mchinjdrv.sys

Learn about Computer Security Virus/Malware Removal Assistance
#1

on launching, CAV warns about this file. However, this file is not in c:\windows\system32\drivers as advised. Is it being created by malware?

thank you?

#2

Hi,

The name of the file looks very suspicious. CAVS has probably quarantined the file which is why you cannot find it. Can you check CAVS quarantine and tell us the name of what CAVS detects this as.

It may be the following:

Mike

#3

Actually, I think mchinjdrv.sys is a legitimate code injector, its a hidden driver deployed & used by Comodo Firewall Pro.

Edit: I think mchinjdrv stands for Mad Code Hook Injection Driver. Seriously.

2nd Edit: Its also deployed by some other security apps… eg. some of ASquare’s stuff.

#4

Kail,

Looks like you are right. Guess I should have read a bit more into it:

I’m running CAVS, A-squared anti-malware and CFP 2.4 myself, but CAVS does not alert to anything here.

krcmd1,

Is cavs alerting you to an infection, or is it an HIPS alert that appears for the program?

Mike

#5

Hallo,

I have CPF but no mchinjdrv.sys. Is this a dinamically generated driver?

#6

Yep, confused me when I first ran into this as well. To be honest, I don’t where or how it is… I took Egemen at his word that CFP used it (not even sure if it still does) & that it was legitimate. I also understood his reluctance to discuss it in a public forum. If the BB’s search wasn’t so “unwell” I’d find his post.

#7

You could always upload it to: http://virusscan.jotti.org/ to verify that it is legitimate.

#8

You’ll need to find it first. ;D

#9

That .sys file must be in file form somewhere on the hard drive at some stage.

#10

Ok, I searched for more infos about madCodeHook…

There is a free non-commercial edition available. However, it contains no static libs. So when using the non-commercial edition you always need to distribute the "madCHook.dll" with your software.

Previous madCodeHook versions provided a static lib to non-commercial developers too (until Tue Aug 30, 2005).

The non-commercial madCodeHook edition has been dropped due to repeated misuse by malware (since Tue May 29, 2007).

Uall wrote the Madshow hook detector and its latest version is on a different url.

#11

Hi,

on my system this mchinjdrv.sys is come with a try installation of eTrust PestPatrol Version 8.0.0.6 (http://www.pestpatrol.com/) and now is missed !?! ???

#12

If you can’t find the file it is maybe hidden. How to show hidden files :

http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Greetz, Red.

#13

Thanks for your link, but I already know about system hidden files …

The problem is that this file (or service or driver) miss also with “show system files” on …

I have noticed that also Cyberhawk installs this hidden file and that in their forum says that this is a kernel driver able to detect rootkits:

#14

Here is how mchinjdrv.sys appears in the system:

??\C:\Windows\Syatem32\Drivers\mchinjdrv.sys

… for whatever that’s worth! If you delete it, it just reappears the next time it’s called for, by whatever it is that called for it.

#15

On my system the file is hidden also, however UnHAckme sees it and can not remove it.
I had Comodo Firewall on for a while and not sure if it was from that but think it was from installing Threatfire

Bruce

#16

I also have this one. Scanned it on VirusTotal.com, and here’s the results:

File mchInjDrv.sys recieved 2007.12.26 16:26:42 (CET)
Result: 2/32 (6.25%)
Detected by: ClamAV, TheHacker

File infomration

Name:mchInjDrv.sys
MD5: 9971aa2d16cb558358d6f6f3b5055cba

Seems like it’s clean.

Cheers,
Ragwing