First can I just say what a great program Avast is and a big thank you toeveryone on the team - I promote it to everyone I know and have used it for 7 yrs now and have cleaned lots of pc's that have other antivirus software on that failed to clean.
Bootscan rocks... Or did untill the below
Root kit problem
I encountered this problem on a friends system that did not have protection: On loading Avast it detected a virus when testing the memory, this is not something I have ever encountered. Avast let me down on this instance, it would nt detect it usingthe boot scan nor could it delet it when it detected it on the memory test the problem was called gasfkykwvtyaqf
After about 6 hrs of frustration I found an article on bleepingcomputer.com
Please download Sophos Anti-rootkit & save it to your desktop.http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html
Note: If using the vendor's download site you will be asked to register with MySophos so an email
containing an activation link can be sent to your email address.
Be sure to print out and read the Sophos Anti-Rookit User Manual and Release Notes.
Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click
Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now".
Click Yes and allow the driver and its randomly named .tmp file (i.e. F.tmp) to load if asked.
If the scan did not start automatically, make sure the following are checked:
Local Hard Drives
Click Start scan.
Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper
When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK
Click on the suspicious file to display more information about it in the lower panel which also
includes whether the item is recommended for removal.
Files tagged as Removable: No are not marked for removal and cannot be removed.
Files tagged as Removable: Yes (clean up recommended) are marked for removal by
Files tagged as Removable: Yes (but clean up not recommended) are not marked for
removal because Sophos did not recognize them. These files will require further
Select only items recommended for removal, then click "Clean up checked items". You will be
asked to confirm, click Yes.
A pop up window will appear advising the cleanup will finish when you restart your computer.
Click Restart Now.
After reboot, a dialog box displays the files you selected for removal and the action taken.
Click Empty list and then click Continue to re-scan your computer a second time to ensure
everything was cleaned.
When done, go to > Run..., then copy and paste this command into the open box:
This should open the log from the rootkit scan. Please post this log in your next reply. If you have
a problem, you can find sarscan.log in C:\Documents and Settings\<username>\Local
Important: Before performing an anti-rootkit (ARK) scan it is recommended to do the following to ensure
BleepingComputer.com > infected with gasfky, loo... http://www.bleepingcomputer.com/forums/lo
3 of 6 01/10/09 20:39andrewmrobbins
more accurate results and avoid common issues that may cause false detections.
Disconnect from the Internet or physically unplug you Internet cable connection.
Clean out your temporary files.
Close all open programs, scheduling/updating tasks and background processes that might activate
during the scan including the screensaver.
Temporarily disable your anti-virus and real-time anti-spyware protection.
After starting the scan, do not use the computer until the scan has completed.
When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to
Note: Not all hidden components detected by ARKs are malicious. It is normal for a Firewall, some
Anti-virus and Anti-malware software
I hope the above does not break any rules as I have only just joined and am just trying to help others with a problem that I managed to solve
I am not sure why Avast was unable to handle this problem but it has not put me off
Keep up the good work