Rootkit scan shows positive results

Avast Free Antivirus / Premium Security
1

Hi - I have jsut upgraded to avast internet security from the free version and I am also running AVG full version.
I have just done a anti rootkit scan in AVG which has revealed between 6 and 16 rootkits which cannot (or will not) be removed.

These are:

“”;“”;“Corrupted section win32k.sys[.text] EngCopyBits+0xA519, size 7 bytes”;“Object is inaccessible.”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_iXlate+0x7EF9, size 7 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] EngSetLastError+0x4825, size 7 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] EngRestoreFloatingPointState+0x3368, size 8 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] EngRestoreFloatingPointState+0xB109, size 7 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] EngRestoreFloatingPointState+0x13B68, size 8 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] EngRestoreFloatingPointState+0x1B654, size 14 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] memmove+0xA234, size 8 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] memmove+0x141B9, size 13 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] EngQuerySystemAttribute+0xF6C, size 8 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_cGetPalette+0x3B59, size 7 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_cGetPalette+0x451C, size 14 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_cGetPalette+0x5619, size 7 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_cGetPalette+0x5669, size 7 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_cGetPalette+0xC4D8, size 8 bytes”;“Object is hidden”
“”;“”;“Corrupted section win32k.sys[.text] XLATEOBJ_cGetPalette+0xF749, size 7 bytes”;“Object is hidden”

I have read through a few of the other similar forum posts and which gives me some comfort insofar as my system is and has not shown any suspicious activity or instability.

Can I or should i try and remove these entries using avast or any other utiltiy.

Any help and comments would be much appreciated.
Thankyou.

2

Before you do anything, please drop either AIS or AVG…!!!

3

As Asyn says DO NOT DO ANYTHING until you have uninstalled one of the antivirus products. You cannot run 2 AV’s at the same time.

4

as already stated…running multiple AV will give you all kind of windows errors and false positive detections, so any detection can not be trusted before you remove one AV

you also need to run a removal tool for the AV you uninstall so any leftover files that may conflict is gone
run and reboot - http://singularlabs.com/uninstallers/security-software/

maybe i am blind…or dont understand the AVG log…but i dont see the word “rootkit” in the scan result you posted above ?
to me that looks like a scan error report, as it say corrupted ?..and that is not the same as detection

5

Hello

Thankyou all for your replies. The results were obtained after a rootkit scan on AVG and it maybe that these are just minor corruptions to my registry. And in any case they could also be the “false positives” you refer to. So yes I will uninstall and try it again. The scan was just done at random and not in response to any specific issues that were occuring in my system.

It maybe that I am worrying unduly and that the Avast should pick up anything amiss. As I saythere are no ill effects. Should I expect Avast to deal with these potential threats during the initial boot up scan?

6

if you think you are infected this is how to find out
attach (not copy and paste) logs from Malwarebytes quick scan / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0
then one of the malware removers will check the logs and give you a verdict :wink:

7

Thanks - Malwarebytes Quick Scan done and results attached - there appears to be no infections. So guess it was a false negative result from AVG!