Issues with avg

Question

I have windows 7 64 bit, avg internet security 2013, and malwarebytes pro. I don't know if i should ask it here or on security.SO, feel free to migrate it if you feel it does not belong here. I'll use the term malware, not virus, and lets not go through the discussion of having 2 anti virus on 1 pc, MWB is not a real time antivirus, I have another question about that subject, you can discuss it there

Today, i scanned my pc using avg, got 55 malware, most of them are rootkits, avg told me to restart my pc, I did, the number was reduced to 35.

I scanned with MWB, got only 1 malware, removed it, MWB didn't detect anything else. I scanned with microsoft anti rootkit tool, and MWB rootkit removal tool got nothing.

I went to safe mode, opened AVG as adminstrator and scanned, in safe mode, avg scanner is like a command prompt you know, and I got this error for many files

• File locked! that drove me crazy, so do the anti virus scan the entire pc or only some files that are not locked? it makes no sense

I'm not done yet, i had enough with safe mode, decided to do an avg scan on the pc, remember the last time i scanned, i had 35 virus, when i rescaned i got 47!

I'm not done yet, i knew either, avg or MWB is lying to me, and it didn't make any sense to me that after restarting m pc, avg is still detecting the same number of malware if not more.

On my PC, there are no hidden files, for example, avg told me that

"";"IRP hook, \FileSystem\Ntfs IRP_MJ_SHUTDOWN -> spaq.sys +0x3FB68, C:\Windows\System32\Drivers\spaq.sys";"Infected"

• So i was curious to check that file, Drivers folder is full of .sys files but there's nothing called spaq.sys! Really? in fact most of the results spaq.sys that doesn't exist. How so?

AVG is only giving 1 details, avg anti rootkit detectedspaq.sys`, that's not good enough for me, especially that i have 2 of the best anti rootkits installed. And how come no rootkit is removed after i restart? instead they increase.

Initial issue solved

I managed to remove the rootkits, by using Kaspersky Anti-rootkit utility TDSSKiller, i had 27 rootkits and they have different names, so Avg gave me wrong numbers and wrong names and was unable to remove them, after removing the rootkit using TDSSKiller, i scanned with avg and found nothing.

But I'll leave the question open, i still have no answer to the first question, why did i get locked file error? And therefore does the antivirus scan every single file on the system or does it skip the locked files?

Answer 1

I managed to remove the rootkits, by using Kaspersky Anti-rootkit utility TDSSKiller, i had 27 rootkits and they have different names, so Avg gave me wrong numbers and wrong names and was unable to remove them, after removing the rootkit using TDSSKiller, i scanned with avg and found nothing.