* Home Help Search Login Register  

Welcome, Guest. Please login or register.
October 12, 2008, 06:50:29 AM

Login with username, password and session length

199552 Posts
22913 Topics
54992 Members
Latest Member: janemack89

more news...
Search:     Advanced search | Tag Cloud
+  Welcome to the Comodo Forum
|-+  Desktop Security Products
| |-+  Comodo Anti-Viruspyware (CAVS)
| | |-+  Virus/Malware Removal Assistance
| | | |-+  mchinjdrv.sys		 « previous next »
Pages: [1] 2 Go Down Print
Author Topic: mchinjdrv.sys  (Read 10510 times)
krcmd1
Newbie
*
Offline Offline

Posts: 17
« on: May 30, 2007, 02:33:36 PM »
on launching, CAV warns about this file.  However, this file is not in c:\windows\system32\drivers as advised.  Is it being created by malware?

thank you?
Logged
mike6688
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 2021
« Reply #1 on: May 30, 2007, 03:51:05 PM »
Hi,

The name of the file looks very suspicious.  CAVS has probably quarantined the file which is why you cannot find it.  Can you check CAVS quarantine and tell us the name of what CAVS detects this as.

It may be the following:
http://www.esafe.com/home/csrt/valerts2.asp?virus_no=22426

Mike
« Last Edit: May 30, 2007, 03:53:13 PM by mike6688 » Logged
C.O.M.O.D.O: CIS + SafeSurf | VEngine | TrustConnect | CRC
XP SP3 32bit | 2.16GHz | 2GB Ram
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3652


I'm not grumpy, just misunderstood.
« Reply #2 on: May 30, 2007, 04:16:51 PM »
Actually, I think mchinjdrv.sys is a legitimate code injector, its a hidden driver deployed & used by Comodo Firewall Pro.

Edit: I think mchinjdrv stands for Mad Code Hook Injection Driver. Seriously.

2nd Edit: Its also deployed by some other security apps.. eg. some of ASquare's stuff.
« Last Edit: May 30, 2007, 04:30:00 PM by kail » Logged
XP Pro+SP3 and Vista Bus+SP1 with CFP 3.0.25.378 & AntiVir PE 8.1 & Firefox 3.0.1
__
Will computers ever be as smart as humans? Probably.. very, very briefly.
mike6688
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 2021
« Reply #3 on: May 31, 2007, 01:50:17 PM »
Kail,

Looks like you are right.  Guess I should have read a bit more into it:
http://www.wilderssecurity.com/showthread.php?t=47024
I'm running CAVS, A-squared anti-malware and CFP 2.4 myself, but CAVS does not alert to anything here.


krcmd1,

Is cavs alerting you to an infection, or is it an HIPS alert that appears for the program?

Mike
Logged
C.O.M.O.D.O: CIS + SafeSurf | VEngine | TrustConnect | CRC
XP SP3 32bit | 2.16GHz | 2GB Ram
gibran
Forum Member
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3823


Sometimes words are meaningless indeed...
« Reply #4 on: May 31, 2007, 03:32:06 PM »
Hallo,

I have CPF but  no mchinjdrv.sys. Is this a dinamically generated driver?
Logged
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3652


I'm not grumpy, just misunderstood.
« Reply #5 on: May 31, 2007, 06:47:12 PM »
Quote from: gibran on May 31, 2007, 03:32:06 PM
Hallo,

I have CPF but  no mchinjdrv.sys. Is this a dinamically generated driver?

Yep, confused me when I first ran into this as well. To be honest, I don't where or how it is.. I took Egemen at his word that CFP used it (not even sure if it still does) & that it was legitimate. I also understood his reluctance to discuss it in a public forum. If the BB's  search wasn't so "unwell" I'd find his post.
Logged
XP Pro+SP3 and Vista Bus+SP1 with CFP 3.0.25.378 & AntiVir PE 8.1 & Firefox 3.0.1
__
Will computers ever be as smart as humans? Probably.. very, very briefly.
Rotty
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 793

http://www.venganza.org/ - Noodly Appendage
« Reply #6 on: May 31, 2007, 07:54:09 PM »
You could always upload it to: http://virusscan.jotti.org/ to verify that it is legitimate.
Logged
The opinions expressed in my posts are my own. 
They do NOT necessarily represent or reflect the views of my employer.
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3652


