smeenk Posted April 27, 2013 ID:674236 Share Posted April 27, 2013 Database version: v2013.04.27.02Windows XP Service Pack 3 x86 NTFSInternet Explorer 8.0.6001.1870227-4-2013 10:52:58mbar-log-2013-04-27 (10-52-58).txtFiles Detected: 2C:\WINDOWS\system32\drivers\RkPavproc1.sys (Unknown Rootkit Driver Infection) -> Delete on reboot.C:\WINDOWS\system32\drivers\RkPavproc3.sys (Unknown Rootkit Driver Infection) -> Delete on reboot.http://www.pcwebplus.nl/phpbb/viewtopic.php?p=60686#p60686 Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 27, 2013 Staff ID:674238 Share Posted April 27, 2013 Hi,This appears to be a generic detection - I'll point the mbar developer to this thread.Although, it may be possible there's indeed a rootkit present (as we have seen with certain 0access veriants) where the files are "forged" by the rootkit meaning, reads through WinAPI differs from the contents readen through low-level disk access.So you may want to do some additional checks there. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 27, 2013 Staff ID:674239 Share Posted April 27, 2013 Updated previous post with some more info. Link to post Share on other sites More sharing options...
smeenk Posted April 27, 2013 Author ID:674240 Share Posted April 27, 2013 OK, thank you miekiemoes Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now