PDA

View Full Version : Rootkit scan - program halt



hake
06-23-2007, 10:52 AM
On running a full rootkit scan on a Windows 2000 machine, Cyberhawk halts fairly soon after commencing the scan.

The titlebar reads: CHService.exe - Application Error

The message reads: The instruction "0x02aa3883" referenced memory at "0x02dba006". The memory could not be "written".

Subsequently, the machine appears to be unable to continue operation or to be shutdown in the proper way. Failure of Cyberhawk cripples the system which needs a hard restart by reset button or power off/on. This seems to be specific to a particular machine because another Windows 2000 machine is able to run the full rootkit scan with relatively infrequent failures of this nature.

Running the rootkit scan on my Windows XP (SP2) machine seems to result in some sort of process hang. After scanning 9 files, nothing useful seems to happen thereafter; the file count stops incrementing and the registry is not scanned at all.

djames
06-23-2007, 02:20 PM
We just managed to repeat something similar, and we are looking into it. It is not so common, but something is amiss here and we are trying to put our finger on it.