Folder AVG Forums » Other topics » Virus Removal, Tools for Removing » Corrupted Section ntkrnlpa.exe
June 14, 2012 04:51 Corrupted Section ntkrnlpa.exe #208409
Reply with Quote | Quick Reply | Top
Cindy2012

Avatar

Novice
Join Date: 14.6.2012
Posts: 2
Hello, I need help. I have malicious software on my computer that cannot be removed. I've tried just about everything. Whatever it is, rendered my anti-virus software useless at first. I could not update, run or delete it (I still cannot remove Avast!, although it's not working). I managed to finally download AVG free antivirus & it keeps catching a hidden object.

Here is what it says: Corrupted section ntkrnlpa.exe[PAGE] rtInitializeSid0x96A, size 4 bytes

Then it says the object is hidden by a rootkit technique (malicious software), and asks if I want to remove it. I say Yes. Then it says it cannot be removed by standard user rights, do you want remove threat as power user? I say yes, then reboot. I scan again & the same exact thing happens, over & over again. I cannot delete whatever this is.

Please help. I need my computer to find work & simply do not trust what's going on in its current state :frowning:
June 14, 2012 05:55 Re: Corrupted Section ntkrnlpa.exe #208421
Reply with Quote | Quick Reply | Top
Ninjawitch

Avatar

Novice
Join Date: 14.6.2012
Posts: 1
I Have The EXACT Same Problem With A Hidden Rootkit Corruption Which AVG Sees As <Unknown> Win32/DH{ZAc}

I have Both Tried To Heal AND Delete It And Then Reboot Only For It To Constantly Show Up Under An AVG 2012 Scan ... I Even Tried To Go Into Safe Mode To Clean It And Failed.

I Got It When I Went To A Political Site And AVAST! Strangely Alerted Me To The Virus YET It Couldn't Detect It Upon Full System Scan.

It Was ONLY AVG That Detected The Rootkit Corruption To Internet Explorer.

The Problem Is AVG And All Other Anti-Viruses CAN'T Handle This Virus Rootkit ... They Are ALL Powerless Against It Hence Why AVG Isn't Answering Your Email I Suspect.

I Still Have The Thing In My Virus Vault And Have Reports On It That AVG Kept ... Much Good That Does.
June 14, 2012 07:36 Re: Corrupted Section ntkrnlpa.exe #208429
Reply with Quote | Quick Reply | Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8245
Hello all,

In order to analyze your issue please provide us with more information (AVG scan result export, Msinfo output ,GMER scan results).

@Cindy2012 Please try using Avast uninstall utility.

Thank you



AVG Team
How-To articles | FAQ | Free Support
June 22, 2012 12:53 Re: Corrupted Section ntkrnlpa.exe #210145
Reply with Quote | Quick Reply | Top
Brickerw

Avatar

Novice
Join Date: 22.6.2012
Posts: 1
I am also having the same exact problem. Is there a solution to this that is published anywhere?
June 22, 2012 15:53 Re: Corrupted Section ntkrnlpa.exe #210183
Reply with Quote | Quick Reply | Top
Gary Bee

Avatar

Novice
Join Date: 29.7.2010
Posts: 296
Hi Brickerw,

The first two members, Cindy2012 and Ninjawitch, both mentioned having installed a second Anti-Virus(AV) utility, AVAST. Then Pokornyz suggested running the Avast uninstall utility, and perform diagnostic scans if that did not help. They have not posted to confirm that removed the detected system modification (aka rootkit).

So first, have you currently or previously had other AV utilities installed? You should just have One AV at a Time to avoid interference. Even if you have already removed them, they often leave definitions and components behind. Check the AVG list for AV Removal Tools. Or check the web site of your utility for their specific removal program.

Should this not be your problem, please supply diagnostic info, by attaching the AVG scan logs, your Msinfo, and the Gmer scans.
Note: Recently users have had problems with Gmer (both old and cur vers, or 64bit). If you do, this Post discusses alternative.


Helping People Not Get Stung Since 1970
A V C © - Almost Very Clever
[which implies some cleverness, but staying humble (or is that bumble)]
Gary

Farewell Štefan Németh, Thank You for all your help.