Win32:Rootkit-gen [Rtk] has been found in Boot scan

Viruses and worms
1

Hello,I did a boot scan and it found the rootkit : Win32:Rootkit-gen [Rtk] .
Here’s the log of the last boot scan I did:

04/25/2008 04:17
Scan of all local drives

File C:\Documents and Settings\Aviv\My Documents\Aviv’s Folder\התקנות לשרתים של פיטי\dPT\dPT-PATCH_04.04.2008.exe\dPT.exe is infected by Win32:Rootkit-gen [Rtk], Deleted
File C:\dPT\dPT.exe is infected by Win32:Rootkit-gen [Rtk], Repair: Error 42060, Moved
File C:\Program Files\Alwil Software\Avast4\DATA\moved\dPT.exe.vir is infected by Win32:Rootkit-gen [Rtk], Deleted
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\harbor\terraintexture.pak\tile5_6.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\ice\terraintexture.pak\tile2_4.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\ice\terraintexture.pak\tile2_5.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\rescue\terraintexture.pak\tile2_5.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\rescue\terraintexture.pak\tile6_2.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\rescue\terraintexture.pak\tile6_3.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\rescue\terraintexture.pak\tile4_4.raw Error 42125
File C:\Program Files\Electronic Arts\Crytek\Crysis\Game\Levels\village\terraintexture.pak\tile4_2.raw Error 42125
File C:\System Volume Information_restore{F76D1690-7A56-40BA-B6F3-9C1519B72513}\RP423\A0239680.exe is infected by Win32:Rootkit-gen [Rtk], Moved to chest
Number of searched folders: 6783
Number of tested files: 565771
Number of infected files: 4

I dunno what to do with this rootkit (or maybe false positive) .
Please tell me what to do ???

version of Avast: - Program: Already up to date
(current version 4.8.1169)

  • Vps: Already up to date
    (current version 080425-0)

tnx,
Bros

2

Should I post a log of hijackthis also?

3

Anyone ?

4

To know if a file is a false positive, please submit it to VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
Other possibility is JOTTI. VirusTotal and Jotti both have file size limit of 10Mb.

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be careful, you should ‘exclude’ that many files that let your system in danger. I won’t add any temporary file or from restore folders to the Exclusion lists.