Rootkit Blocked Keeps Popping Up!

Viruses and worms
1

So I woke up this morning to Avast going off about a rootkit being blocked The infection is Win32:Rootkit-gen[Rtk]
Im not sure what the hell that is but all i’ve been doing is researching how to get rid of it was in my temp files under AppData???..it’s in my virus chest now…but unlike any other attack this one keeps attempting…every 2 seconds avast pops up saying Rootkit Blocked, Im now running a full system scan but after that Im not sure what to do…Im going to work in about 30 min so when I get home I’d love to get this done and over with…I could just call sony because my laptop is still in warranty but I’m sure Avast can fix this. Please anyone who knows what I should do post your responses.

2

This is good place to start when you get home

http://forum.avast.com/index.php?topic=53253.0

you will have to wait for essexboy, our resident malware expert, to reply to the thread.

3

If it is returning then there are likely to be other elements restoring it.

Download the free version of MBAM (MalwareBytes AntiMalware), install, update, run it and post the contents of the log file.

http://www.malwarebytes.org/mbam.php

4

you can also run GMER

5

I guess no one has told you that the avast anti-rootkit is based on the GMER anti-rootkit, but designed to be more user friendly in not having to sift through the information returned.

As far as I’m concerned you shouldn’t use the GMER anti-rootkit unless you know what you are doing or are using it under instruction.

6

i know how to use gmer

7

You might, but those to whom you are suggesting it might not and it is them that you should be concerned about and that was where my comments are directed given this is a support site.

8

This sounds like it may be the TDL4 MBR rootkit - from reading the beta thread I think this is being added at some stage for both detection and cure. Until then

Please read carefully and follow these steps.

[*]Download TDSSKiller and save it to your Desktop.
[*]Extract its contents to your desktop.
[*]Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillermain.png

[*]If an infected file is detected, the default action will be Cure, click on Continue.

http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerMal-1.png

[*]If a suspicious file is detected, the default action will be Skip, click on Continue.

http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerSuspicious.png

[*]It may ask you to reboot the computer to complete the process. Click on Reboot Now.

http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerCompleted.png

[*]If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
[*]If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of “TDSSKiller.[Version][Date][Time]_log.txt”. Please copy and paste the contents of that file here.