located threats- system32\drivers\spuo.sys What is it & can i delete?

[amitamit2]

located threats- system32\drivers\spuo.sys What is it & can i delete?

AVG found a bunch of threats in said location (picture included). Can anyone tell me what that is exactly, what could it affect in my computer, and most importantly - can i safely "heal"/"remove" said files?
I don't wanna carelessly mess with system32...

 

[Layback Bear]

Thank you amitamit2 for posting here as requested. I want to follow this.

 

[cottonball]

Have you tried to use AVG to fix the issue?
Does the he sp** file change after addressing the issue and restarting the computer?

Let's see what the following anti-rootkit tool has to show...

Please go to the Malwarebytes Anti-Rootkit Download

Save to the Desktop (easy to find)

Right-click the file and select: Extract here... (to the Desktop)

Open its folder and double-click on mbar.exe to start the program.

Follow the prompts and be sure to update the definitions when it asks.

If it detects any infections, allow the program to remove them.

When the program is done, two reports are created in the mbar folder:
1. system-log.txt
2. mbar-log-2013-02-18 (20-13-32).txt (corresponds to mbar-log-year-month-day (hour-minute-second).txt)

Please provide both reports in your reply.

 

[cottonball]

BTW, what version of AVG do you have?

 

[Sir George]

AVG found a bunch of threats in said location (picture included). Can anyone tell me what that is exactly, what could it affect in my computer, and most importantly - can i safely "heal"/"remove" said files?
I don't wanna carelessly mess with system32...

The following link could be useful;

Rootkit and malware detection and removal guide

HTH

 

[cottonball]

Some good information there, however, the programs mentioned are another story.

RootkitRevealer
About 6 or more years ago, it was going strong.
Haven't seen anyone use it lately, and the last time I did, it did not support any Operating
System beyond XP.

Has it been updated now to run in Windows 7, and now it is back??
Hmmmm....

F-Secure BlackLight
This program may run in Windows 7 32-bit. However, the system being dealt with is 64-bit.

As far as the program goes, you will need to find specific instructions as to how to use it.
It is not meant for casual use, and will result in Windows not operating properly, if used incorrectly.

At this point, it is more than likely the detections are false. AVG had this problem before now.

 

[Callender]

False Positive Detections?

Some good information there, however, the programs mentioned are anothe story.

RootkitRevealer
About 6 or more years ago, it was going strong.
Haven't seen anyone use it lately, and the last time I did, it did not support any Operating
System beyond XP.

Has it been updated now to run in Windows 7, and now it is back??
Hmmmm....

F-Secure BlackLight
This program may run in Windows 7 32-bit. However, the system being dealt with is 64-bit.

As far as the program goes, you will need to find specific instructions as to how to use it.
It is not meant for casual use, and will result in Windows not operating properly, if used incorrectly.

At this point, it is more than likely the detections are false. AVG had this problem before now.

I reckon Cottonball knows best. It's probably false positive detection by AVG and you need to confirm by another source.

I've used many rootkit detectors/ revealers and the only one that never gave a false positive detection was:

Removing rootkit with the Trend Micro Rootkit Buster

You need the 64bit version for Windows 7

 

[cottonball]

Good choice, Callender!


@amitamit2:

Since it is best to use more than one tool to confirm results, also run the program...

Please download Trend Micro Rootkit Buster:
Removing rootkit with the Trend Micro Rootkit Buster
Select the file that corresponds to your system (64-bit)
Save the file on the Desktop

Right-click RootkitBuster.exe, and select: Run as Administrator

To use the program, accept the terms of the license agreement, and then click: Next
On the next console, press: Scan Now

Wait for the program to finish scanning the computer and until you see the results of the scan.
You can also press the Log tab to obtain the report.

At the screen containing the results, press: Full Results

A 1392158435 - Notepad (numbers will vary) report opens on the Desktop containing info such as:

Trend Micro RootkitBuster
| Module version: 5.0.0.1129
| Computer Name: CB-PC
| OS version: 6.1-7601
| User Name: CB

Please provide the results of the XXXXXXXXXX - Notepad in your reply.

Thanks!

 

[amitamit2]

cottonball, i downloaded Malwarebytes Anti-Rootkit as u instructed and will shortly write down what the results were.
And about your questions:

Have you tried to use AVG to fix the issue?

As i said, i was afraid to press the remove all unhealed button, because those things were on system 32 and i asked if it's safe to click it.

BTW, what version of AVG do you have?

