Hidden Driver in a rootket. How do I rid myself of the virus or spyware???

AVG is reporting this problem. When I tell AVG to remove the "software/file" the message reads that the I cannot access the file because it is locked (access denied). Can you (anyone) give me some information on how to rid myself of this problem? Thanks in advance!

"Object name";"C:\WINDOWS\TEMP\INSTB32.SYS"
"Detection name";"Hidden driver"
"Object type";"file"
"SDK Type";"Rootkit"
"Result";"Object is hidden"

 

Is it AVG Free ? I don't think it removes rootkits.

Have you tried deleting the file via explorer ?

Also check the file name on the web to be sure its a virus/rootkit.

This program is good for unlocking "locked" files in general ,
its not an Anti-rootkit product though.

http://download.cnet.com/Unlocker/3000-2248_4-10493998.html

 

I think AVG Free can't detect hidden drivers, the option is disabled. Maybe it's a FP?

 

I'd suggest you to send INSTB32.SYS to some av labs (e.g. AVG, Kaspersky, Avira,...) to ensure whether this driver is malicious or just fp. Here's what Prevx says about it http://www.prevx.com/filenames/X32233117978654672-X1/INSTB32.SYS.html

 

Hi joelholliman

here a post in kaspersky forum:

http://forum.kaspersky.com/lofiversion/index.php/t56856.html

Looks like FP

 

Thanks for your input. AVG is the full version. AVG reports the file is in \Windows\Temp but I can't see it. Folder options are set to see hidden files. Do you know how I can make it visible? Thanks!

 

The file is hidden even though the folder options state to show all hidden files. Do you know of a way to see this file? Thanks in advance!

 

Sorry, I don't really know how to view hidden drivers but you could check if there's an option to open the driver location from avg itself. Also look in the quarantine, maybe avg already moved the file there.

 

You could see what f-secure blacklight has to say.

http://www.f-secure.com/en_EMEA/products/technologies/blacklight/

 

Let me guess, you have a laptop? Its a file associated with LoJack .

I got the same warning on mine and after research found out it was associated with that program. I wouldnt remove it if you want it to work.

 

In the Folder Options Dialog Window just below "Show hidden files and folders", remove the check mark (disable) from the following:

01)- Hide extensions of known file types
02)- Hide protected operating system files

This action should reveal the hidden files/drivers, however,
if the files/drivers are protected by an Rootkit, this action might be fruitless

Also run F-Secure Blacklight as suggested by user "Mattchu" and disable all security software before running the tool.
Disabling all security software allows Blacklight to run unhindered.

Here is the URL to the Direct Download Page of F-Secure Blacklight:
http://www.f-secure.com/en_EMEA/security/security-lab/tools-and-services/blacklight/


HKEY1952

 

Welcome joelholliman,

What they speak, all these reliable tools (especially antirootkits), which are (with the links) in my Signature, please?


PROROOTECT

 

For xp, there is a simple solution. Just install a dos7 or linux and check the location under a different OS. Removing a rootkit is easy as pie. Hope this helps.

 

Yes schindyguy (WELCOME! ) - 'No malicious code was found in this file' : INSTB32.SYS . One FP here.

Look here: http://209.85.229.132/search?q=cach...ck Absolute Software&cd=1&hl=fr&ct=clnk&gl=fr

.. and here: http://en.community.dell.com/forums/t/19274925.aspx

Also look for: Absolute Software Corp., Computrace, LoJack.


PROROOTECT