Hello,
I seem to have caught a really bad rootkit (called win32.rootkit-gen(rtk)) which now prevents me even scanning with Avast. If I go to run a system scan it says 'Access Denied:Splash cannot execute the following program: C/program files/Alwil software/avast/ashSimp2.exe
Anyone ever had this problem? I’ve run about at dozen different spyware/malware programs (and even somehow managed to get a boot-time scan on avast to work-- don’t know how) and I still can’t kill this mother. Anyone seen this or have any ideas?
Which operating system are you using?
“Try” posting a HiJackThis Log here so that evangelists can analyze it^^www.filehippo.com/download_hijackthis/ )
-AnimeLover^^
I’m running XP. Here’s the Hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe@ivt ’ protocol is in My Computer Zone, should be Intranet Zonehttp://www.creative.com/su/ocx/15026/CTSUEng.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://www.sidestep.com/get/k42037/sb02b.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139791006500 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128906823875 http://www.linksysfix.com/netcheck/53/install/gtdownls.cab http://www.creative.com/su/ocx/15026/CTPID.cab
–
Larc
July 1, 2009, 3:26pm
5
b Service Pack[/b]
b Firewall[/b]
b Suspicious Entries[/b]
O2 - BHO: C:\WINDOWS\system32\gsf83iujid.dll - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - C:\WINDOWS\system32\gsf83iujid.dllVirusTotal for better analysis… Prevx Analysis
O15 - ProtocolDefaults: ‘file’ protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - hXXp://www.sidestep.com/get/k42037/sb02b.cabMcAfee
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -Hijack Remote
O22 - SharedTaskScheduler: rtasgvfu76ew8ndkfno94 - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - C:\WINDOWS\system32\gsf83iujid.dll
Download malwarebytes http://www.malwarebytes.org/mbam.php
Here’s the malwarebyte’s scan log:
Malwarebytes’ Anti-Malware 1.38
7/1/2009 1:26:24 PM
Scan type: Full Scan (C:|D:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Why didn’t you take action on the folder and file detections ?
Run MBAM again and this time when the scan is complete, all detections should have a check mark in the box to the left of the entry, leave them selected (or select if not selected). At the bottom of the window there is a button, Remove Selected, click that and the items will be removed.