I don't know any more than what the pic in the first post says... "AVG antivirus free edition 2012, last updated 10/2/2014"... that's what it says... (Date is opposite for Americans, switch 10/2 to -> 2/10)

EDIT:

Since it is best to use more than one tool to confirm results, also run the program...
Please download Trend Micro Rootkit Buster:

Will do!

 

[amitamit2]

Malware Bytes keeps getting stuck on random files and isn't completing its scan... I'll give it a few more minutes to let it try to get itself unstuck on history.ie5\index.dat and if it's still there i'll try the other one this time...

EDIT:
Nvm, it's through with the file... took abnormally long... it's having similar pauses in a lot of files... this is gonna take a while... a long long while...

EDIT 2: Malware Bytes is done. Seems like i had a big "boxore" problem, not sure if it's a big deal or not (Logs included).
After restarting, I proceeded to use Trend Micro; It scanned for about half a second and produced no results...

 

[amitamit2]

Judging by the previous results, am I to conclude that AVG gave me false positives and that i shouldn't erase them?

 

[cottonball]

Let's submit the file for analysis to VirusTotal
http://www.virustotal.com/

File:
C:\Windows\System32\drivers\spuo.sys

Use the 'Choose File' button to navigate to the location of the file.

In the Choose file to upload prompt, select the file, then, click the 'Open' button.
The file is now displayed in the blank box of VirusTotal
Click: Scan It, and wait for the results.
If you get a message saying: File has already been analyzed, click: Reanalyze file now

:ar: Once scanned, please provide the link to the results page in your reply.

 

[amitamit2]

i tried searching for it but couldn't locate it... I tried "show hidden folders" AND un-checking "hide protected operating files" but i still couldn't see it in said location...

 

[Callender]

Quick question. Do you have any CD Emulation software installed? (Alcohol or Daemon Tools) If so have a look here:

Why we request you disable CD Emulation when receiving Malware Removal Advice - Virus, Trojan, Spyware, and Malware Removal Logs

 

[amitamit2]

I used to use Daemon Tools a lot. Even though i haven't turned it on in a long long time, it looks like it still had its virtual drive in my computer. I used Defogger as instructed and am re-running the Anti-Rootkit softwares again.
So far, Micro Trend hasn't found anything (as usual), and Malwarebytes is taking it's sweet time with the scan (again... as usual).
I also saw that it could be what was causing some of my windows updates to regularly not install. I'll also be installing all waiting windows updates now.

 

[cottonball]

If I recall correctly, Daemon tools has been known to cause some hang-ups with sptd.sys

However, what we have here is spuo.sys

Also, the fact that the file cannot be found anywhere seems to confirm that this is an AVG issue.

 

[amitamit2]

In any case, both Anti-Rootkits found nothing and i've completed all pending windows updates. So r u saying that i should ignore AVG's findings?
Also, do you have any other suggestions on things i should do?
So far the issue has stopped but i'm not sure if it's permanently gone; and if it is, then i'm not really sure what exactly cured the problem...

 

[Callender]

spuo.sys

If I recall correctly, Daemon tools has been known to cause some hang-ups with sptd.sys

However, what we have here is spuo.sys

Also, the fact that the file cannot be found anywhere seems to confirm that this is an AVG issue.

Line of thought was - if Daemon Tools is installed it could possibly interfere with scanners that could detect spuo.sys. Not that deactivating the Damon Tools driver or removing it would eliminate spuo.sus as it's clearly nothing to do with Daemon Tools.

 

[cottonball]

Hmmmm...to my understanding, Daemon Tools use a hidden driver (sptd.sys) as part of its
CD Emulation, and may be seen as a Rootkit, or will interfere with the proper operation
of Rootkit scanners.

sptd.sys cannot be opened, shows as a hidden object, etc.

That is why a program called Defogger is run.
Download Defogger - MajorGeeks

It enables or disables CD emulation, a step often required in removing difficult malware.

However, as mentioned before, IMO spuo.sys is not a relative...

 

[cottonball]

Hmmmm...to my understanding, Daemon Tools use a hidden driver (sptd.sys) as part of its
CD Emulation, and may be seen as a Rootkit, or will interfere with the proper operation
of Rootkit scanners.

sptd.sys cannot be opened, shows as a hidden object, etc.

That is why a program called Defogger is sometimes run.
Download Defogger - MajorGeeks
It enables or disables CD emulation, a step often required in removing difficult malware.

However, as mentioned before, IMO spuo.sys is not a relative...I could be wrong, though.