* Home Help Search Login Register  

Welcome, Guest. Please login or register.
December 08, 2009, 11:23:10 PM

Login with username, password and session length

341056 Posts
37715 Topics
85602 Members
Latest Member: deathblame

more news...
Search:     Advanced search | Tag Cloud
+  Welcome to the Comodo Forum
|-+  Desktop Security Products
| |-+  Comodo Internet Security - CIS
| | |-+  Virus/Malware Removal Assistance
| | | |-+  mchinjdrv.sys		 « previous next »
Pages: [1] 2 Go Down Print
Author Topic: mchinjdrv.sys  (Read 18138 times)
krcmd1
Newbie
*
Offline Offline

Posts: 17
« on: May 30, 2007, 02:33:36 PM »
on launching, CAV warns about this file.  However, this file is not in c:\windows\system32\drivers as advised.  Is it being created by malware?

thank you?
Logged
mike6688
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 2058
« Reply #1 on: May 30, 2007, 03:51:05 PM »
Hi,

The name of the file looks very suspicious.  CAVS has probably quarantined the file which is why you cannot find it.  Can you check CAVS quarantine and tell us the name of what CAVS detects this as.

It may be the following:
http://www.esafe.com/home/csrt/valerts2.asp?virus_no=22426

Mike
« Last Edit: May 30, 2007, 03:53:13 PM by mike6688 » Logged
C.O.M.O.D.O: CIS | VE | TrustConnect | CSC | Online Backup (Beta)
XP SP3 32bit | 2.16GHz | 2GB Ram
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 5323


I'm not a complete idiot, some bits are missing.
« Reply #2 on: May 30, 2007, 04:16:51 PM »
Actually, I think mchinjdrv.sys is a legitimate code injector, its a hidden driver deployed & used by Comodo Firewall Pro.

Edit: I think mchinjdrv stands for Mad Code Hook Injection Driver. Seriously.

2nd Edit: Its also deployed by some other security apps.. eg. some of ASquare's stuff.
« Last Edit: May 30, 2007, 04:30:00 PM by kail » Logged
Vista Business x32+SP2 with CIS 3.12 & Firefox 3.5 & Becky! 2.52
__
A positive and polite attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.
mike6688
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 2058
« Reply #3 on: May 31, 2007, 01:50:17 PM »
Kail,

Looks like you are right.  Guess I should have read a bit more into it:
http://www.wilderssecurity.com/showthread.php?t=47024
I'm running CAVS, A-squared anti-malware and CFP 2.4 myself, but CAVS does not alert to anything here.


krcmd1,

Is cavs alerting you to an infection, or is it an HIPS alert that appears for the program?

Mike
Logged
C.O.M.O.D.O: CIS | VE | TrustConnect | CSC | Online Backup (Beta)
XP SP3 32bit | 2.16GHz | 2GB Ram
gibran
Average User
Comodo's Hero
*****
Offline Offline

Posts: 5063


A bad workman always blames his tools
« Reply #4 on: May 31, 2007, 03:32:06 PM »
Hallo,

I have CPF but  no mchinjdrv.sys. Is this a dinamically generated driver?
Logged
"In the beginning the Universe was created. This has made a lot of people very angry and has been widely regarded as a bad move."- Douglas Adams
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 5323


I'm not a complete idiot, some bits are missing.
« Reply #5 on: May 31, 2007, 06:47:12 PM »
Quote from: gibran on May 31, 2007, 03:32:06 PM
Hallo,

I have CPF but  no mchinjdrv.sys. Is this a dinamically generated driver?

