes that might activate
during the scan including the screensaver.
Temporarily disable your anti-virus and real-time anti-spyware protection.
After starting the scan, do not use the computer until the scan has completed.
When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to
the Internet.
Note: Not all hidden components detected by ARKs are malicious. It is normal for a Firewall, some
Anti-virus and Anti-malware software
I hope the above does not break any rules as I have only just joined and am just trying to help others with a problem that I managed to solve
I am not sure why Avast was unable to handle this problem but it has not put me off
Keep up the good work
-
It didn't work, everything is either classified as non removeable or removeable but not suggested. I think that I'm just going to back up my music then do a complete system restore.
I appreciate everyone's help.
-
Sorry, thistledown, I don't know exactly what "maximum secrets.." means in this context, a "secret" is defined as an encrypted piece of information, such as a password or username, and it sounds a likely type of behaviour for a rootkit file, which by nature can be hidden or encrypted, and/or buried in what's called the alternate data stream. (Which simply is a way of saying the file offers one reading for its visible part, but has hidden and unreadable components that differ in structure/size somewhere else.)
A system restore will not fix this infection, I'm afraid, only "proper" manual/specialist fixing (which I'm not qualified to confidently perform) or a full format and reinstall will get rid of it.
What were the other programs you attempted to run, and a brief description of the problem encountered by each one? It's possible there may be another program that can nail it. What's needed (which sounds like it should be simple but isn't always) is to find the executable that recreates its spawn, I believe it is the spawn (my description) that is being detected, but not the main "carrier". That is why it keeps coming back.
You might want to try the Sophos program mentioned above, too.
There are other programs, like Unlocker, that can sometimes allow an otherwise un-movable file to be deleted.
Thing is, how much trouble do you want to go to on this, when a backup (don't back up anything from the OS; just your own saved files) and then format/reinstall is a bit of a PITA, but at least you know what you're in for, and with some certainty about the end result.?
-
I've been asking on a few forums and doing some research so I've tried multiple systems. I have tried rootrepeal, which kept giving me errors, sophos, the results for which are on a previous post of mine, Avast (of course), superanti spyware which didn't even detect it, malware bytes which also didn't detect it and radix which again, didn't detect it.
The overall vibe has been that I'm screwed. I'm using a Toshiba computer running off of Vista and I was planning on using the recovey disc. Will that work or is it not drastic enough?
-
I actually don't know if the recovery disk will be drastic enough. Some part of the Windows reinstall must include a format, to wipe all files from the disk. I've never had a computer with OEM operating system installed; always had the Windows installation disk, so I don't know about using recovery partitions, sorry.
You might want to try some of the apps listed here. (http://downloads.andymanchesta.com/antirk.html)
I'd look at trying Rootkit revealer (by Sysinternals, one of the original anti-rootkits), Rootalyzer, by the makers of Spybot, and maybe F-secure's Blacklight.
Thing is, you will probably need advice before trying to remove what is found, as there are often hidden objects that are quite legitimate. It definitely is not safe to just delete anything found. (Even if you can.)
I'd also keep updatting MBAM, and run it again. It's pretty good on these (from what I read) if it can detect them.
-
I've been trying other devices but they aren't finding anything. Is it possible Avast is having a false alarm? If not I'll try the system recovery CD and if that doesn't work I'll just go ahead a wipe my computer and reinstall.
-
It's possible it's a FP. Worth checking, for sure.
When Avast detected it do you recall the file name and path?
The Avast rootkit scan runs 8 minutes after boot, you can't actually command it to run, you could try downloading GMER (which is the same one Avast uses) and get that to do a scan, report on what is found, please. Download it from the AndyManchester site I linked you to, earlier.
TM rootkit buster detected it as C:\\Windows\System32\gasfkyphtttxw.dll. (Are you certain there was an extra "\" between "C" and "Windows" in that name?)
Can you find the file, and if so, upload it to www.virustotal.org for a multiple online scan.
-
You can actually command it to run.
- avast! Rootkit Scan - Windows Start, Run and copy and paste this command (including the quotes, assumes that you installed avast in the default location) "C:\Program Files\Alwil Software\Avast4\ashQuick.exe" "<RTK>SUPERQUICK" and click OK.
The rootkit scan also runs before the Standard or Thorough on-demand scans, so it is possible to initiate it outside of the 8 minutes after boot anti-rootkit scan.
####
Before doing that you can look in the C:\Program Files\Alwil Software\Avast4\DATA\Log\aswAr.log file, check this file using notepad and copy and past the info on the detection. This contains info on the last
-
GMER keeps crashing my computer. I'm tired of dealing with this so tomorrow I'm just going to use the recovery disk. If that doesn't work I'm torn between doing a complete reinstall and taking a sledge hammer to my laptop.
-
I'm inclined to think it is more likely to be the real deal (a rootkit or similar) than a FP, based on your reports of what won't run/computer crashes etc.
I hope the recovery disk does the job for you, but I think a full format will be required.
-
We'll see what happens. I'll post my results later.