Author Topic: ROOTKIT scan log  (Read 3018 times)

0 Members and 1 Guest are viewing this topic.

kiwipops

  • Guest
ROOTKIT scan log
« on: July 31, 2008, 04:47:25 AM »
hi again,have still been unable to get a current scan date,when I scan with Avast,but when I used the rootkit scan I found 3 services entries that could not be identified,does this mean anything
Service {89FE77F6-92FC-40F7-856C-AAFD60911E3D} [???]
Service {C08DF078-4392-4359-8229-20FA527CBBDD} [???]
Service {EA22DB8F-2CF2-4EA0-91A1-ED32A79D99ED} [???]
The question marks were part of the scan...
Thanks

wyrmrider

  • Guest
Re: ROOTKIT scan log
« Reply #1 on: July 31, 2008, 04:53:28 AM »
someone else will have to answer the rootkit question
but did you try and schedule a boot time Avast scan
rt click the ball - update- rt click the ball schedule scan
reboot
quarantine/chest  do not remove/delete
post the log

general instructions follow

The C:\Program Files\Alwil Software\Avast4\DATA\report\aswBoot.txt
provides a more user friendly summary of the boot-time scan and it should list any detections.

here are the instructions to send result to virus total shamelessly copied from DavidR

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect\* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.
« Last Edit: July 31, 2008, 04:57:54 AM by wyrmrider »

kiwipops

  • Guest
Re: ROOTKIT scan log
« Reply #2 on: July 31, 2008, 10:00:32 AM »
Thanks for your prompt reply.I did the boot scan,and almost straight away was told that there was Win32 trojan.gen in the System volume file,although there was a list of options it was immediately deleted,although all I did was press the arrow key.I left the scan running and when I returned,the computer had rebooted,and there was one of those Microsoft error reports things saying"the system has recovered from a serious failure or words to that effect.It asked if I wanted to send the report,which is probably a waste of time,as I cannot access the Microsoft site,Windows updates fail,and last time a panel appeared telling me the site I was trying to connect to lacked certification.But anyway I updated the Avast program,which I have delayed doing,because I was hoping the email support might sort out which was the best way to do this,given all the problems I have been experiencing.I did another boot scan and have attached the log.

wyrmrider

  • Guest
Re: ROOTKIT scan log
« Reply #3 on: July 31, 2008, 06:04:18 PM »
Hi
If no one responds to this soon post in the avast malware removal forum (below in lists of forums)
with a link to this thread
good luck