Hi all. I was wondering if you could help me out!
I ran a scan with Avast and my computer started to behave erratically. Text on Avast, my desktop icon names and startmenu also started to vanish when my mouse was near them. I stopped the scan half an hour into it (the scan seemed freakishly slow … as slow as 512k a second at times), wondering what the problem was and noticed that the scan had found 181 “Threat:Rootkit: system modification” warnings in the C:\Windows folder.
I let Avast delete these threats, and Avast gave me a message “Action postponed until the next …” beside each threat. As I closed Avast down, Avast advised me to start a bootscan, which I agreed to. However, upon restart instead of a bootscan Windows started a CHDSK scan, claiming my C drive was dirty. I assumed this was a legit Windows action, and not a malicious action done by the rootkit infection. Anyhow, the CHDSK scan finished and Windows restarted without the Avast bootscan starting up. I set a bootscan and restarted the computer again. This time the bootscan started and completed with no infections found…
To make sure there really was no problem, I went into safe mode and ran Avast. Incidentally, I noticed all the shield controls were off in safe mode. Is this normal? I started a full scan anyway. Nothing found.
Starting up Windows normally, I ran a quickscan in Avast. Nothing found. Then I ran a full scan again. The same erratic Windows behaviour occurred during the scan, with over 100 rootkit threats found, text in apps/desktop icons and the startmenu vanishing and slow disk activity.
Other weird Windows behaviour I’ve observed include:
- When I checked on the properties of some folders during the scan, the properties window would often be blackened out, the text barely visible.
- Folder windows often not responding and when they do they leave afterimages in other folder windows underneath them.
- when I looking at a .txt file in notepad I could not save any amendments I made. Instead I was variously given strange messages about there not being “enough resources to save” or the filename being incorrect and not being able to “save to diskette.” That last one surely wasn’t even a regular Windows warning!
- Couldn’t even get taskmanager up.
- Opening some other applications would result in a warning about the program not being supported or a “The application failed to initialize properly (0xc000012d). Click on OK to terminate the application” warning.
- Starting up Spybot, Windows gave me a warning that it had been modified. I shut it down just in case.
- I ran a full scan in Superantispyware and Windows went crazy in exactly the same way as when I ran an Avast full scan.
- Avast or Superantispyware stop responding if I stopva scan. Trying to close them down, I get a message claiming that the system has locked them.
- Copying large amounts of data is slower than normal. The estimated time left is often wildly exaggerated. For example, copying 8 gigs might take half hour, but the estimated time of completion can be 153 minutes.
Link to photos taken of some of the weird behaviour of my computer: http://www.flickr.com/photos/26212832@N07/sets/72157627678912456/
One last note: my machine seems to act normally when not full scanning with Avast or Superantispyware. On the web or playing games for example, all seems normal. The only exception to this is when I am copying files, where disk activity is really sluggish.
I read through the guide on dealing with malware from http://forum.avast.com/index.php?PHPSESSID=qor44h76enf9l50c5nva0jp6b2&topic=53253.0 and have done the scans with the programs suggested.
I already had Malwarebytes Anti-Malware on my computer, so I ran quickscan with it and had no problems. It didn’t seem to turn up any threats. Whether that means the rookit has managed to hide itself from MBAM’s scan, I don’t know. Nonetheless I have attached the log on the offchance any of the you can glean any clues from it.
I’ll be grateful for any help. Thanks!
