Application Control alert

[Hammer56]

Hello

I hope I’m not asking a stupid question in regards to this situation.

I keep getting this alert when I bootup my computer. (ver 2.4.18.84)

Application: mchinjdrv.sys
Application Path: c:\windows\system32\drivers
Company: N/A
Parent Process: system
Suggestion: This file is not found in Comodo Safelist database it may not be safe to execute this file.

I did a search of my computer and could not find this file. How do I get rid of this alert?

Thanks in advance

Hammer56

WindowsXP Home
comodo AV Beta 2
Spybot S&D ver 1.51
Threatfire ver 3
Spyware Blaster ver3.5.1
Spyware Terminator ver2.0.1.224

[Opus_Dei]

Not a stupid question at all
I don’t know if there has been a resoluton yet
I PM’d Kail to see if there has been any resolution on these
this is all I could find on this maybe someone else can help you or possibly a mod wants to merge the topic with your permision of course
from
https://forums.comodo.com/virusmalware_removal_assistance/mchinjdrvsys-t13421.0.html

@kail post:2

This driver is a legitimate code injector, its a hidden driver. mchinjdrv stands for Mad Code Hook Injection Driver (seriously). The free version was taken down late 2005 (I think) because of abuse & that’s the one you find in Malware. You don’t find this one because it is not free. This driver is used by CFP (2.4, I don’t think version 3 uses it… Egemen?) & A-Squared products to name but a couple. Deleting it (if you can find it) is futile since its installed (by what uses it) dynamically at run-time. It is not an infection.

and from
https://forums.comodo.com/virusmalware_removal_assistance/mchinjdrvsys-t9257.0.html

when did this start showing up
have you tried Uninstalling and reinstalling CFP2.4

OD

@Hammer56 post:1

Hello

I hope I’m not asking a stupid question in regards to this situation.

I keep getting this alert when I bootup my computer. (ver 2.4.18.84)

Application: mchinjdrv.sys
Application Path: c:\windows\system32\drivers
Company: N/A
Parent Process: system
Suggestion: This file is not found in Comodo Safelist database it may not be safe to execute this file.

I did a search of my computer and could not find this file. How do I get rid of this alert?

Thanks in advance

Hammer56

WindowsXP Home
comodo AV Beta 2
Spybot S&D ver 1.51
Threatfire ver 3
Spyware Blaster ver3.5.1
Spyware Terminator ver2.0.1.224

[kail]

Thanks for the PM OD.

As far as I know MchInjDrv.sys isn’t a problem to be resolved (read previous statements).

However, the fact that CFP is detecting MchInjDrv.sys implies (to me, at least) that this particular SYS is either not CFPs hidden driver (other security apps do use it) or CFPs Safelist has been damaged/deleted. I would go with ODs suggestion of re-installing CFP (really to rebuild the Safelist).

BTW what sort of alert is this from CFP? Does it just appear in the Log or does CFP generate a pop-up alert for it. Do you get the option to remember it? However, I’m not suggesting that you do allow it yet… best to try & find out who’s it is first. Running any A-Squared apps?

[Hammer56]

Thanks for the response

This file is also used by Threat Fire (formerly Cyberhawk) as a kernel, which I have installed on my computer. So do I uninstall Threat Fire, and re-install CFP?

Thanks

Hammer56

[Opus_Dei]

I would uninstall Threat Fire, but that is me. I am assuming that you have some other version of AV on there as well. From what I read Threat fire is meant as supplementary software.

There are othere post relating to a conflict with cyberhawk

I could use a different version of MchInjDrv.sys or it could be the fact that this file is auto regenerated from a compressed file who know

You need to decide which combination of security software you want to run
If you uninstall Threat Fire and keep getting the alert I would uninstall CFP2.4 and reinstall

Ultimately the decision is yours

OD

@Hammer56 post:4

Thanks for the response

This file is also used by Threat Fire (formerly Cyberhawk) as a kernel, which I have installed on my computer. So do I uninstall Threat Fire, and re-install CFP?

Thanks

Hammer56

[kail]

I don’t think Threat Fire & CFP will (or can) use the same driver (physical SYS file). In CFPs case the driver is decompressed, loaded & removed from disk at run-time… Threat Fire probably does something similar.

I agree with OD, uninstall Threat Fire, reinstall CFP and try again. Please post back what happens, thanks.

[Hammer56]

Kail, Opus Dei

I went ahead and un-installed Threat Fire. I rebooted my computer a couple of times to be sure and NO alert was given by CFP. I really didn’t want to re-install CFP, so I think I’ll leave it be for now and see how it goes.

Thanks for all your help!

Hammer56