Rootkit help

Viruses and worms
1

So Avast found 8 infected files during a scan. They’re all rootkits. I choose to delete them all but it said it was postponed till the next reboot, so when I closed the results window it asked me to reboot the computer which it did. Then it did the boot-scan and it found nothing. I’m still worried because I had the same thing over a week ago. I found the rootkits and did a system recovery which restored the computer to factory settings. Now days later they popped up again. I did the same thing as before and again no virus found. I didn’t do a system recovery though. I did what was on this thread. http://forum.avast.com/index.php?topic=53253.0

Also after I did what was on that thread I tried to delete them again through the avast logs but it says Error: Access is denied (5).

I attached the logs.

I also read on wikipedia that these types of rootkits may have had a flaw so they appeared but there could be more hidden that avast can’t detect.

2

could you also post info about what files avast detected and where they are located ?
or attach a screenshot of the scan result…

malware specialist is notified…may take several hours before they arrive here

3

Ok here’s the picture of the locations and the scan log.

Also yesterday Avast found a file it couldn’t scan. It’s AxInstSV. Could that have anything to do with this?

http://i.imgur.com/yKf1b.png

http://i.imgur.com/2MerT.png

4

Is there anyone on that can help me?

Edit: Just ran MalwareBtyes and it found something. It was deleted and quarantined.

Log is attached. It says the item quarentined and deleted is Heuristic.Reserved.Word.Exploit

5

Looking at the screen shots and the log I would hazard that to be a false positive… The MBAM quarantine is due to that file using a system name

How is the computer behaving ?

6

What about all of those rootkits? They always re-appear. My computer is behaving fine, but I’m not an expert with computers so I can’t say for sure. The reboot is normal, I updated Avast to the new release that was released hours ago, I’m scanning Malwarebytes and Avast 1 more time. I’m just hesitant to start entering information like passwords. Do you think it’s safe?

7

Which is why I feel it is a False Positive - They are in the winsxs which is a windows area for service packs/updates and original files http://www.winvistaclub.com/f16.html

8

Ok. I’ll scan my computer regularly and post again if I need assistance, but you’re sure it’s ok to start typing in things like passwords?

9

I do not believe you are infected, none of the signs are there for that