I'm not grumpy, just misunderstood.
« Reply #7 on: May 31, 2007, 08:09:28 PM »
You'll need to find it first.  Grin
Logged
XP Pro+SP3 and Vista Bus+SP1 with CFP 3.0.25.378 & AntiVir PE 8.1 & Firefox 3.0.1
__
Will computers ever be as smart as humans? Probably.. very, very briefly.
Rotty
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 793

http://www.venganza.org/ - Noodly Appendage
« Reply #8 on: May 31, 2007, 09:09:48 PM »
That .sys file must be in file form somewhere on the hard drive at some stage.
Logged
The opinions expressed in my posts are my own. 
They do NOT necessarily represent or reflect the views of my employer.
gibran
Forum Member
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3823


Sometimes words are meaningless indeed...
« Reply #9 on: June 01, 2007, 07:48:46 AM »
Ok, I searched for more infos about madCodeHook...

Quote
There is a free non-commercial edition available. However, it contains no static libs. So when using the non-commercial edition you always need to distribute the "madCHook.dll" with your software.

Previous madCodeHook versions provided a static lib to non-commercial developers too (until Tue Aug 30, 2005).

The non-commercial madCodeHook edition has been dropped due to repeated misuse by malware (since Tue May 29, 2007).

Uall wrote the Madshow hook detector and its latest version is on a different url.
« Last Edit: June 01, 2007, 07:55:39 AM by gibran » Logged
yeiazel
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 563
« Reply #10 on: August 02, 2007, 01:52:17 AM »
Hi,

on my system this mchinjdrv.sys is come with a try installation of eTrust PestPatrol Version 8.0.0.6 (http://www.pestpatrol.com/) and now is missed !?!  Huh
Logged
Before posting a question check the FAQ

Remember also to list operating system and all active programs at time of the problem.
Rednose
Malware Research Group
Comodo's Hero
*****
Offline Offline

Posts: 1329


Ganda's sleepy ( in his wildest dreams )
« Reply #11 on: August 04, 2007, 05:42:41 AM »
If you can't find the file it is maybe hidden. How to show hidden files :

http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Greetz, Red.
Logged
XP 32x SP3  CFP 2.4  SSM 2.0 Free  Avast! 4.8 Home  CBOClean 4.27  CMF 2.0  SAS 4.21 Free  MBAM 1.28
yeiazel
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 563
« Reply #12 on: August 13, 2007, 07:23:57 PM »
Quote from: Rednose on August 04, 2007, 05:42:41 AM
If you can't find the file it is maybe hidden. How to show hidden files :

Thanks for your link, but I already know about system hidden files ...

The problem is that this file (or service or driver) miss also with "show system files" on ...

I have noticed that also Cyberhawk installs this hidden file and that in their forum says that this is a kernel driver able to detect rootkits:
http://www.pctools.com/forum/showthread.php?t=48220
Logged
Before posting a question check the FAQ

Remember also to list operating system and all active programs at time of the problem.
purrcy
Newbie
*
Offline Offline

Posts: 7
« Reply #13 on: October 05, 2007, 02:01:38 PM »
Here is how mchinjdrv.sys appears in the system:

\??\C:\Windows\Syatem32\Drivers\mchinjdrv.sys

... for whatever that's worth!  If you delete it, it just reappears the next time it's called for, by whatever it is that called for it.
Logged
controler
Comodo Member
**
Offline Offline

Posts: 32
« Reply #14 on: December 30, 2007, 01:46:58 PM »
On my system the file is hidden also, however UnHAckme sees it and can not remove it.
I had Comodo Firewall on for a while and not sure if it was from that but think it was from installing Threatfire

Bruce
Logged
Tags:
Pages: [1] 2 Go Up Print 
« previous next »
Jump to:  

SSL Firewall
Page created in 0.652 seconds with 20 queries.
Powered by SMF 1.1.5 | SMF © 2006, Simple Machines LLC
Seo4Smf v0.2 © Webmaster's Talks 		Design by 7dana.com