Reply to thread

Message

<blockquote data-quote="Papirus" data-source="post: 94440" data-attributes="member: 4131">OK, I did the following steps to check the MBR and other Rootkit problems:1. Run aswMBR while Adaware and MalwareByte were also running.&nbsp; It found suspicious tpkd.sys file as shown in the log here.&nbsp;&nbsp; [attachment=3064]2. Upload the tpkd.sys file into Virus Total web site and re-analyze the file.&nbsp; No virus is found as shown in the review page here.&nbsp; [attachment=3065]3. Run MBAR and it could not open the folder due to encryption problems.&nbsp; I suspect it was caused by locking issues with other antivirus programs.4. Ad-aware completed the full scan and found one malware in the system (but it is not tpkd.sys file).&nbsp; I cleaned the malware.&nbsp; However, MalwareByte become hung while SBAMsvc.exe is taking over the CPU usage.&nbsp; The PC system became so slow and all CPU usage went to the system idle now after a while.&nbsp; 5. I run McAfee rootkit remover but no virus found.&nbsp; However, the system was really slow like when I first found the zeroaccess rootkit in the system.&nbsp; System shutdown took about 5 minutes to complete....really slow.6. The next day, I run MBAR again but this time I closed all programs including Ad-aware real time protection.&nbsp; One malware is found as shown here.&nbsp; [attachment=3066]&nbsp; and [attachment=3067]7. Cleaned the malware (including created restore point prior to the cleaning).8. Reboot the PC.9. Then I run aswMBR again (Adaware is disabled).&nbsp; This time it does not show any potential malware as shown in the log here.&nbsp; [attachment=3068]I have also completed running MalwareByte quick scan with no virus found.&nbsp; I am running the full scan now.BTW. When I run Comodo full scan with Ad-aware real time protection running in the background, Comodo tagged both Adaware.exe and SBAMsvc.exe as malware.&nbsp; Is this a real malware or false positive finding?Thanks.</blockquote>

[QUOTE="Papirus, post: 94440, member: 4131"] OK, I did the following steps to check the MBR and other Rootkit problems: 1. Run aswMBR while Adaware and MalwareByte were also running. It found suspicious tpkd.sys file as shown in the log here. [attachment=3064] 2. Upload the tpkd.sys file into Virus Total web site and re-analyze the file. No virus is found as shown in the review page here. [attachment=3065] 3. Run MBAR and it could not open the folder due to encryption problems. I suspect it was caused by locking issues with other antivirus programs. 4. Ad-aware completed the full scan and found one malware in the system (but it is not tpkd.sys file). I cleaned the malware. However, MalwareByte become hung while SBAMsvc.exe is taking over the CPU usage. The PC system became so slow and all CPU usage went to the system idle now after a while. 5. I run McAfee rootkit remover but no virus found. However, the system was really slow like when I first found the zeroaccess rootkit in the system. System shutdown took about 5 minutes to complete....really slow. 6. The next day, I run MBAR again but this time I closed all programs including Ad-aware real time protection. One malware is found as shown here. [attachment=3066] and [attachment=3067] 7. Cleaned the malware (including created restore point prior to the cleaning). 8. Reboot the PC. 9. Then I run aswMBR again (Adaware is disabled). This time it does not show any potential malware as shown in the log here. [attachment=3068] I have also completed running MalwareByte quick scan with no virus found. I am running the full scan now. BTW. When I run Comodo full scan with Ad-aware real time protection running in the background, Comodo tagged both Adaware.exe and SBAMsvc.exe as malware. Is this a real malware or false positive finding? Thanks. [/QUOTE]

Verification