Potential Rootkit


  1. Posts : 195
    Windows 7 Ultimate x64 SP1
       #1

    Potential Rootkit


    Hi, hopefully I've put this in the correct forum section, anyway I've just done a scan on a family members laptop with the latest version of Hitman Pro & its picked up a rootkit infection, the file is amstream.dll located in C:\Windows\System32, I've had a quick look at the file & uploaded it to VirusTotal but it says its clean, this file looks as though it been updated by SP1 as the version is 6.6.7601.17514 don't think that matters but I'm puzzled as to where this infection has come from, the family member's computer it's been detected on has MSE, Comodo Firewall, Malwarebyte & Hitman Pro (The last two are just on demand not paid versions).

    Is there anything I can do to determine that it's maybe a FP, I've done a quick scan using MBAM but picked up nothing & I'm on doing a full scan with MSE.

    Has anyone else got Windows 7 SP1 & willing to try Hitman Pro to see if they get the message?

    I don't wanna touch anything yet in case it's an important system file.

    Thanks anyway.

    GILLY
    Attached Thumbnails Attached Thumbnails Potential Rootkit-hitman_scan_rootkit.png  
      My Computer


  2. Posts : 8,383
    Windows 10 Pro x64, Arch Linux
       #2

    No such issue here, you may have a variant of the TDSS rootkit
    How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?
      My Computer


  3. Posts : 195
    Windows 7 Ultimate x64 SP1
    Thread Starter
       #3

    Thanks for your reply, I ran the Kaspersky program but it picked up nothing, also I've just noticed that only Prevx has picked this threat up, I don't know how good their definitions are but until I find out more I'm going to put this down as a FP for now.

    Thanks again.

    EDIT: Just ran another full scan with Hitman Pro & it's picking up nothing so I'm guessing it was just a FP on Prevx's part & I can only assume they updated their definitions in the last half hour to correct it?
      My Computer


  4. Posts : 6,349
    Windows7 Pro 64bit SP-1; Windows XP Pro 32bit
       #4

    Posting what I find on the subject.

    amstream.h

    Look in the list her. It is alphabetical and listed in Windows Media Player as part of the program.

    http://support.microsoft.com/kb/269605
      My Computer


  5. Posts : 8,608
    Windows 7 Ultimate 32bit SP1
       #5

    amstream.dll - Process Information
    This component is part of Microsoft DirectX

    Component Name
    : amstream.dll
    Description of : Microsoft DirectX is a group of technologies designed to make Windows-based computers an ideal platform for running and displaying applications rich in multimedia elements such as full-color graphics, video, 3D animation, and rich audio.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:36.
Find Us