Folder AVG Forums » Other topics » Virus Removal, Tools for Removing » [SOLVED] IRP Rootkit Detection
January 4, 2013 20:29 [SOLVED] IRP Rootkit Detection #222540
Top
topcroft

Avatar

Novice
Join Date: 4.1.2013
Posts: 3
Windows XP sp3
AVG 2012 .0.2221 2637/5509
ZoneAlarm Free Firewall version: 11.0.000.018
Vsmon version: 11.0.000.018
Driver version: 11.0.000.018
Web Identity Protections version: 1.5.393.18
AD-AWARE 9.6 Scan only no active components
Spybot S&D 1.6.2 Scan only no active components
Spywareblaster 4.6
Spywareguard
Trusteer Rapport 1207.52

Scheduled scan found IRP hook rootkit on scheduled scan the day after re installing AVG free 2012 after having problems installing 2013. Rootkit scan clear after re booting computer. Carried out repair installation on 2012. Scheduled scan clear this morning but on running a rootkit scan this evening 4 IRP hook rootkits detected.

Computer appears to be running normally with no obvious problems.

"";"C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS";"IRP hook, \Driver\IntelIde IRP_MJ_PNP -> PCIIDEX.SYS PciIdeXDebugPrint+0x2D80";"Object is white-listed (critical/system file that should not be removed)"
"";"C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS";"IRP hook, \Driver\HidUsb IRP_MJ_PNP -> HIDCLASS.SYS +0x1902";"Object is white-listed (critical/system file that should not be removed)"
"";"C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS";"IRP hook, \Driver\Disk IRP_MJ_SYSTEM_CONTROL -> CLASSPNP.SYS ClassInitialize+0x666";"Object is white-listed (critical/system file that should not be removed)"
"";"C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS";"IRP hook, \Driver\Disk IRP_MJ_PNP -> CLASSPNP.SYS ClassDebugPrint+0x6FB";"Object is white-listed (critical/system file that should not be removed)"

I am now concerned that this may be a genuine infection.
As I am new to this process please keep any instructions as simple as possible.




January 4, 2013 21:14 Re: IRP Rootkit Detection #222541
Top
BIG AL 43

Avatar

Moderator
Join Date: 19.6.2014
Posts: 0
@ topcroft

Have a look @ this link http://forums.avg.com/ww-en/avg-forums?sec=thread&act=show&id=220333#post_220333.


AVG Forums Volunteer ModeratorAVG Forum member since - Nov. 27, 2004My total posts on the Old AVG Free Forum - 27,063
Alan
How-To Articles | FAQ | Free Support
January 4, 2013 23:58 Re: IRP Rootkit Detection #222552
Top
topcroft

Avatar

Novice
Join Date: 4.1.2013
Posts: 3
ms info output attached . Thank you for your help.

gmer scan added
January 5, 2013 00:13 Re: IRP Rootkit Detection #222553
Top
BIG AL 43

Avatar

Moderator
Join Date: 19.6.2014
Posts: 0
@ topcroft

OK, Just to keep you fully in the picture regarding AVG Team forum support.. For your further guidance/info please refer to the 1st Announcement post @ the top of the Information forum area. The AVG Team are actually attending to answering any postings backlog in date order but please bear in mind that it's also now the weekend in Brno, Czech Rep..


AVG Forums Volunteer ModeratorAVG Forum member since - Nov. 27, 2004My total posts on the Old AVG Free Forum - 27,063
Alan
How-To Articles | FAQ | Free Support
January 17, 2013 14:04 Re: IRP Rootkit Detection #223094
Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8245
Hello topcroft,

According to provided results your computer seems to be clean.

For help on root-kit detection please uninstall all other security software.

Thank you



AVG Team
How-To articles | FAQ | Free Support
January 17, 2013 19:59 Re: IRP Rootkit Detection #223126
Top
topcroft

Avatar

Novice
Join Date: 4.1.2013
Posts: 3
There have been no further detections during daily scheduled scans and several additional rootkit scans since the day following my original post. Thank you for checking the scans, logs, etc that I provided.
January 18, 2013 00:41 Re: IRP Rootkit Detection #223132
Top
BIG AL 43

Avatar

Moderator
Join Date: 19.6.2014
Posts: 0
OK topcroft, No probs.. Pleased to see that you appear to be now sorted. Thanks for returning to the forum & posting.


AVG Forums Volunteer ModeratorAVG Forum member since - Nov. 27, 2004My total posts on the Old AVG Free Forum - 27,063
Alan
How-To Articles | FAQ | Free Support