Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: amonra on March 17, 2011, 12:55:57 PM

Title: Another infection by Win32:Rootkit-gen [Rtk]
Post by: amonra on March 17, 2011, 12:55:57 PM
This is the second infection in the last few days. Doesn't Avast do it's job well?

Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: thisiscool on March 17, 2011, 01:55:51 PM
lol i've got the same one a week ago from a website..
but avast removed it at the second he found it.. and the computer was clean like a baby ass!
lol after a couple of days i've decided to formart the computer just in case.
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: amonra on March 17, 2011, 03:13:52 PM
I tried out the Bit Defender Rescue CD as well, after scanning with Avast. My system seems to be clean now. (I hope!) :)
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: Para-Noid on March 18, 2011, 01:18:16 AM
What scan are you using and what settings concerning rootkits do you have? I may be that your rootkits settings are to high. And did you run a boot-time scan? If you run a boot-time scan I advise you to keep and use default settings.  It could be false positives. Try using "quick" setting for root-kits not "full". You might consider getting MalwareBytes  http://filehippo.com/download_malwarebytes_anti_malware/
And Super Anti-Spyware  http://filehippo.com/download_superantispyware/ :)
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: nord on March 18, 2011, 03:12:53 AM
What scan are you using and what settings concerning rootkits do you have? I may be that your rootkits settings are to high. And did you run a boot-time scan? If you run a boot-time scan I advise you to keep and use default settings.  It could be false positives. Try using "quick" setting for root-kits not "full". You might consider getting MalwareBytes  http://filehippo.com/download_malwarebytes_anti_malware/
And Super Anti-Spyware  http://filehippo.com/download_superantispyware/ :)

para-noid,

Have you had good luck with Super anti-spyware and Avast 6.0.1000? I use Avast with Outpost Free 2009 (until they fix the new security suite) and the only problems I've had using Avast are with Super and Ad-ware. Malwarebytes and HitmanPro have worked perfectly with my current firewall and Avast combo.

Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: amonra on March 18, 2011, 08:35:04 AM
What scan are you using and what settings concerning rootkits do you have? I may be that your rootkits settings are to high. And did you run a boot-time scan? If you run a boot-time scan I advise you to keep and use default settings.  It could be false positives. Try using "quick" setting for root-kits not "full". You might consider getting MalwareBytes  http://filehippo.com/download_malwarebytes_anti_malware/
And Super Anti-Spyware  http://filehippo.com/download_superantispyware/ :)
I think my system was infected at March 14. See my another post:
http://forum.avast.com/index.php?topic=73843.0

Yes, I did run a full scan, the boot-time one as well. The detected file in Java cache was deleted. I updated my Java to the latest version, too. Another full scan at March 16. found nothing.

But however, yesterday I noticed a suspicious file in my Users folder named YCemSCi.exe, created at March 14. as well. And a few temp files. Fortunately this time Avast detected them (maybe, the new definition update!). I don't think it is a false positive.

By the way, all my settings are default (Normal).

What about SuperAntiSpyware Portable? Should I give it a try?
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: Para-Noid on March 19, 2011, 12:26:13 AM
What scan are you using and what settings concerning rootkits do you have? I may be that your rootkits settings are to high. And did you run a boot-time scan? If you run a boot-time scan I advise you to keep and use default settings.  It could be false positives. Try using "quick" setting for root-kits not "full". You might consider getting MalwareBytes  http://filehippo.com/download_malwarebytes_anti_malware/
And Super Anti-Spyware  http://filehippo.com/download_superantispyware/ :)

para-noid,

Have you had good luck with Super anti-spyware and Avast 6.0.1000? I use Avast with Outpost Free 2009 (until they fix the new security suite) and the only problems I've had using Avast are with Super and Ad-ware. Malwarebytes and HitmanPro have worked perfectly with my current firewall and Avast combo.


Both SAS and MBAM "do not" conflict with avast and play well with avast. To answer your question...yes. The best indicator is that neither have detected any nasty things as I expected. avast came through with flying colors.
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: Nesivos on March 19, 2011, 03:07:55 AM
There is some talk on the Net that this virus comes with "Gameguard".

In fact there have been some Avast users from two and three years ago that had this virus infect their system

http://www.aeriagames.com/forums/en/viewtopic.php?t=253157 (http://www.aeriagames.com/forums/en/viewtopic.php?t=253157)

http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc (http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc)

Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: amonra on March 19, 2011, 09:43:41 AM
There is some talk on the Net that this virus comes with "Gameguard".

In fact there have been some Avast users from two and three years ago that had this virus infect their system

http://www.aeriagames.com/forums/en/viewtopic.php?t=253157 (http://www.aeriagames.com/forums/en/viewtopic.php?t=253157)

http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc (http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc)



I have nothing to do with Gameguard. I got this infection from a website while surfing. Cannot remember which one. But I guess it did make use of a hole in Java 6u17.

I ran SuperAntiSpyware Portable too. It works well, but found nothing except some cookies listed as adware.
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: Para-Noid on March 19, 2011, 07:39:36 PM
There is some talk on the Net that this virus comes with "Gameguard".

In fact there have been some Avast users from two and three years ago that had this virus infect their system

http://www.aeriagames.com/forums/en/viewtopic.php?t=253157 (http://www.aeriagames.com/forums/en/viewtopic.php?t=253157)

http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc (http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc)


Have you tried MBAM (MalwareBytes) yet?

I have nothing to do with Gameguard. I got this infection from a website while surfing. Cannot remember which one. But I guess it did make use of a hole in Java 6u17.

I ran SuperAntiSpyware Portable too. It works well, but found nothing except some cookies listed as adware.
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: news on March 19, 2011, 08:05:48 PM
There is some talk on the Net that this virus comes with "Gameguard".

In fact there have been some Avast users from two and three years ago that had this virus infect their system

http://www.aeriagames.com/forums/en/viewtopic.php?t=253157 (http://www.aeriagames.com/forums/en/viewtopic.php?t=253157)

http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc (http://answers.yahoo.com/question/index?qid=20080414195550AAqOUvc)



I have nothing to do with Gameguard. I got this infection from a website while surfing. Cannot remember which one. But I guess it did make use of a hole in Java 6u17.

I ran SuperAntiSpyware Portable too. It works well, but found nothing except some cookies listed as adware.

amonra..you may want to update your java software. It's now at Java6 update 24. 
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: amonra on March 19, 2011, 09:12:55 PM
amonra..you may want to update your java software. It's now at Java6 update 24. 

I already did it. Thanks anyway.

(Didn't you read my third post above? ;D)
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: danny96 on March 19, 2011, 09:20:30 PM
I tried out the Bit Defender Rescue CD as well, after scanning with Avast. My system seems to be clean now. (I hope!) :)
Also try to scan your computer with malwarebytes
Title: Re: Another infection by Win32:Rootkit-gen [Rtk]
Post by: amonra on March 19, 2011, 09:32:51 PM
I tried out the Bit Defender Rescue CD as well, after scanning with Avast. My system seems to be clean now. (I hope!) :)
Also try to scan your computer with malwarebytes
Thanks for the tip.