LPT1.HRQ - A security issue?

Thecrowman · 08-20-2008, 08:52 AM

Hi,

I have a small question. I use Avast! Anti-virus on Windows XP and recently I decided to run the Thorough Scan instead of the Standard Scan, and found something I haven't found before. Avast! found something called LPT1.HRQ in the C:\Windows directory, and recogniced it as a Rootkit. I tried to delete it but to no effect; it's still there when I run the scan again. I've also tried this in Safe Mode but it's the same deal here; finds LPT1.HRQ, attempts to delete it but nothing happens.

There are no error messages or anything, the file, or whatever it is, just persist even after I've restarted the computer. I don't have any printers installed.

I've also tried the RootkitUnhooker but it's the same thing here. Rku finds it but is unable to delete it. RootkitRevealer is unable to start at all.

I've also tried Pandas Online Scan as recommended by you. Same thing here.

My question is probably obvious at this point; should I worry about LPT1.HRQ?

Thanks in advance!

Thecrowman · 08-20-2008, 09:09 AM

Another thing, I can't access the Hijackthis Log Help Forum at all. Whenever I click on the forum link my web browser shuts down. I've tried this in Firefox, IE and Opera.

**Angelfire777** · 08-20-2008, 12:10 PM

Note to other members: This computer is being worked on here at General Computer Security because Thecrowman can't access the Hijackthis room due to the infection that he has. This is a special case. All other members should post their logs in the Hijackthis room.

@Thecrowman

You have an infection that's usually confined in Italy. Is this a laptop? If so, have you visited Italy before?

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following report for further review, and so we may continue cleaning the system:

C:\ComboFix.txt

Thecrowman · 08-21-2008, 11:04 AM

Hi,

Thanks for the help, Angelfire777, but I decided to do a full system recovery instead. My computer (yes, laptop ;) ) have had various small "ailments" so I wanted to start with a blank slate, so to speak. The problem seems to have gone away, but I'll keep this thread in mind if it ever occurs again.

Thanks again.

Cheers!

Thecrowman

**Angelfire777** · 08-21-2008, 12:29 PM

Ok. Thanks for letting us know.

Please read miekiemoes' "How to Prevent Malware"

Happy safe surfing!

08-20-2008, 08:52 AM	#1 (permalink)
Thecrowman Registered User Join Date: Aug 2008 Posts: 3 OS: Win XP	LPT1.HRQ - A security issue? Hi, I have a small question. I use Avast! Anti-virus on Windows XP and recently I decided to run the Thorough Scan instead of the Standard Scan, and found something I haven't found before. Avast! found something called LPT1.HRQ in the C:\Windows directory, and recogniced it as a Rootkit. I tried to delete it but to no effect; it's still there when I run the scan again. I've also tried this in Safe Mode but it's the same deal here; finds LPT1.HRQ, attempts to delete it but nothing happens. There are no error messages or anything, the file, or whatever it is, just persist even after I've restarted the computer. I don't have any printers installed. I've also tried the RootkitUnhooker but it's the same thing here. Rku finds it but is unable to delete it. RootkitRevealer is unable to start at all. I've also tried Pandas Online Scan as recommended by you. Same thing here. My question is probably obvious at this point; should I worry about LPT1.HRQ? Thanks in advance!

08-20-2008, 09:09 AM	#2 (permalink)
Thecrowman Registered User Join Date: Aug 2008 Posts: 3 OS: Win XP	Re: LPT1.HRQ - A security issue? Another thing, I can't access the Hijackthis Log Help Forum at all. Whenever I click on the forum link my web browser shuts down. I've tried this in Firefox, IE and Opera.

08-20-2008, 12:10 PM	#3 (permalink)
Angelfire777 Moderator/Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Oct 2006 Posts: 4,581 OS: Vista	Re: LPT1.HRQ - A security issue? Note to other members: This computer is being worked on here at General Computer Security because Thecrowman can't access the Hijackthis room due to the infection that he has. This is a special case. All other members should post their logs in the Hijackthis room. @Thecrowman You have an infection that's usually confined in Italy. Is this a laptop? If so, have you visited Italy before? Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once installed, you should see a blue screen prompt that says: The Recovery Console was successfully installed. Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. Please include the following report for further review, and so we may continue cleaning the system: C:\ComboFix.txt __________________ UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 08-20-2008 at 12:12 PM.

08-21-2008, 11:04 AM	#4 (permalink)
Thecrowman Registered User Join Date: Aug 2008 Posts: 3 OS: Win XP	Re: LPT1.HRQ - A security issue? Hi, Thanks for the help, Angelfire777, but I decided to do a full system recovery instead. My computer (yes, laptop ;) ) have had various small "ailments" so I wanted to start with a blank slate, so to speak. The problem seems to have gone away, but I'll keep this thread in mind if it ever occurs again. Thanks again. Cheers! Thecrowman

08-21-2008, 12:29 PM	#5 (permalink)
Angelfire777 Moderator/Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Oct 2006 Posts: 4,581 OS: Vista	Re: LPT1.HRQ - A security issue? Ok. Thanks for letting us know. Please read miekiemoes' "How to Prevent Malware" Happy safe surfing! __________________ UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it.