Avast! With GMER

[SAMEE]

Is GMER Anti-Root Kit engine using by Avast! Free 5.0...?

[SafeSurf]

GMER is a rootkit scanner.

Avast does have a boot-time scanner, but I do not know what they use for their detection.  This would be a question for one of the Avast developers. 

[RejZoR]

Yes, GMER technology is used in avast! to detect and eliminate rootkits and other hidden software. Though it has been highly modified so i'm not sure how much of the original GMER remained in it.

[SAMEE]

GMER is a rootkit scanner.
Avast does have a boot-time scanner 

I have known about that you said. However, I need to recognize that GMER technology is already included in Avast or Not.

[SAMEE]

Yes, GMER technology is used in avast! to detect and eliminate rootkits and other hidden software. Though it has been highly modified so i'm not sure how much of the original GMER remained in it.

 OH!Nice to hear about that RejZoR and thanks for update.

[Infratech Solutions]

Here is some information about AVAST & GMER:

http://www.avast.com/pr-avast!-gmer-technology-gets-top-score-in-rootkit-detection-tests

[SAMEE]

Here is some information about AVAST & GMER:

http://www.avast.com/pr-avast!-gmer-technology-gets-top-score-in-rootkit-detection-tests

  “GMER is fully integrated and optimized within avast!,” said Przemyslaw Gmerek, founder, GMER."   Avast! is the Best!

Thanks Edj!!!

[s4u]

Wow, I missed that information. Great!!!

[Asyn]

Wow, I missed that information. Great!!!

Well, you missed it long time before...
http://blog.avast.com/2009/07/17/avast%E2%80%99s-top-5-hidden-gems/
asyn

4. Strong antirootkit shield. Starting with version 4.8, avast has a built-in antirootkit scanner. It is based on GMER, one of the most respected specialized antirootkit applications available (in fact, the guy who created the original GMER now works for us). We’re constantly improving the internals of this component so that it’s able to detect and remove even the latest threats, including e.g. the infamous MBR rootkit.

Normally, it’s not necessary to perform any manual rootkit scans as these are done automatically each time you restart your computer. Uses of the Professional Edition can run a manual rootkit scan by creating a task in the Enhanced User Interface and selected Rootkit scan in the Scan Areas section.

[stxNTrm06]

Sorry to disappoint someone, but my experience with GMER is not among the brightest.

I had no problems with GMER version 1.0.14.14536. This is an installation version - it places 4 files in WINDOWS folder, one driver in drivers folder and registers gmer service and I am still using it at present. 

Disappointment came with the newer version GMER 1.0.15.15281 which caused system instability and crashes. This is portable version and gmer.exe file is UPX compressed.



This picture is taken from Sysinternals Process Explorer while GMER 1.0.15.15281 is performing a scan and shows how the system in the backgroung gradualy is getting overloaded to 50 % by two threads and within the next 3-4 minutes the overload rises to 100 %, the system becomes inresponding, further investigation impossible and GMER continues scanning without proplems.

The svchost.exe threads in Process Explorer:

kernel32.dll!CreateThread+0x22 (26 % overload)
ntdll.dll!Rt!AllocateHeap+0x18c (25 % overload)

This situation occured just the same way in different modes:

1. In normal mode
2. In safe mode
3. With firewall enabled (PC Tools).
4. With firewall disabled
5. With used Operating System - Windows XP SP3.
6. With newly installed and updated (including drivers) Operating System - Windows XP SP3 and no other software installed.

And there was no support for GMER and none of my E-mails were ever answered.

"... Avast! is the Best! ..."

Maybe, but not the GMER technology. That is the reason I am still afraid to perform full scans in Avast, because of the GMER crashing technology.

The cause for my system instability using GMER 1.0.15.15281 remained uncleared but I suppose it was because of that version some incompatibility with systems based on Intel Processors supporting Hyper-Threading Technology (Two Virtual Processors) enabled in BIOS which is my case.

So, if those anti-malware-test.com tests were performed on my system, GMER would have been at the bottom of the list because of inability to perform any scans at all and that might have been the case with some others too:

GMER?
http://www.wilderssecurity.com/showthread.php?t=262268

Thanks. 

[DavidR]

In all the time I have had avast5 with the (GMER based) anti-rootkit built in I have not had a single problem with any of the scans incorporating it.

I think that because of the way the avast anti-rootkit module is built even with GMER technology it is a world of difference as the avast module isn't the same raw data gathering and leave it up to the user to decide what is or isn't a rootkit. The idea of the avast anti-rootkit module is where ever possible to have taken those decisions for the user.

I have had problems running the stand alone GMER anti-rootkit scan in the past, I can't recall the version now, yet none with any avast scan incorporating the anti-rootkit scan.

[SAMEE]

I had no problems with GMER version 1.0.14.14536. This is an installation version - it places 4 files in WINDOWS folder, one driver in drivers folder and registers gmer service and I am still using it at present. 

Disappointment came with the newer version GMER 1.0.15.15281 which caused system instability and crashes. This is portable version and gmer.exe file is UPX compressed.

  Would this be a GMER Version problem?

[SafeSurf]

Would this be a GMER Version problem?

Perhaps.  But I agree with DavidR in that I have never had a problem on any of the machines I run using Avast 5.0+ with a Boot-time scan using any OS.  So please feel confident that it is fine to run. 

[SpeedyPC]

I had no problems with GMER version 1.0.14.14536. This is an installation version - it places 4 files in WINDOWS folder, one driver in drivers folder and registers gmer service and I am still using it at present.  

Disappointment came with the newer version GMER 1.0.15.15281 which caused system instability and crashes. This is portable version and gmer.exe file is UPX compressed.

  Would this be a GMER Version problem?

May I ask what firewall are you currently using? I had a similar problem related to system instability and crashes using Comodo and I've managed to solved to the problem, only if you're using Comodo Firewall which is related to an Execution Control Setting problem and a few minor things in the Comodo settings.

I just need to know what firewall are you currently using before I give you further instruction.

(Edited) Forgot I didn't have any further problem using the latest GMER version with my current system setup below my sig.

[Asyn]

But I agree with DavidR in that I have never had a problem on any of the machines I run using Avast 5.0+ with a Boot-time scan using any OS.  So please feel confident that it is fine to run. 

+1
Also keep in mind that avast performs a root kit scan every time you start of your machine...!! (about 8 mins after boot-up)
asyn