Author Topic: Rootkit Infection - Avast cannot remove the malware - Only Avast detects it (Read 2439 times)

REDACTED · « **on:** January 18, 2015, 06:12:33 PM »

Hello! I would like to share this problem and try to find a solution. Avas is detecting this:

01:07:37.787 Disk 0 scanning C:\WINDOWS\system32\drivers
01:07:46.424 File: C:\WINDOWS\system32\drivers\ipfltdrv.sys **INFECTED** Win64:Evo-gen [Susp]
01:07:59.298 File: C:\WINDOWS\system32\drivers\wanarp.sys **INFECTED** Win64:Evo-gen [Susp]

However other Rootkit's detection tools such as Malwarebyte and mcafee are not detecting anything.

If you ask Avast to remove it, it says the removal was successful, however after another quick scan it will be there again.

A boot scan has not showed anything.

What should I do?

Eddy · « **Reply #1 on:** January 18, 2015, 06:44:27 PM »

Don't listen to drtweak.
Those files seem to be legitimate windows drivers.
Please report it to avast:
https://www.avast.com/contact-form.php?subject=VIRUS-FILE

CraigB · « **Reply #2 on:** January 18, 2015, 06:48:51 PM »

drtweak also doesn't have permission to suggest tools that are only to be used under the guidance of a malware specialist.

DavidR · « **Reply #3 on:** January 18, 2015, 07:23:39 PM »

@ Leonardo Ferreira
Combofix is a powerful tool that that could also do harm to your system, it should only use under guidance of a malware removal specialist.

In this forum it means 'qualified' malware removal specialists. A list of those qualified is given here, https://forum.avast.com/index.php?topic=53253.0.

Author Topic: Rootkit Infection - Avast cannot remove the malware - Only Avast detects it (Read 2439 times)

REDACTED

Rootkit Infection - Avast cannot remove the malware - Only Avast detects it

Eddy

Re: Rootkit Infection - Avast cannot remove the malware - Only Avast detects it

CraigB

Re: Rootkit Infection - Avast cannot remove the malware - Only Avast detects it

DavidR

Re: Rootkit Infection - Avast cannot remove the malware - Only Avast detects it