Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have windows 7 64 bit, avg internet security 2013, and malwarebytes pro. I don't know if i should ask it here or on security.SO, feel free to migrate it if you feel it does not belong here. I'll use the term malware, not virus, and lets not go through the discussion of having 2 anti virus on 1 pc, MWB is not a real time antivirus, I have another question about that subject, you can discuss it there

Today, i scanned my pc using avg, got 55 malware, most of them are rootkits, avg told me to restart my pc, I did, the number was reduced to 35.

I scanned with MWB, got only 1 malware, removed it, MWB didn't detect anything else. I scanned with microsoft anti rootkit tool, and MWB rootkit removal tool got nothing.

I went to safe mode, opened AVG as adminstrator and scanned, in safe mode, avg scanner is like a command prompt you know, and I got this error for many files

enter image description here

  • File locked! that drove me crazy, so do the anti virus scan the entire pc or only some files that are not locked? it makes no sense

I'm not done yet, i had enough with safe mode, decided to do an avg scan on the pc, remember the last time i scanned, i had 35 virus, when i rescaned i got 47!

I'm not done yet, i knew either, avg or MWB is lying to me, and it didn't make any sense to me that after restarting m pc, avg is still detecting the same number of malware if not more.

On my PC, there are no hidden files, for example, avg told me that

"";"IRP hook, \FileSystem\Ntfs IRP_MJ_SHUTDOWN -> spaq.sys +0x3FB68, C:\Windows\System32\Drivers\spaq.sys";"Infected"

  • So i was curious to check that file, Drivers folder is full of .sys files but there's nothing called spaq.sys! Really? in fact most of the results spaq.sys that doesn't exist. How so?

AVG is only giving 1 details, avg anti rootkit detectedspaq.sys`, that's not good enough for me, especially that i have 2 of the best anti rootkits installed. And how come no rootkit is removed after i restart? instead they increase.

Initial issue solved

I managed to remove the rootkits, by using Kaspersky Anti-rootkit utility TDSSKiller, i had 27 rootkits and they have different names, so Avg gave me wrong numbers and wrong names and was unable to remove them, after removing the rootkit using TDSSKiller, i scanned with avg and found nothing.

But I'll leave the question open, i still have no answer to the first question, why did i get locked file error? And therefore does the antivirus scan every single file on the system or does it skip the locked files?

share|improve this question
2  
OK, a few things: 1) Do not try to scan a potentially infected system while running it. Shut it down, boot from something else, then scan from that other booted OS. 2) Where did you get AVG? The legal site (where there is a free download) or an alternative site. 3) Warning: Some malware claims to the anti-virus but is not (partially to add to point 2. Partially to prevent you from downloading something 'helpful'). 4) Please read this post: superuser.com/questions/100360/… –  Hennes Sep 17 '13 at 23:06
    
@Hennes 1) ill try to connect my laptop to another laptop and scan it 2) i got it from the official site avg.com 3) could you please give an example or more explanation? 4) thanks for the link sir :) –  Fischer Sep 17 '13 at 23:15
1  
If AVG is saying a System file is infected your system is either so corrupt you should simply reinstall or its a false positive. My honest viewpoint is that AVG has some serious problems, I have never trusted it, and suggest MSE instead. It's very likely AVG is detecting false positives –  Ramhound Sep 17 '13 at 23:52
    
You won't be able to see Spaq.sys if it IS a rootkit, since that's the point of a rootkit. –  techie007 Sep 17 '13 at 23:54
    
Anyway an example of fake security software is " Internet Security 2013" –  Ramhound Sep 17 '13 at 23:55
show 7 more comments

1 Answer

up vote 0 down vote accepted

I managed to remove the rootkits, by using Kaspersky Anti-rootkit utility TDSSKiller, i had 27 rootkits and they have different names, so Avg gave me wrong numbers and wrong names and was unable to remove them, after removing the rootkit using TDSSKiller, i scanned with avg and found nothing.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.