A lot of rootkit

Avast Free Antivirus / Premium Security
1

After an update, my Avast Free find a lot of rootkits, but… some are Avast files, some are MBAM files!
This is the list, all in C:\WINDOWS\system32\drivers:

aavmker4.sys
afd.sys
aswFsBlk.sys
aswmon.sys
aswmon2.sys
aswRdr.sys
aswSP.sys
aswTdi.sys
mbam.sys
mbamswissarmy.sys
mrxsmb.sys
ndproxy.sys
srv.sys

Anyone can help me? Are False Positives?

2

First, ensure that you have the latest virus definitions, avastUI, Maintenance, Updates and do a manual update.

The latest one is 110606-0.

What type of scan were you doing when these were detected ?

3

Check a Rootkit Scan. Also use http://www.comodo.com/business-security/network-protection/cleaning_essentials.php Scan with this and use the Killswitch.exe to identify all Process. After that you are cured or solved. ;D
Before Two days I’m also infected like this… I follow this, then it has been solved.Its My Pleasant advice.

Thank YOu…

4

I wouldn’t try this unless you’re an advance experience user because you can get FP from Comodo Cleaning Essentials (CCE), and you could also lead into problem with you’re PC CCE must be used by an advance experience user only.

5

For me its an FP because i have mbamswissarmy.sys detected but Avast team is not responding on my complain.

I have plenty of FP but different on yours but mostly all are sys files.

6

Are you tried Boot Time scan with your Avast?
Set the heuristic level as High. May Be It will help you…
May the Behavior Based Detection false positive, I think.
http://download.eset.com/special/eos/esetsmartinstaller_enu.exe
http://quickscan.bitdefender.com/
Try them and run a On line Scan… May Be it will bring you which is true…

7

I tried so: I uploaded these suspicious files to :

www.virustotal.com
http://virusscan.jotti.org/
http://virscan.org/

No one of these online scanning sites reported a rootkit…
Can I think that it was a False positive?

8

First you didn’t answer my question:
What type of scan were you doing when these were detected ?

This is crucial, as if this is the anti-rootkit scan, 8 minutes after boot then the heuristic methods used to detect these ‘can’t be replicated’ on the conventional scans that are done at virustotal, etc.

Second, did ensure that your virus definitions are up to date ?
If you have the latest update now 110611-0 are these detections still happening ?

9

Yeah… There are must be FP.

10

Did you read what I just posted, VT is worthless if this was a rootkit scan ???

11

WE need some detailed report from you… Pimpoli.
Are you think your PC is Infected?

12

Check Emsisoft Hijackfree to understand all Process instead Your PC. If anything goes wrong you are infected. Or there must be an false positive.

13

Yes, it is the anti-rootkit scan, 8 minutes after boot. And these alerts occurs AFTER an update (after the 110528-0 update)

14

Hijackfree do not report any malware or rootkit… but I’m afraid: these are AVAST and MBAM files, and also Win system files!

15

Pimpoli, I suggest you to listen to DavidR who is more experienced…

16

Yes it may well have happened after a Virus Definitions update, but that update is really old (May 28) and if this were still the cause there would certainly be many more reports in the forums and we aren’t seeing that.

It would be highly unusual for a problem in a Virus Definitions update to still be present so long after the update (your first post on 11/06/06 9 days after), now 16 days after that update.

This is why I asked if you now had the latest Virus Definitions update and if it was still happening ?

Do you have the Virus Definitions & Engine updates set to Auto (the default setting) ?

I have avast free and have never seen any alert on these avast (asw****.sys ans aavm****.sys) files, if it were an issue with a Virus Definitions update, then I should have seen it along with all others who have responded here. I can’t comment on the other files, but I have MBAM pro on two systems and no detections on its drivers either.