Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: gosub on April 16, 2011, 07:00:12 PM

Title: I cannot remove a rootkit virus
Post by: gosub on April 16, 2011, 07:00:12 PM

New to troubleshooying pc problems but i seem to have a bad one

I have a virus called rootkit and have run multiple boot-time scans but virus keeps reappearing
I understand that it is writing to the MBR but does anyone know how to remove this

Apologies in advance but i have never used a forum and am worried i have posted in the wrong area

Please advise if anyone knows which direction i should follow

Thanks in advance for any replies

Regards

David

Title: Re: I cannot remove a rootkit virus
Post by: essexboy on April 16, 2011, 07:02:30 PM

Hi run this little programme and post the log please

Download aswMBR.exe (http://public.avast.com/~gmerek/aswMBR.exe) ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

(http://i1224.photobucket.com/albums/ee362/Essexboy3/aswmbrscan.gif)
Click the "Scan" button to start scan


(http://i1224.photobucket.com/albums/ee362/Essexboy3/aswmbrsavelog.gif)
On completion of the scan click save log, save it to your desktop and post in your next reply

Title: Re: I cannot remove a rootkit virus
Post by: gosub on April 16, 2011, 07:28:48 PM

Tried to post but my reply seems not to post

Attached is the log file requested but i changed the .dat extension to .log to be able to post it. You will need to revert it

Thanks and kind regards

David

Title: Re: I cannot remove a rootkit virus
Post by: gosub on April 16, 2011, 07:40:44 PM

I think the log file posted has the same virus on it so please beware when viewing the log file

I have done a screenshot also, see attached file.

Is there any way of finding out how i got the virus

Regards

David

Title: Re: I cannot remove a rootkit virus
Post by: essexboy on April 16, 2011, 08:26:18 PM

OK that answered the question


Re-Run aswMBR

Click Scan

On completion of the scan

Click the   Fix Button [color="#FF0000"]
(http://i1224.photobucket.com/albums/ee362/Essexboy3/aswmbrtdl4.gif)



Save the log as before and post in your next reply

Title: Re: I cannot remove a rootkit virus
Post by: gosub on April 16, 2011, 09:15:05 PM

I accidentally closed after running fix so ran it again

See attached screen for results

In case this is concluded can i thank you kindly for your swift help with my problem

Kindest regards

David

Title: Re: I cannot remove a rootkit virus
Post by: essexboy on April 16, 2011, 09:16:38 PM

That looks good - any other problems ?

Title: Re: I cannot remove a rootkit virus
Post by: gosub on April 16, 2011, 09:19:31 PM

None at all unless you know how to reduce mortgages without banks knowing

I am sincerely impressed and thankful for your support with this

I can't thank you enough on fix and turnaround time

Regards

David 'Gosub'

Title: Re: I cannot remove a rootkit virus
Post by: essexboy on April 16, 2011, 10:02:06 PM

No problem that was an easy one  ;D

Title: Re: I cannot remove a rootkit virus
Post by: gosub on April 16, 2011, 10:12:54 PM

Easy or not, your knowledge was offered in great time and i am very grateful

Regards

David