Показано с 1 по 7 из 7.

mchlnjDrv.sys

  1. #1
    Junior Member Репутация
    Регистрация
    12.04.2008
    Сообщений
    3
    Вес репутации
    37

    mchlnjDrv.sys

    Please tell me if AVZ uses a temporary driver filename mchlnjDrv.sys?

    After recently running AVZ, avast! AV found mchlnjDrv.sys and said it was a rootkit.

    avast! was then unable to remove mchlnjDrv.sys (or even find it) when subsequent scan was done on reboot. And a search of my pc does not turn up mchlnjDrv.sys.

    I think that it was possibly alerting on a temp driver file used by AVZ?

    Does the AVZ scanner use that driver? Thank you!

    P.S. I do not have Comodo FW on my pc, but I do have BOClean.

  2. #2
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация
    Регистрация
    29.09.2004
    Сообщений
    3,510
    Вес репутации
    1280
    MchlnjDrv.sys - It is not an AVZ driver. It is a trojan!
    Please do the needed logs http://virusinfo.info/showthread.php?t=9184 , attach them and we will try to help you.
    Месть - мечта слабых, прощение - удел сильных.
    Поддержать проект можно здесь

  3. #3
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для AndreyKa
    Регистрация
    08.01.2005
    Адрес
    Россия
    Сообщений
    13,625
    Вес репутации
    1291
    I'm not so sure. AVZ really use temporary drivers but the name is random.
    Mynorgeek, you have to accomplish the Rules: http://virusinfo.info/showthread.php?t=9184

  4. #4
    Junior Member Репутация
    Регистрация
    12.04.2008
    Сообщений
    3
    Вес репутации
    37
    Many thanks for replies. Reason I did not submit logs is because I just wanted to know if AVZ loaded a temp driver named mchlnjDrv.sys.

    My avz scan did not turn up a rootkit. It was avast! that alerted to this driver, and I know that mchlnjDrv.sys is used in some other security softwares, namely Comodo Personal Firewall. Trouble is, I don't have CPF, but I do have Comodo BOClean.

    According to the CPF coder, "mchlnjDrv.sys is the part of the api hooking SDK CPF uses to inject its DLL appguard.dll to other applications.

    It is loaded and extracted on demand by cmdagent.exe. So it is a safe driver.

    It is used by many other security software which perform user space api hooking too. So you may also see it reported with other programs."

    So this is why I asked, in case AVZ used this driver.

    I'll keep investigating, checking with Comodo and avast! It could also be a false positive from avast!

    If anyone thinks of anything else, please let me know.

  5. #5

  6. #6
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    972
    Well, in this part of the forum you should provide 3 logs in order to investigate your system, remember to disable avast, other antyspyware before it!
    Otherwise this topic will be closed

  7. #7
    Junior Member Репутация
    Регистрация
    12.04.2008
    Сообщений
    3
    Вес репутации
    37
    Thank you. Sorry.

Свернуть/Развернуть Ваши права в разделе

  • Вы не можете создавать новые темы
  • Вы не можете отвечать в темах
  • Вы не можете прикреплять вложения
  • Вы не можете редактировать свои сообщения
  •  
Page generated in 0.00707 seconds with 15 queries