2 replies to this topic

[Ged]

Guys

Malwarebytes keeps finding a rootkit agent in C:\WINDOWS\system32\sysaudio.sys (Rootkit.Agent) . It quarantines and deletes it yet when I run it again the next evening it appears again ?

I am running AVG8 and Zone Alarm Pro..Neither of them find it...

Hope this is an easy fix.

Thanks for your time and help

Ged

[DavidP]

It found the same file on my computer too. I haven't removed it yet because I want to make sure that it wasn't a mistake. Also, I wanted to find out what problems I could expect if I were to remove it.

It seems the original file would need to be replaced. Where would I go or how would I replace it on a WinXP Home SP2 operating system?

[DaChew]

C:\WINDOWS\system32\drivers

is the correct location for the legitimate file

http://miekiemoes.blogspot.com/2008/10/fak...archengine.html

http://www.malwareby...?showtopic=2936

You might want to post in the HJT subforum here