Possible rootkit infection?

If you still suspect a rootkit, then you need to look at it with GParted. This is a bootable partition manager that will allow you to see the contents of your drive, including any hidden partitions.

Rootkits generally cloak themselves from Windows disk management. This application will show the entire contents of the disk.

GParted -- A free application for graphically managing disk device partitions

D/L GParted, select the boot medium you wish to use & run it at boot time. Any rootkit will show up, usually at the end of the drive, as a hidden boot partition between 1 to 10 MB depending on the variant.

You might want to d/l & run RKill, then run your malware scanners again. After running RKill, do NOT reboot.

RKill Download

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools. When finished it will display a log file that shows the processes that were terminated while the program was running.


As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using some sort of anti-malware or anti-virus program so that the infections can be properly removed.

Yes, run an AV Scan after running RKill. And the other Malware scanners.

RKill works by trying to identify known malware processes & shutting them down. In some instances, malware can't be removed while it's active. Being shut down gives your malware scanner a better chance of isolating it.

Another option you have is to boot into Safe Mode & then do a scan with your malware scanners.

GParted will show you a graphical interface of the partitions on your drive. Rootkits are usually located at the end of the drive, generally between 1 - 10MB, set as a hidden boot partition.

GParted -- Screenshots

Have a look with GParted to see if the partition is there.

The fact you keep getting reinfected suggests that something is reintroducing the infection to the system, or it hasn't properly been weeded out.

In addition: Update Avast virus definitions and rescan. Post any detections.

On another note: I've used a few rootkit scanners in the past and they've all suffered from false positive detections. It's best to scan only and post the log.

I've used MBAR too and it's the only one I've use that didn't give false positive detections. Perhaps you could scan and post results. (without removing anything)

Instructions and download link:

https://blog.malwarebytes.org/news/2...-anti-rootkit/

Additional security measures? Usually there's a sacrifice to be made regarding system performance and usability. You can take additional measures but do you mind being bothered by pop ups?

You can change UAC to maximum level. See Option One - Always Notify in the tutorial here:

User Account Control - UAC - Change Notification Settings

You can add additional anti-executable solutions if you like:

See:

VoodooShield free blocks exploits and more

VS can be tricky to configure though. Personally I use the Pro version. Just my preference and not a recommendation.

A decent free alternative:

https://secureaplus.secureage.com/Ma...s_download.php - need free (offline installer) no AV version.

Some more info and screenshots from my machine:

https://www.sevenforums.com/2932674-post21.html

Basically it blocks any unsigned executable that's not in the whitelist from running and scans the file on VirusTotal. You then get the option to either allow the file to run or you can block it.

Other than that just keep all third party software patched an up to date. Browsers and plugins, Java, Flash Player etc.

You can also check all running processes using Tookeri's tutorial here:

Process Explorer + VirusTotal (to check all processes with 50+ AV's)

You might want to add AdwCleaner to the list of Malware scanners you run on a regular basis. Run Malwarebytes & other malware scanners once a week to be sure your system hasn't been compromised. This is called a layered approach. Since no program catches/finds everything 100%, you need to utilize other scanners to find anything your AV may have missed.

AdwCleaner Download

Some good advice in the above post. If you kept UVK installed you can just auto-update and run scans with MBAM and ADWcleaner from within UVK's GUI. It will update to the latest versions for you then launch the scan.

You find the third party scanners in the "System Repair" section and if you want to you can add more of your own choices.



On another note the latest version includes Ultra Adware Killer which in my opinion detects and removes more stuff than ADWcleaner but Ultra Adware Killer is a new release just out of Beta so caution is needed.