Quantcast IRP hook

Closed Thread
Results 1 to 9 of 9

Thread: IRP hook

  1. #1
    Notebook Enthusiast
    Join Date
    Jul 2010
    Posts
    41
    Rep Power
    10

    Default IRP hook

    I did a scan using AVG. As I've been suspecting possible rootkits on my laptop, I ran the rootkit scan. AVG tells me there are 28 rootkits on my computer. This is a C&P copy of the log from the scan. Message continues below....



    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CREATE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CREATE_NAMED_PIPE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CLOSE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_READ -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_WRITE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_EA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_EA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_FLUSH_BUFFERS -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_VOLUME_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_VOLUME_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_DIRECTORY_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_FILE_SYSTEM_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_DEVICE_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SHUTDOWN -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_LOCK_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CLEANUP -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CREATE_MAILSLOT -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_SECURITY -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_SECURITY -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_POWER -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SYSTEM_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_DEVICE_CHANGE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_QUOTA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_QUOTA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_PNP -> 0xFFFFFA80067448DD";"Object is hidden"


    When it comes time to remove them, AVG says: "The module is different," and it can't remove it.

    Does anyone have anysuggestions for getting this crap out of my computer? And can anyone tell me what these things may be doing? This has been driving me nuts for about the last 2 days.

    Any help would be HUGELY appreciated!!!

    Thanks!
    T Bone

    Qosmio X505-Q890

  2. #2
    Notebook Virtuoso
    Join Date
    Sep 2008
    Posts
    2,667
    Rep Power
    24

    Default Re: IRP hook

    Remove AVG.
    Pick either MSE, Avira or Avast (just one) and re-scan your computer (either one of those 3 is far better than AVG and won't really impact performance).

    Or ... if you don't want to get rid of AVG, try running it in Safe Mode to get rid of the issue.
    A lot of av's cannot get rid of some infections while in standard mode.
    Acer Aspire 5930G - 15"
    CPU: T9600 (1.05V)RAM: 8GB-DDR2/800Mhz HDD: HITACHI TRAVLSTAR 7K500 GPU: 9600M GT GDDR3 (0.89V) Chipset: PM45 (BIOS: 1.23) OS: Windows 7 SP1 Ultimate x64

  3. #3
    Notebook Enthusiast
    Join Date
    Jul 2010
    Posts
    41
    Rep Power
    10

    Default Re: IRP hook

    I've removed AVG. I've scanned in Safe Mode with MSE, SuperAntiSpyware, and Malwarebyte's Anti-Malware. All three don't detect anything when I scan in either Safe Mode or a normal boot-up.

    Why would AVG give me those results, but none of the other scans don't detect anything? Thant doesn't make any sense. Unless it's just AVG just trying to get me to buy their product(s).
    T Bone

    Qosmio X505-Q890

  4. #4
    Newbie
    Join Date
    Dec 2010
    Posts
    1
    Rep Power
    0

    Default Re: IRP hook

    Quote Originally Posted by Deks View Post
    Remove AVG.
    Pick either MSE, Avira or Avast (just one) and re-scan your computer (either one of those 3 is far better than AVG and won't really impact performance).

    Or ... if you don't want to get rid of AVG, try running it in Safe Mode to get rid of the issue.
    A lot of av's cannot get rid of some infections while in standard mode.
    how does one get into safe mode?

    sps

  5. #5
    Notebook Virtuoso
    Join Date
    Sep 2008
    Posts
    2,667
    Rep Power
    24

    Default Re: IRP hook

    You have to restart the computer and keep pressing F8 button until it gives you a selection screen.
    From there, pick 'Safe Mode' and run the antivirus once there.

    another recommendation would be to download/install/update Malwarebytes and also run it from Windows Safe Mode.
    Acer Aspire 5930G - 15"
    CPU: T9600 (1.05V)RAM: 8GB-DDR2/800Mhz HDD: HITACHI TRAVLSTAR 7K500 GPU: 9600M GT GDDR3 (0.89V) Chipset: PM45 (BIOS: 1.23) OS: Windows 7 SP1 Ultimate x64

  6. #6
    Notebook Nobel Laureate
    Join Date
    Mar 2008
    Location
    London UK
    Posts
    9,484
    Rep Power
    54

    Default Re: IRP hook

    avg could be giving a false positive which isnt picked up with the others.
    i used to use avg pro and am now on avast pro and its tons better and not had 1 false positive since.
    >>>--- Everything you need to Monitor Temperatures & More ---<<<
    --> Free Burning Software <--
    --> How to manually update your Nvidia drivers <-- --> Benchmark Survey <-- --> Benchmark Results Only <--
    --Clevo (P150EM) : XMG P502 -mySN UK- i7 3720QM / 680GTX / 16GB Ram / 512GB Crucial SSD (The Dogz Dangley Bits)--


  7. #7
    Newbie
    Join Date
    Mar 2011
    Posts
    1
    Rep Power
    0

    Default Re: IRP hook

    I think deks the "notebook deity" has dispensed some shocking advice here. I think none of those products can detect a rootkit and you probably have a rootkit. I think AVG is by far one of the most accurate free scanners available.

    My advice if you are in doubt is to go and confirm what AVG has already told you with a Kaspersky tool called TDSSKiller. If it's not that particular rootkit then you should confirm it with the free Kaspersky scanner. Better yet, just trust the AVG tool and remove the rootkit.

  8. #8
    Banned
    Join Date
    Jun 2008
    Location
    European Union
    Posts
    8,392
    Rep Power
    0

    Default Re: IRP hook

    Quote Originally Posted by Major Wedgie View Post
    I think deks the "notebook deity" has dispensed some shocking advice here. I think none of those products can detect a rootkit and you probably have a rootkit. I think AVG is by far one of the most accurate free scanners available.

    My advice if you are in doubt is to go and confirm what AVG has already told you with a Kaspersky tool called TDSSKiller. If it's not that particular rootkit then you should confirm it with the free Kaspersky scanner. Better yet, just trust the AVG tool and remove the rootkit.
    Actually, iastor ist the Intel Matrix/Rapid Storage driver -> so either a false positive or a well hidden one.
    A simple test would be to uninstall the Intel Rapid/Matrix Storage driver if you have one -> Registry entries may remain though.

    On this note though, there is a Sysinternals Rootkit revealer - Sysinternals Security Utilities
    download it and run as admin, it will take quite some time.

    -> It might give you entries as possible rootkits that aren't, so you will need to evaluate every entry, but I think that's the best tool available to you.

  9. #9
    ZzzZzz
    Join Date
    Jul 2006
    Location
    Tehran, Iran.
    Posts
    3,045
    Rep Power
    34

    Default Re: IRP hook

    Rootkit revealer is useless, it has not been updated in a long time.
    GMER is far better though.
    Thinkpad T400
    Older laptop : ASUS W3J

 

 

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
All times are GMT -4. The time now is 05:32 AM.
Powered by vBulletin® Version 4.2.2
Copyright © 2014 vBulletin Solutions, Inc. All rights reserved.
SEO by vBSEO 3.6.1