(SOLVED) AVGxxxxx.SYS Leftover Drivers: Avast Rootkit False Postive

Viruses and worms
21

Well, no joy/luck with AppRemover…see attached…all it found was Avast.

At this point I’m pretty convinced these are not Malware but conflict of some old AVG “drivers” that were not cleanly uninstalled. The question becomes, can I find a way to get rid of or hope that Avast updates their softwre/DB to mark them as false positives.

My last/next efforts will be to boot into Safe Mode and turn off the “hide O/S files” and see if these three files are visible within Windows directory…perhaps I can move/rename.

If not luck there then last “brute force” method I can think of is to uninstall Avast with its complete uninstaller, run CCleaner (files/reg), install AVG10 (2011), run AVG complete uninstaller, run CCleaner, run AppRemover, install Avast, see if I get same error.

As FYI, I have one other XP machine doing exact same thing but not my 64bit brand new W7 HP Pavilion DM4 laptop…Avast runs fine…no rootkit popup. I initially installed old AVG9 on it, then uninstall, then installed Avast. Besides these laptops being different inherently the big diff I see is that the two XP machines had AVG10 (2011) installed…then removed when we saw how BAD it was. AVG10/2011 never saw the new HP W7 machine…AVG10/2011 has alot more “security” in it than AVG9…perhaps the “root” of the issue…ha…ha. :slight_smile:

Any other suggestions let me know ?

22

Or you could run OTS and I will see if I can find the files then Kill them

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTS to your Desktop

[*]Close ALL OTHER PROGRAMS.
[*]Double-click on OTS.exe to start the program.
[*]Check the box that says Scan All Users
[*]Under Additional Scans check the following:

Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - SafeBoot Minimal
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check

[*]Under the Custom Scan box paste this in


%SYSTEMDRIVE%*.exe
CREATERESTOREPOINT

[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

23

Well, first thanks to all posters on this thread !!!

I spent the last three hours…clean uninstall Avast (thru util), CCleaner, AppRemover, install lastest AVG10/2011, clean uninstall AVG10/2011 (thru latest util), CCleaner, AppRemover, RE-install of Avast…and bang…the rootkit saw these files again…ugh !!!

At this point I’ll try OTS but I’m convinced this is a false positive from Avast Rootkit…not Avast fault because this is left over crud from AVG…one more reason of hundred I want away from their software.

So, I’ve spent few days on my vacation now trying to run this down and I really appreciate everyones help…really !!! I’m open to any other suggesstions and I’ll feedback the log when I run OTS (FYI, I have system restore turned off since I use RollBack RX so I’ll not include that portion of instructions…let me know if any issue there).

Any chance Avast will post to this thread that they will log this/these as false positive in their rootkit and remove in next virus DB or program update ? Long term I’m not sure I can have these popups and scans show these hits.

Regards.

24

It just so happens that AVG is vulnerable to infection, a few days ago one of the AVG drivers was infected and I had to remove the entire programme manually. Needless to say the user has now changed to Avast

25

essexboy,

I went ahead and ran OTS…attached is txt log.
Can you decipher ?..not sure if it means anyhting.

Thx.

P.S. I tried again to hit ignore on the popup and it
appears this no longer is coming up at boot…perhaps
the ignore finally took. However, if I run FULL scan that
has the rootkit it sees the three files…but can’t delete
or move to Virus Chest. There is no “ignore” option in
the log files ?..wish Avast would add.

Last item I can think of while I await feedback on the
OTS log is to run CHKDSK /F on reboot to fix any file
Index problems. Not sure this would resolve but worth
a try.

26

Intriguing I cannot see any AVG drivers there

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.

 
[Unregister Dlls]
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {02478D38-C3F9-4efb-9B51-7695ECA05670} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> {DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1708537768-261903793-725345543-1003\] > -> HKEY_USERS\S-1-5-21-1708537768-261903793-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> WebBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> WebBrowser\\"{A057A204-BACC-4D26-9990-79A187E2698E}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< RunOnce [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
YN -> "AvgUninstallURL" -> C:\WINDOWS\System32\cmd.exe [cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYAMABLAE0AQwAtAEUAOQBWAFUAVwAtAEUAVwAwAFYAQQAtAFUAVQAzAFgATAAtAEYARQBXADkANwA"&"inst=NwA3AC0AMQA0ADEANQAzADYAOAA5ADkALQBCAEEAKwAxAC0ASwBWADMAKwA3AC0AWABMACsAMQAtAEYAUAA5ACsANgAtAEIAQQBSADkARwArADEALQBUAEIAOQArADIALQBGAEwAKwA5AC0AWABPADMANgArADEALQBGADkATQA3AEMAKwA1AC0ARgA5AE0AMQAwAEIAKwAyAC0AWABPADkAKwAxAC0ARgA5AE0AMgArADEALQBEAEQAVAArADAA"&"prod=90"&"ver=9.0.894]
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YN -> "C:\Program Files\AVG\AVG10\avgmfapx.exe" -> [C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer]
YN -> "C:\Program Files\AVG\AVG8\avgnsx.exe" -> [C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe]
YN -> "C:\Program Files\AVG\AVG8\avgupd.exe" -> [C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe]
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.

Depending on what the fix contains, this process may take some time and your desktop icons might disappear or other uncommon behavior may occur.

This is no sign of malfunction, do not panic!

27

essexboy,

Thanks for the suggestion but I’m very hesistant to spend time on a fix that may have other impacts to the system…basically intrusive. Talking with others this clearly is a false positive by Avast…even though it is left over crud from AVG not one other rootkit I run sees the issue…I’ve now run six. I think doing more to the system for a false positive runs the risk of being counter productive. I’m only hoping that the Avast folks will agree and change their program or DB to reflect this…after all I assume others switching from AVG will have the same issue…since I have two PCs that are different machines showing the identical issue.

I did run the CHKDSK and while it did fix some index issues a FULL SCAN (includes their rootkit scan) from Avast still shows these three files as high risk but no way to delete, move to Virus Chest or “ignore” (no option for ignore). I would at least like the “ignore” option like in the Avast rootkit popup warning…seems that it finally took my “ignore” effort there but guess this does not apply to a scan ?

Anyway, I may change my mind if there is more problems down the road but for now I think it should be left to Avast folks to fix. As FYI, when you run OTS Avast pops up saying you are about to run an unsafe program and you should run in their “sandbox” and if you do anything it does will not be saved, etc…guess kinda a “shield”…again, I’m new to Avast.

Regards.

28

I wanted to post the resolution…found it.

It seems that even though I uninstalled “AVG” the AVG web searcher was still installed.
This is even though nothing showsi in the Windows Add/Remove.
So, I went ahead and installed Googles search add-in/toolbar as default.
I then went into Internet Explorer and within the add-ins console deleted the AVG add-in.

I re-ran Avast FULL scan with rootkit and no issues found.

Thx for all the help…hope this thread helps someone else.