Analysis results with aswMBR.exe, Avast detected rootkit

Viruses and worms
1

goodnight, I need help. Avast detected rootkit on my pc, do a review with aswMBR.exe and this was the result that fearlessness:

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2014-05-15 23:04:26

23:04:26.107 OS Version: Windows 6.1.7600
23:04:26.107 Number of processors: 1 586 0x170A
23:04:26.112 ComputerName: PATTY-PC UserName: Patty
23:04:27.139 Initialize success
23:04:30.212 AVAST engine defs: 14051502
23:04:48.566 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IdeDeviceP0T0L0-0
23:04:48.570 Disk 0 Vendor: SAMSUNG_HM320II 2AC101C4 Size: 305245MB BusType: 11
23:04:48.756 Disk 0 MBR read successfully
23:04:48.763 Disk 0 MBR scan
23:04:48.769 Disk 0 unknown MBR code
23:04:48.781 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
23:04:48.788 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 119900 MB offset 206848
23:04:48.819 Disk 0 Partition 3 00 82 Linux swap 2000 MB offset 245762048
23:04:48.828 Disk 0 Partition - 00 05 Extended 183243 MB offset 249860094
23:04:48.868 Disk 0 Partition 4 00 83 Linux 183243 MB offset 249860096
23:04:48.890 Disk 0 scanning sectors +625141760
23:04:48.963 Disk 0 scanning C:\Windows\system32\drivers
23:04:57.957 Service scanning
23:05:09.517 Service NvUpdSrv C:\Program Files\NVIDIA Corporation\Update Center\nvupdate.exe INFECTED Win32:Evo-gen [Susp]
23:05:19.322 Modules scanning
23:05:31.593 Disk 0 trace - called modules:
23:05:31.617 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys dxgkrnl.sys igdkmd32.sys dxgmms1.sys
23:05:31.628 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0x85624030]
23:05:31.639 3 CLASSPNP.SYS[8899859e] → nt!IofCallDriver → \Device\Ide\IdeDeviceP0T0L0-0[0x851ab908]
23:05:32.060 AVAST engine scan C:\Windows
23:05:34.927 AVAST engine scan C:\Windows\system32
23:08:06.188 AVAST engine scan C:\Windows\system32\drivers
23:08:19.753 AVAST engine scan C:\Users\Patty
23:09:31.305 AVAST engine scan C:\ProgramData
23:09:43.097 Scan finished successfully

That could explain this result mean? I hope you can help me, thanks!

2

Attach your logs. (MBAM and OTL…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0

3

Do you have a dedicated GPU (An addon that didn’t come with the CPU). For example the GTX Series or GT series.

That service that Avast! detected thinks it’s susipcious.

Can you go to the following directory?

C:\Program File\NVIDIA Corporation\Update Center\nvupdate.exe

  • Copy (Ctrl + C) it, then paste (Ctrl + V) it to your desktop.

THEN

Go to VIRUSTOTAL and upload the file. Give us the link when done.

====================================================================================================

I’ve checked m system. nvupdate doesn’t exist fr NVIDIA cards. (Hidden Files, System Files, nadda) So, my guess is this… Just to be sure, attach the logs and VT scan of that file.

http://www.herdprotect.com/nvupdate.exe-4875af1d4a7b1d017691259dbcc01480b4721248.aspx

^^

That might not be the right file.