Windows XP sp3
AVG 2012 .0.2221 2637/5509
ZoneAlarm Free Firewall version: 11.0.000.018
Vsmon version: 11.0.000.018
Driver version: 11.0.000.018
Web Identity Protections version: 1.5.393.18
AD-AWARE 9.6 Scan only no active components
Spybot S&D 1.6.2 Scan only no active components
Spywareblaster 4.6
Spywareguard
Trusteer Rapport 1207.52

Scheduled scan found IRP hook rootkit on scheduled scan the day after re installing AVG free 2012 after having problems installing 2013. Rootkit scan clear after re booting computer. Carried out repair installation on 2012. Scheduled scan clear this morning but on running a rootkit scan this evening 4 IRP hook rootkits detected.

Computer appears to be running normally with no obvious problems.

"";"C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS";"IRP hook, \Driver\IntelIde IRP_MJ_PNP -> PCIIDEX.SYS PciIdeXDebugPrint+0x2D80";"Object is white-listed (critical/system file that should not be removed)"
"";"C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS";"IRP hook, \Driver\HidUsb IRP_MJ_PNP -> HIDCLASS.SYS +0x1902";"Object is white-listed (critical/system file that should not be removed)"
"";"C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS";"IRP hook, \Driver\Disk IRP_MJ_SYSTEM_CONTROL -> CLASSPNP.SYS ClassInitialize+0x666";"Object is white-listed (critical/system file that should not be removed)"
"";"C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS";"IRP hook, \Driver\Disk IRP_MJ_PNP -> CLASSPNP.SYS ClassDebugPrint+0x6FB";"Object is white-listed (critical/system file that should not be removed)"

I am now concerned that this may be a genuine infection.
As I am new to this process please keep any instructions as simple as possible.

@ topcroft

Have a look @ this link http://forums.avg.com/ww-en/avg-forums?sec=thread&act=show&id=220333#post_220333.

---

AVG Forums Volunteer ModeratorAVG Forum member since - Nov. 27, 2004My total posts on the Old AVG Free Forum - 27,063
Alan

---

How-To Articles | FAQ | Free Support

ms info output attached . Thank you for your help.

gmer scan added

@ topcroft

OK, Just to keep you fully in the picture regarding AVG Team forum support.. For your further guidance/info please refer to the 1st Announcement post @ the top of the Information forum area. The AVG Team are actually attending to answering any postings backlog in date order but please bear in mind that it's also now the weekend in Brno, Czech Rep..

---

AVG Forums Volunteer ModeratorAVG Forum member since - Nov. 27, 2004My total posts on the Old AVG Free Forum - 27,063
Alan

---

How-To Articles | FAQ | Free Support

Hello topcroft,

According to provided results your computer seems to be clean.

For help on root-kit detection please uninstall all other security software.

Thank you

---

AVG Team
How-To articles | FAQ | Free Support
We Protect Us

Computer not working? Laptop slowing down?
Let our AVG TechBuddy expert remotely fix it for you.
Find out more (US & Canada)

There have been no further detections during daily scheduled scans and several additional rootkit scans since the day following my original post. Thank you for checking the scans, logs, etc that I provided.

OK topcroft, No probs.. Pleased to see that you appear to be now sorted. Thanks for returning to the forum & posting.

---

AVG Forums Volunteer ModeratorAVG Forum member since - Nov. 27, 2004My total posts on the Old AVG Free Forum - 27,063
Alan

---

How-To Articles | FAQ | Free Support