AVG Root kit detection?

Discussion in 'Malware Help (A Specialist Will Reply)' started by Dandramere, Jul 13, 2014.

  1. Dandramere

    Dandramere Private E-2

    Hi guys, my AVG scanner has recently detected 2 rootkits both located in the same address:

    "";"hidusb.sys, hooked import USBD.SYS USBD_CreateConfigurationRequestEx -> USBD.SYS USBD_CreateConfigurationRequestEx, C:\Windows\system32\DRIVERS\USBD.SYS";"Cannot be cleaned
    Remove manually"

    It will not let me clean the file, I have tried a reg fix and my system restore won't go back.

    I recently installed EA's origin on the 10th of July and this file was detected on a scan originally on the 12th.

    However when I shell scan the file individually it comes up clean and when I do a specific rootkit scan with AVG I get nothing again. Could this be a false negative. Any help is appreciated, thanks!

    P.S I am new to this, so if there is any dumps you guys need please let me know.
     
    Dandramere, Jul 13, 2014
    #1
  2. Dandramere

    Dandramere Private E-2


    Sorry forgot to add my files!
     

    Attached Files:

    Dandramere, Jul 13, 2014
    #2
  3. Dandramere

    Dandramere Private E-2

    Sorry I am making such a pigs ear out of my first post, it won't let me edit and add on the files so I had to quote again, here are the rest of the files, I had issues installing the MGTools, it opens up a dialog box and continually asks me if I will allow changes to be made to the registry when I run it.
     

    Attached Files:

    Dandramere, Jul 13, 2014
    #3
  4. Dandramere

    Dandramere Private E-2

    After a bit of fiddling I finally got my MGTools working, here is the log. Thanks again guys.
     

    Attached Files:

    Dandramere, Jul 13, 2014
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to tell me what file AVG is detecting.

    In the meantime, rerun MBAM and have it fix everything it finds. Then after a reboot, rescan with MBAM and attach a new log.
     
    TimW, Jul 14, 2014
    #5
  6. Dandramere

    Dandramere Private E-2

    Hi TimW, first of all many thanks for your response.

    The AVG log was as follows: "";"hidusb.sys, hooked import USBD.SYS USBD_CreateConfigurationRequestEx -> USBD.SYS USBD_CreateConfigurationRequestEx, C:\Windows\system32\DRIVERS\USBD.SYS";"

    However I have recently done two more full scans with AVG after running all the other programs and it has not been detected since.

    My first scan of Malware Bytes had nothing to clean, I did the restart and attached you will find the exported log.
     

    Attached Files:

    Dandramere, Jul 14, 2014
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
     
    TimW, Jul 14, 2014
    #7
  8. Dandramere

    Dandramere Private E-2

    Thank you very much for taking the time to look at my log files Tim.:cool
     
    Dandramere, Jul 14, 2014
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Jul 14, 2014
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds