Rootkit problems

[Dick Jagger]

I got what I believe is a rootkit virus, RtkBtMnt.exe, that has installed itself in my temp folder and is associated with a running process Realtek HD Audio Data Rerouter. I don't think Realtek would design their program to run from the temp folder which is routinely cleaned.

I ran a full scan with MSE, which did not find it.
I ran Malwarebytes and used the Fileassassin tool to delete it but it doesn't stay deleted - reappears after rebooting.

There is also this txt file in the temp folder which also cannot be deleted: FXSAPIDebugLogFile.txt.

Any good trouble shooters here that can offer some suggestions?

Thanks.

 

[electrotune1200]

I really don't think it's anything to worry about.

rtkbtmnt.exe - Realtek HD Audio Data Rerouter

Supposedly the process is responsible for routing your audio through bluetooth.

 

[Dick Jagger]

Thanks for your reply... but should it be running from the User/Temp folder and be completely un-deletable? I found this guy had a real problem with it:

Since it appears in the temp file, it starts creating labuage.bin files, useless foulders and rubbish that fill up your disk at great speed. If you try to delete it, you can't. Unlocker is useless against it. If you restart your pc in safe mode, file is unavailable, nor can it be found.
So far, the only I was able to do, was to open the task manager whenever I start my pc, and stop its process. That seems to stop its creating new rubbish.
I don't know why people that seem to know a lot, keep on stating it;s a normal process. No Realtek file is so protected, or installed in a temp folder. Please, post your solution if you happen to find it.
​

Also, in process explorer, it had a slightly different name than the HD Audio Control Panel process of which it is listed as a child (Realtek Semiconductor vs. Realtek Semiconductor Corp.)

 

[Roder56]

I had that a few months ago. I ended up having to delete the sound driver. Have not seen the process or item in my temp folder since. Not t worry the driver re-installs itself on reboot

 

[Borg 386]

D/L & run TDSSKiller & see what it finds.

TDSSKiller Download

NOTE: When running TDSSKiller, launch the program, click on the blue text "Change Parameters" & check the box marked "Detect TDLFS File system." Click OK & then run the scan.