Yep, confused me when I first ran into this as well. To be honest, I don't where or how it is.. I took Egemen at his word that CFP used it (not even sure if it still does) & that it was legitimate. I also understood his reluctance to discuss it in a public forum. If the BB's  search wasn't so "unwell" I'd find his post.
Logged
Vista Business x32+SP2 with CIS 3.12 & Firefox 3.5 & Becky! 2.52
__
A positive and polite attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.
Rotty
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 898


http://www.venganza.org/ - Noodly Appendage
« Reply #6 on: May 31, 2007, 07:54:09 PM »
You could always upload it to: http://virusscan.jotti.org/ to verify that it is legitimate.
Logged
The opinions expressed in my posts are my own. 
They do NOT necessarily represent or reflect the views of my employer.
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 5323


I'm not a complete idiot, some bits are missing.
« Reply #7 on: May 31, 2007, 08:09:28 PM »
You'll need to find it first.  Grin
Logged
Vista Business x32+SP2 with CIS 3.12 & Firefox 3.5 & Becky! 2.52
__
A positive and polite attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.
Rotty
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 898


http://www.venganza.org/ - Noodly Appendage
« Reply #8 on: May 31, 2007, 09:09:48 PM »
That .sys file must be in file form somewhere on the hard drive at some stage.
Logged
The opinions expressed in my posts are my own. 
They do NOT necessarily represent or reflect the views of my employer.
gibran
Average User
Comodo's Hero
*****
Offline Offline

Posts: 5063


A bad workman always blames his tools
« Reply #9 on: June 01, 2007, 07:48:46 AM »
Ok, I searched for more infos about madCodeHook...

Quote
There is a free non-commercial edition available. However, it contains no static libs. So when using the non-commercial edition you always need to distribute the "madCHook.dll" with your software.

Previous madCodeHook versions provided a static lib to non-commercial developers too (until Tue Aug 30, 2005).

The non-commercial madCodeHook edition has been dropped due to repeated misuse by malware (since Tue May 29, 2007).

Uall wrote the Madshow hook detector and its latest version is on a different url.
« Last Edit: June 01, 2007, 07:55:39 AM by gibran » Logged
"In the beginning the Universe was created. This has made a lot of people very angry and has been widely regarded as a bad move."- Douglas Adams
yeiazel
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 1078
« Reply #10 on: August 02, 2007, 01:52:17 AM »
Hi,

on my system this mchinjdrv.sys is come with a try installation of eTrust PestPatrol Version 8.0.0.6 (http://www.pestpatrol.com/) and now is missed !?!  Huh
Logged
Before posting a question check the FAQ

Remember also to list operating system and all active programs at time of the problem.
Rednose
Malware Research Group
Comodo's Hero
*****
Offline Offline

Posts: 1687


Ganda's wet dream ...
« Reply #11 on: August 04, 2007, 05:42:41 AM »
If you can't find the file it is maybe hidden. How to show hidden files :

http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Greetz, Red.
Logged
Malware Fighter !
yeiazel
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 1078
« Reply #12 on: August 13, 2007, 07:23:57 PM »
Quote from: Rednose on August 04, 2007, 05:42:41 AM
If you can't find the file it is maybe hidden. How to show hidden files :

Thanks for your link, but I already know about system hidden files ...

The problem is that this file (or service or driver) miss also with "show system files" on ...

I have noticed that also Cyberhawk installs this hidden file and that in their forum says that this is a kernel driver able to detect rootkits:
http://www.pctools.com/forum/showthread.php?t=48220
Logged
Before posting a question check the FAQ

Remember also to list operating system and all active programs at time of the problem.
purrcy
Newbie
*
Offline Offline

Posts: 7
« Reply #13 on: October 05, 2007, 02:01:38 PM »
Here is how mchinjdrv.sys appears in the system:

\??\C:\Windows\Syatem32\Drivers\mchinjdrv.sys

... for whatever that's worth!  If you delete it, it just reappears the next time it's called for, by whatever it is that called for it.
Logged
controler
Comodo Member
**
Offline Offline

Posts: 35
« Reply #14 on: December 30, 2007, 01:46:58 PM »
On my system the file is hidden also, however UnHAckme sees it and can not remove it.
I had Comodo Firewall on for a while and not sure if it was from that but think it was from installing Threatfire

Bruce
Logged
Tags:
Pages: [1] 2 Go Up Print 
« previous next »
Jump to:  

SSL Certificate Free Virus Removal Firewall
Page created in 0.078 seconds with 19 queries.
Powered by SMF 1.1.10 | SMF © 2006, Simple Machines LLC
Seo4Smf v0.2 © Webmaster's Talks 		Design by 7dana.com