rootkit.srizbi..?

[yuvaraja]

hi....mbam real time protection popped a warning that a malicious process was about to start and asked to quarantine i did so and a rootkit.srizbi was quarantined....only a file.....it was an audio book that i was d/l.....subsequent scan comes clean....i have avira v9 premium and OA premium but both did nothing......so am i clean?

[AdvancedSetup]

One would assume so but if you're not comfortable, or you have some signs of infected behavior with it or if you'd like to us to help you do some deeper scanning of your system please follow the directions below.

Scan and post logs - read note at bottom in green

If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
   
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
   

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review
  

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.
  

[yuvaraja]

hi.......thanks for replying........ i have scanned again with avira premium(full scan) and mbam(quick scan) no detection....pc runs fine thanks to mbam real time protection......+1 for it.

P.S. i have two questions though

1. why did avira and online armor not see the rootkit?

2. I use rollback rx so in case of an infection not caught in real time could a rollback to clean image undo the infection? sorry if the questions are outside the purview of mbam forum

[Matthew P]

hi.......thanks for replying........ i have scanned again with avira premium(full scan) and mbam(quick scan) no detection....pc runs fine thanks to mbam real time protection......+1 for it.

P.S. i have two questions though

1. why did avira and online armor not see the rootkit?

2. I use rollback rx so in case of an infection not caught in real time could a rollback to clean image undo the infection? sorry if the questions are outside the purview of mbam forum

1. Roots kits aren't normally easy to find. Also no anti virus or malware remover software can decet every threat. New threats appear every day.

2. I've never heard of rollback rx But from Google it says its a Third Party SystemRestore software. So I suppose it may work however I know with most virus's ext will hide in system restore points however rollback rx May not have that problem yet I dunno.

HOWEVER when i did some more research it sounds like some Anti-Malware programs ACTUALLY detect RollBackRX as a root kit. So this may be a f/p

I'd make sure its not decting RollBack first.

[TonyKlein]

The first detection appears to be a FP that was corrected a couple of days ago, see here

Do make sure you update your MBAM before scanning.