Hi! I have a problem and I hope you can help me to solve it.
Recently I was updating the sound driver of my pc, from hxxp://www.ma-config.com/es and when the update was succesful avast notified me of a possible rootkit and I make a Boot-time scan, but nothing appears in the scan. I downloaded AVG anti rootkit free and a rootkit was detected in C:\Windows\System32\Drivers with .SYS extension, I deleted and reboot the pc but then I make a scan again and AVG anti rootkit free told me that there was another one rookit in the same folder: C:\Windows\System32\Drivers I think that the rootkit that I deleted previosly was not deleted but rename.
I make scans using Malwarebytes, OTL and aswmBR.exe. and I´ve attached the log files of the respectives programs. So I hope someone can help me 'cause I don´t wanna lost my pc… I appreciate your prompt help.
:OTL
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a7x8mj7d)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{148145DD-5AF9-4049-8755-142C1F4BFEBE}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=410&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtD0F0FyEtByE0DyE0F0CtAzztBtD0CtN0D0Tzu0StBtAzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=1669840488
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=SP_ss&mntrId=a01c820c000000000000000000000000&tlver=1.5.29.1&instlRef=sst&babTrack&q="
[2012/08/04 00:49:28 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Foxconn\AppData\Roaming\mozilla\Firefox\Profiles\1r7a86ck.default\extensions\ffxtlbr@babylon.com
O2 - BHO: (no name) - {68DD98BF-9DE8-418C-89F0-E37AC61CC2D9} - No CLSID value found.
O2 - BHO: (no name) - {F1AF26F8-1828-4279-ABCE-074EF3235BD7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
OK it did not want to leave the building, time for the sledgehammer
Please downloadThe Avenger by Swandog46 to your Desktop.
[*]Right click on the Avenger.zip folder and select “Extract All…”
[*] Follow the prompts and extract the avenger folder to your desktop
Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Begin copying here:
Drivers to delete:
a7x8mj7d
Files to delete:
C:\windows\system32\drivers\a7x8mj7d.sys
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
Now, open the avenger folder and start The Avenger program by clicking on its icon.
[*] Right click on the window under Input script here:, and select Paste.
[*] You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
[*] Click on Execute
[*] Answer “Yes” twice when prompted.
The Avenger will automatically do the following:
[*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Delete”, The Avenger will actually restart your system twice.)
[*]On reboot, it will briefly open a black command window on your desktop, this is normal.
[*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
[*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
Please copy/paste the content of c:\avenger.txt into your reply along with a fresh OTL log .
It looks like it is changing on the boot, there are no rootkit type activities however, it will need a deeper look
Download and Install Combofix
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
Hidden drivers are in themselves not a problem. This one is probably being generated by a programme on your system. Is Avast detecting it on the antirootkit scan ?
Nope. I’ve enabled in settings rootkit scan on system startup. Today I made a boot-time scan and no rootkits was found…
What do you think?
Is it a false positive of avg anti rootkit free?
However, previously (when this problem began) avast notified me about a possible infection due by a rootkit when I updated sound driver…
Was it an avast false positive too???
I found in google a similar problem with hidden drivers detected with avg anti rootkit here: http://bit.ly/YH80lq
The hidden driver file is generated by Alcohol 120!
