IRP_MJ_SCSI kernel mode hook on mvs91xx.sys - What is this and is this bad? How to prevent this?

Status
Not open for further replies.

Tempnexus

Level 3
Thread author
Verified
Nov 25, 2015
136
HitmanPro with EWS is showing this alert:
IRP_MJ_SCSI kernel mode hook on mvs91xx.sys detected and bypassed.
The device stack the hard disk is referencing a hidden driver. This could affect the detection of malicious files.

What is this and is this bad? How to prevent this?

Picture is worth a 1000 words.
shit2.PNG


@Erik Loman
 
Last edited by a moderator:
  • Like
Reactions: Sunshine-boy

Erik Loman

From SurfRight
Verified
Developer
Jan 27, 2015
61
Are you running HitmanPro.Alert 3.5 (or newer) as well? Then this is most likely the WipeGuard kernel-mode hook of HitmanPro.Alert. You can see in the log file where the detour points to.

WipeGuard protects critical boot sectors of the system. Its current implementation is a bit limited but it will gain more features in upcoming builds.

NOTE: This detection is only shown if you run in EWS.
 
  • Like
Reactions: Sunshine-boy
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top