system
December 29, 2011, 12:41pm
1
I currently have Avast! Free as my antivirus program. Im running Windows 7 Ultimate. Recently i checked for rootkits using Avast but i got nothing. a friend recommended me to try out Trend Micro RootkitBuster and i did. It detected nearly 100 rootkits on my laptop but most of them were just my music files and some old recycle bin items. Along with that i saw some pretty suspicious programs that im not sure if i should fix or not. Can someone please please please PLEASE offer assistance soon on what to delete and what not to??
Here is HALF of the log file of RootkitBuster:
–== Dump Hidden MBR, Hidden Files and Alternate Data Streams on D:\ ==–
I shall post the rest of the log in another message
system
December 29, 2011, 12:43pm
2
Here’s the remaining:
[FILE_STREAM]:
system
December 29, 2011, 12:44pm
3
Here is the 3rd part
[FILE_STREAM]:
system
December 29, 2011, 12:45pm
4
The 4th part
[FILE_STREAM]:
system
December 29, 2011, 12:46pm
5
the 5th part
[FILE_STREAM]:
–== Dump Hidden Registry Value on HKLM ==–
–== Dump Hidden Process ==–
–== Dump Hidden Driver ==–
–== Service Win32 API Hook List ==–
system
December 29, 2011, 12:47pm
6
Here are the logs guys. I’m hoping you’ll help me ASAP. Thanks in advance
system
December 29, 2011, 12:48pm
7
Empty the reclycle bin and follow the guide…link below:http://forum.avast.com/index.php?topic=53253.0
attach the logs here.A malware removal expert will help u soon.
Essexboy[malware removal expert] notified.
system
December 29, 2011, 4:42pm
8
Appears RootkitBuster works similiar to SysInternal’s RootkitRevealer.
These type of utilities show “potential” problem areas such as hidden and hooked files. Their existance does not automatically imply that they are malicious rootkits. Also since many of those files are music files, I somewhat suspect that what is being shown is the result of the old Sony copyright “rootkit” or equivalent software at work.
The output needs to be analyzed by an expert familiar with the utility. Does Trend have a forum or support link where you can unload those logs for analysis?
system
December 30, 2011, 3:53pm
9
@DonZ63 Thanks for replying :). I’m 100% sure that MP3 files can have no rootkits. It’s just the other entries that seem suspicious to me. Ya trend micro has Discussion Boards but for some reason i can’t post any messages to it. i have an account on trend micro but it just refuses to accept my posts. heaven knows why.
@trueindian thanx a lot for the link. i shall get down to it immediately and have the logs up in an hour
system
December 30, 2011, 4:45pm
10
Here is the log of Malwarebytes’ Anti Malware:
Malwarebytes Anti-Malware 1.60.0.1800www.malwarebytes.org
Database version: v2011.12.24.05
Windows 7 Service Pack 1 x86 NTFS
30-12-2011 22:02:09
Scan type: Quick scan
Memory Processes Detected: 0
Memory Modules Detected: 0
Registry Keys Detected: 0
Registry Values Detected: 0
Registry Data Items Detected: 0
Folders Detected: 0
Files Detected: 0
(end)
system
December 30, 2011, 4:59pm
11
First, MBAM is not the most effective anti-malware software for detecting rootkits.
You can try Kapersky’s TDSS Rootkit utility here: http://support.kaspersky.com/faq/?qid=208283363 or Sophos Rootkit Detection utility here: http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx .
Personally, I think you are clean. Remember what I posted previously, the Trend utility output is just letting you know of potential vulnerabilities. Again, someone at Trend has to review your log output and determine if there is indeed a problem,
system
December 30, 2011, 5:12pm
12
here are the logs for OTL:
system
December 30, 2011, 5:15pm
13
DonZ63 thank u for the links.i shall download them and check with them ASAP
system
December 30, 2011, 5:59pm
14
I’m sorry but TDSS Rootkit and Sophos Rootkit Detection are painfully slow. It’s at 3% for the past 1hr. Isn’t there a way to find out if i’m infected or if it’s just a false positive?
Pondus
December 30, 2011, 6:09pm
15
Isn't there a way to find out if i'm infected or if it's just a false positive?
yes....you got that option in reply #6 from true indian
so now relax and wait for Essexboy to arrive…
OBS: you should also run aswMBR from that guide and attach the log
system
December 30, 2011, 6:26pm
16
thanks for your reply pondus :). im trying to run aswMBR but it just hangs everytime. il try to post the logs once i fix it
No visible malware showing there, the ads’s attached to the music may well be DRM data and is of no import
The main pointer though would be if you are experiencing any problems ? Are you ?
system
December 30, 2011, 10:14pm
18
I'm sorry but TDSS Rootkit and Sophos Rootkit Detection are painfully slow. It's at 3% for the past 1hr.
TDSS runs in about a minute or less on my PC excluding updating time. Sophos does run for a while since it is doing a full scan of your hard drive.
Scan times are however hardware dependent.
system
December 31, 2011, 10:52am
19
Phew thank u so much essexboy. My computer is good for most of the time but it becomes slow in opening files or launching applications at random times. i have no idea why. Also i have a problem when dragging windows. the contents aren’t shown. just a black outline appears whenever i drag them. after i change the visual settings inside Computer, it turns normal but again the black outline comes back after some time. Any way to fix these?
Clear all the temporary files and run the windows defrag tool
Let me know if that makes an improvement
Clear Cache/Temp Files TFC by OldTimer
[*] Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator ).will close all programs when run, so make sure you have saved all your work before you begin.Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion .reboot your machine . If it does not, please manually reboot the machine yourself to ensure a complete clean.
