aswMbr.exe finds Win32:Aluroot-B but does not fix.

Viruses and worms
1

Hello
I have scanned for viruses with several legitimate scanners including the ones listed by you guys and have come up clean on most except for aswMBR.exe. This one keeps detecting Win32:Aluroot-B in “windows\system32\csrsrv.dll”, but will not fix it. My computer is not displaying any noticeable symptoms of an infection. I have attached the requested reports. Help?.

2

hey and welcome to the forum.

a malware expert will help you from here when one is online later today.

3

Hi I believe that may be a false positive, is it only AswMBR that is reporting it ?

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application

https://dl.dropbox.com/u/73555776/tdss%20start.JPG

[*]Then click on Change parameters.

https://dl.dropbox.com/u/73555776/tdss%20Change%20param.JPG

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

[*]Click the Start Scan button.

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

https://dl.dropbox.com/u/73555776/tdss%20threat.JPG

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

[*]Get the report by selecting Reports

https://dl.dropbox.com/u/73555776/tdss%20report.JPG

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.

4

Hi
Yes, it is only aswMBR.exe reporting it.
I attempted to paste in the TDSSKiller report, but it exceeds the character limit, I have attached it instead.
Thanks

5

OK you are the second one to show this file in aswmbr, in both cases it is the only programme reporting it

I believe this to be a false positive, does a standard Avast scan find it ?

6

A standard avast scan reports no threats, and I ran a boot time scan yesterday with the same result.

7

I think it is a FP I will pass it on to GMER