Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Potential Rootkit


15 Jan 2011   #1

Windows 7 Ultimate x64 SP1
 
 
Potential Rootkit

Hi, hopefully I've put this in the correct forum section, anyway I've just done a scan on a family members laptop with the latest version of Hitman Pro & its picked up a rootkit infection, the file is amstream.dll located in C:\Windows\System32, I've had a quick look at the file & uploaded it to VirusTotal but it says its clean, this file looks as though it been updated by SP1 as the version is 6.6.7601.17514 don't think that matters but I'm puzzled as to where this infection has come from, the family member's computer it's been detected on has MSE, Comodo Firewall, Malwarebyte & Hitman Pro (The last two are just on demand not paid versions).

Is there anything I can do to determine that it's maybe a FP, I've done a quick scan using MBAM but picked up nothing & I'm on doing a full scan with MSE.

Has anyone else got Windows 7 SP1 & willing to try Hitman Pro to see if they get the message?

I don't wanna touch anything yet in case it's an important system file.

Thanks anyway.

GILLY



Attached Images
 
My System SpecsSystem Spec
.

15 Jan 2011   #2

Windows 8.1 Pro x64
 
 

No such issue here, you may have a variant of the TDSS rootkit
How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?
My System SpecsSystem Spec
15 Jan 2011   #3

Windows 7 Ultimate x64 SP1
 
 

Thanks for your reply, I ran the Kaspersky program but it picked up nothing, also I've just noticed that only Prevx has picked this threat up, I don't know how good their definitions are but until I find out more I'm going to put this down as a FP for now.

Thanks again.

EDIT: Just ran another full scan with Hitman Pro & it's picking up nothing so I'm guessing it was just a FP on Prevx's part & I can only assume they updated their definitions in the last half hour to correct it?
My System SpecsSystem Spec
.


15 Jan 2011   #4

Windows7 Pro 64bit SP-1; Windows XP Pro 32bit
 
 

Posting what I find on the subject.

amstream.h

Look in the list her. It is alphabetical and listed in Windows Media Player as part of the program.

http://support.microsoft.com/kb/269605
My System SpecsSystem Spec
15 Jan 2011   #5
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

amstream.dll - Process Information
This component is part of Microsoft DirectX

Component Name
: amstream.dll
Description of : Microsoft DirectX is a group of technologies designed to make Windows-based computers an ideal platform for running and displaying applications rich in multimedia elements such as full-color graphics, video, 3D animation, and rich audio.
My System SpecsSystem Spec
Reply

 Potential Rootkit




Thread Tools



Similar help and support threads for2: Potential Rootkit
Thread Forum
Potential Slimtype BD E DS4E1S Driver Fix Hardware & Devices
Require (Rootkit.TDSS.TDL4) Rootkit Removal & Cleanup walkthrough System Security
Potential 64 bit problem? General Discussion
Potential New Card??? Graphic Cards
Full RAM Potential Hardware & Devices
Potential Mac Switcher -advice? General Discussion
CPU Not running at full potential. Hardware & Devices

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 07:22 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33