New version finds rootkit hidden files - can't delete & nothing else does

[Vlk]

With the invaluable help of polipodi, it seems that we have solved the problem now.
The fix should be included in the latest VPS update (081229-0).

Please try this latest VPS and report back if the problem is really solved.


BTW can anyone who had the problem confirm that their Windows volume is formatted as FAT32? (this would explain the increased number of Acer laptops in the set as Acer seems to preinstall Windows XP on FAT32 volumes).


Thanks
Vlk

[yare]

Hi, my OS is running on FAT32 - I know, outdated but after installing all tools I left it like that (will transfer to NTFS in the future).

I have updated VPS and I am ready to run full scan  - will report results here as soon the scan is over.

Again thank you very much for very quick response to this issue.

[DavidR]

No need for a full scan, just reboot, the anti-rootkit scan runs 8 minutes after boot and takes seconds, so would be quicker than a full scan.

[TheScorpion]

No need for a full scan, just reboot, the anti-rootkit scan runs 8 minutes after boot and takes seconds, so would be quicker than a full scan.

I found that the problem only made itself known if I did a 'full' scan. The scan would freeze at that point (about 3/4 through) and the suspicious files indicated. Just starting or rebooting my pc didn't produce the problem.

BTW can anyone who had the problem confirm that their Windows volume is formatted as FAT32? (this would explain the increased number of Acer laptops in the set as Acer seems to preinstall Windows XP on FAT32 volumes).

My system is FAT32 on an ASUS laptop. I'll run a full scan this morning and report results.
Impressed with the immediate action on the problem. 

[yare]

Everything works just fine  Full scan using avast! GUI completed w/o problems   I have to admit that there are differences in new build - scan is much faster than before (in my case even 30% faster - using same scanning options (thorough/scan archives/all local disks))

I ran full scan (via GUI) because boot-scan worked OK all the time (as TheScorpion has said) - issue with heuristic engine (at least in my case) occurred only when full scan was initiated using avast! GUI and only if scan area included system folder - on demand scan of every other folder/file worked ok.

Again, many thanks to avast! support team for such a quick response. Also many thanks to polipodi for providing test/debug machine that helped with bug reproduction.

[TheScorpion]

Just completed a 'thorough' full scan with no problems.
Also, the 'percentage of files checked'  gauge is now working. Before it would remain at 0%.
Well sorted. Thanks. 

[gcon60]

Vik, polipodi and the rest of the Avast team, thank you all very much for the efforts you put into resolving this problem.  It has been a long journey from November 24th when I raised the issue, until now.  I am delighted you cracked it before we ran out of 2008 – a clean slate for the New Year.

Sorry, I was reluctant to allow access to my PC, but I have been working in computers most of my long life and you get cynical about security matters – paranoid even.  I was relying on a more trusting approach from others; thanks polipodi.

Anyway, upgraded from 1229 to 1296 with VPS 081230-0 and did a thorough scan.  BRILLIANT!  It all worked.

Have a Guid Ne’er day and a great 2009

Gerard
 

[art13]

The problems I mentioned here:

http://forum.avast.com/index.php?topic=41157.0

at both the Packardbell-desktop and the Acer-laptop were solved with installing VPS (081229-0)

Both systems were FAT32 formatted.

Thanks to everbody contributing to the solution.

Art

[CharleyO]

***

Though I did not have this problem, I would also like to thank Vik and the rest of the Avast team for a job well done ... and to polipodi for trusting the avast team to use his computer to research the problem.   


***

[judy one]

I had AVAST on 2 systems.  I tried the new version.  It identified about 90 rootkit viruses that could not be deleted from one system.  Then I did a system restore.  AVAST new version still did the same thing.

BitDefender found about the same number of inaccessible files that were password protected (I recognized them) or compressed.  McAfee found no viruses. 

I believe the new version has a design flaw that is misinterpreting password protected or compressed files as rootkit infections.  I thought the problem was my computer until I found this forum.  Thank you.

[igor]

I believe the new version has a design flaw that is misinterpreting password protected or compressed files as rootkit infections. 

No, it's certainly not the case.
Please post a few examples of the detected filenames - and also check what version of VPS you have.