Avast ANTIROOTKIT

Pondus · 2017-01-15T19:21:55.000Z

do you need that file?

To answer your question, yes

Experts are notified but they are probably not online before tomorrow

why are you running a rootkit scan, any problems?

system · 2017-01-15T19:35:44.000Z

OK I will upload a log once scanning is finished.
Before few days I saw that Google Chrome will not run any more (it displayed sad face so I asked Google for help.
They answered I need to try run some malware software.
I tried many of them and noticed that some of them want to install specific driver by Windows boot - to test the system - but they failed.
Then I was 99% sure that I have something but only Avast Antirootkit actually said there are Rootkits.
It runs now for more then hour and found more then 8000 items so I’m waiting it to finish.
I suppose I need to purchase some license to remove them?
Could you please give me any info about that?
Thank you.

Pondus · 2017-01-15T19:41:32.000Z

I suppose I need to purchase some license to remove them?

No

when scan is finish, attach log, dont remove anything

also see here > https://forum.avast.com/index.php?topic=194892.0
Scroll down to second picture > Farbar recovery scan tool
Follow instructions and attach the two diagnostic logs

Then a expert will assist you tomorrow

system · 2017-01-15T19:52:11.000Z

OK will do so, thank you.

Rednose · 2017-01-15T20:12:16.000Z

Hi guys,

I just want to mention that aswar is a very old and obsolete version, you schould not use anymore.

Greetz, Red.

system · 2017-01-15T20:32:56.000Z

Is there any other Rootkit scanner for Windows Server 2008?
Thank you.

Eddy · 2017-01-15T21:09:44.000Z

There are searchengines

If you are running a server and need to ask the things you did here, I suggest you hire a real admin.

system · 2017-01-15T22:27:03.000Z

Hello
I did try other rootkit scanners but they can not run because they can not install some driver when booting. Only Avast was able to find them…
What real admin I need to hire? Could you please give me more info’s?
Thank you.

dbrisendine · 2017-01-17T07:32:24.000Z

Eddy post:10:

There are searchengines

If you are running a server and need to ask the things you did here, I suggest you hire a real admin.

I think the question is, why are you running Windows Server 2008? Are you providing services to users or just running a no-cost OS?

system · 2017-01-18T08:43:36.000Z

I’m running VPS and there is Server 2008 installed.

Pondus · 2017-01-18T08:46:03.000Z

for help, attach the requested logs

system · 2017-01-18T10:16:20.000Z

Pondus post:14:

for help, attach the requested logs

Hello
I sent you a PM.
Thank you.

Eddy · 2017-01-18T10:39:18.000Z

Attach the log files to your post here.

dbrisendine · 2017-01-18T16:20:46.000Z

Thanks for the log files but I am not going to download files from a unsecured, 3rd-party site.
This is a VIRTUAL machine. None of Avast’s scanners are designed to work on a virtual system. You could see if a scan with TDSSkiller finds anything; it does not need a reboot to scan the system. However, if it does scan, the software will most likely find every file suspicious as the files’ characteristics are not the ones expected due to the system running in a Virtual container.
Being a virtual system, why not restart the server with a fresh image? Or re-install Chrome to see if that fixes the Chrome issue?

system · 2017-01-18T17:02:25.000Z

Hello
that’s 3 txt files inside ZIP archive, nothing else. Do you have other option where I can upload the file? I can not post my log files to public.
TDSSkiller was not found anything but it can not install boot driver, just like MallWarebyte and other I try. I suppose it is because of virtual file system?
I can not install any fresh image because I have running programs, database etc. I’m aware that I can move them to new VPS but if possible, I will try to clean current system.
I reinstalled Chrome many times, it does not work. Chrome is not important at this moment.
Thank you for any help.

system · 2017-01-19T08:17:07.000Z

Does anyone want to help?
I can send log files on PM.
Thank you.

dbrisendine · 2017-01-21T07:17:25.000Z

I will look at the log files PROVIDED my malware scanners say the file(s) are safe. What scanner produced these logs?

system · 2017-01-26T11:36:00.000Z

Hello
I’ve sent you a PM.
Thank you.

system · 2017-01-31T07:04:50.000Z

dbrisendine post:20:

I will look at the log files PROVIDED my malware scanners say the file(s) are safe. What scanner produced these logs?

Hello dbrisendine
di you have any news? I’v also sent you a PM
Thank you.

dbrisendine · 2017-01-31T08:05:51.000Z

I apologize but I thought I replied to your message (PM) but now I can not find my reply.

Your FRST logs look clean; that is, they show no signs of infections or adware running on the system. You may want to uninstall some of the scanners you have installed as multiple AV scanners can conflict with each other and produce false positive results.

As to the aswar scan results, it seems these files are being tagged because their attributes are not default values. The file values are different due to the OS being run in a VR machine environment instead of a physical environment.

Announcements