1. You may have noticed things look a little different around here - we've switched to a new platform (XenForo) and have some new forum styles and features. This how-to guide will help you find your way around. If you find anything that looks strange, post it in this thread.

IRP hook

Discussion in 'Security and Anti-Virus Software' started by tbonez1376, Oct 27, 2010.

Thread Status:
Not open for further replies.
  1. tbonez1376

    tbonez1376 Notebook Enthusiast

    Joined:
    Jul 12, 2010
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    15
    I did a scan using AVG. As I've been suspecting possible rootkits on my laptop, I ran the rootkit scan. AVG tells me there are 28 rootkits on my computer. This is a C&P copy of the log from the scan. Message continues below....



    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CREATE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CREATE_NAMED_PIPE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CLOSE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_READ -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_WRITE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_EA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_EA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_FLUSH_BUFFERS -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_VOLUME_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_VOLUME_INFORMATION -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_DIRECTORY_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_FILE_SYSTEM_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_DEVICE_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SHUTDOWN -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_LOCK_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CLEANUP -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_CREATE_MAILSLOT -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_SECURITY -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_SECURITY -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_POWER -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SYSTEM_CONTROL -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_DEVICE_CHANGE -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_QUERY_QUOTA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_SET_QUOTA -> 0xFFFFFA80067448DD";"Object is hidden"
    "";"<unknown>";"IRP hook, \Driver\iaStor IRP_MJ_PNP -> 0xFFFFFA80067448DD";"Object is hidden"


    When it comes time to remove them, AVG says: "The module is different," and it can't remove it.

    Does anyone have anysuggestions for getting this crap out of my computer? And can anyone tell me what these things may be doing? This has been driving me nuts for about the last 2 days.

    Any help would be HUGELY appreciated!!!

    Thanks!
     
  2. Deks

    Deks Notebook Virtuoso

    Joined:
    Sep 30, 2008
    Messages:
    2,818
    Likes Received:
    38
    Trophy Points:
    66
    Remove AVG.
    Pick either MSE, Avira or Avast (just one) and re-scan your computer (either one of those 3 is far better than AVG and won't really impact performance).

    Or ... if you don't want to get rid of AVG, try running it in Safe Mode to get rid of the issue.
    A lot of av's cannot get rid of some infections while in standard mode.
     
  3. tbonez1376

    tbonez1376 Notebook Enthusiast

    Joined:
    Jul 12, 2010
    Messages:
    41
    Likes Received:
    0
    Trophy Points:
    15
    I've removed AVG. I've scanned in Safe Mode with MSE, SuperAntiSpyware, and Malwarebyte's Anti-Malware. All three don't detect anything when I scan in either Safe Mode or a normal boot-up.

    Why would AVG give me those results, but none of the other scans don't detect anything? Thant doesn't make any sense. Unless it's just AVG just trying to get me to buy their product(s).
     
  4. sarahlee

    sarahlee Newbie

    Joined:
    Dec 22, 2010
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    5
    how does one get into safe mode?

    sps
     
  5. Deks

    Deks Notebook Virtuoso

    Joined:
    Sep 30, 2008
    Messages:
    2,818
    Likes Received:
    38
    Trophy Points:
    66
    You have to restart the computer and keep pressing F8 button until it gives you a selection screen.
    From there, pick 'Safe Mode' and run the antivirus once there.

    another recommendation would be to download/install/update Malwarebytes and also run it from Windows Safe Mode.
     
  6. MrDJ

    MrDJ Notebook Nobel Laureate

    Joined:
    Mar 23, 2008
    Messages:
    10,619
    Likes Received:
    296
    Trophy Points:
    501
    Location:
    London UK
    avg could be giving a false positive which isnt picked up with the others.
    i used to use avg pro and am now on avast pro and its tons better and not had 1 false positive since.
     
  7. Major Wedgie

    Major Wedgie Newbie

    Joined:
    Mar 20, 2011
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    5
    I think deks the "notebook deity" has dispensed some shocking advice here. I think none of those products can detect a rootkit and you probably have a rootkit. I think AVG is by far one of the most accurate free scanners available.

    My advice if you are in doubt is to go and confirm what AVG has already told you with a Kaspersky tool called TDSSKiller. If it's not that particular rootkit then you should confirm it with the free Kaspersky scanner. Better yet, just trust the AVG tool and remove the rootkit.
     
  8. DetlevCM

    DetlevCM Notebook Nobel Laureate

    Joined:
    Jun 23, 2008
    Messages:
    8,392
    Likes Received:
    0
    Trophy Points:
    0
    Location:
    European Union
    Actually, iastor ist the Intel Matrix/Rapid Storage driver -> so either a false positive or a well hidden one.
    A simple test would be to uninstall the Intel Rapid/Matrix Storage driver if you have one -> Registry entries may remain though.

    On this note though, there is a Sysinternals Rootkit revealer - Sysinternals Security Utilities
    download it and run as admin, it will take quite some time.

    -> It might give you entries as possible rootkits that aren't, so you will need to evaluate every entry, but I think that's the best tool available to you.
     
  9. mujtaba

    mujtaba ZzzZzz Super Moderator

    Joined:
    Jul 29, 2006
    Messages:
    3,079
    Likes Received:
    95
    Trophy Points:
    116
    Location:
    Tehran, Iran.
    Rootkit revealer is useless, it has not been updated in a long time.
    GMER is far better though.
     
Thread Status:
Not open for further replies.

Share This Page