This might not be the correct place to post this, but I'm doing it anyway.
When I turned on my computer this morning, AVG notified me of a virus in System32. More specifically in \drivers\iaStor.sys.
The exact message is "Virus identified Win32/patched.DQ"
Since it's apparently a critical file, I'm hesitating deleting it, but I'm hoping someone here might have some insight on this problem and a possible solution.
Thanks!
-
moral hazard Notebook Nobel Laureate
I would backup all of my files and format the disk, reinstall windows.
-
As it seems to be residing in your driver map, make sure to have any necessary drivers ready as a backup if you start cleaning out.
I'd suggest to use a second opinion by downloading MBAM/Malwarebytes'Antimalware and run a quick scan. -
With viruses in System32, it's just best to backup your files and reinstall Windows, save you trouble later if you happen to "accidentally" remove an important file.
-
Run TDSSKiller from Kaspersky.
How to remove malware belonging to the family Rootkit.Win32.TDSS -
There is no description of your hardware or your OS in your post. It is impossible to give you give you good advice.
iastore.sys is an intel storage drive used by sata drives and RAID setups. Without it, your computer will not run (if it is an sata or raid based system)
It could be a false alarm, but it could be real. Are you noticing any odd behavior? Have you run any other software to try and confirm (try gmer)
I have run into many infected machines where infected drivers result in odd behavior--specifically search engine redirection.
The solution is to replace the file with a known good file. How that is done depends on your level of expertise and resources. -
perrin_aybara Notebook Consultant
-
Virus in System32?
Discussion in 'Security and Anti-Virus Software' started by JonasJur, May 30, 2010.