The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Virus in System32?

    Discussion in 'Security and Anti-Virus Software' started by JonasJur, May 30, 2010.

  1. JonasJur

    JonasJur Notebook Enthusiast

    Reputations:
    0
    Messages:
    23
    Likes Received:
    0
    Trophy Points:
    5
    This might not be the correct place to post this, but I'm doing it anyway.

    When I turned on my computer this morning, AVG notified me of a virus in System32. More specifically in \drivers\iaStor.sys.
    The exact message is "Virus identified Win32/patched.DQ"

    Since it's apparently a critical file, I'm hesitating deleting it, but I'm hoping someone here might have some insight on this problem and a possible solution.

    Thanks!
     
    JonasJur, May 30, 2010
    #1
  2. moral hazard

    moral hazard Notebook Nobel Laureate

    Reputations:
    2,779
    Messages:
    7,957
    Likes Received:
    87
    Trophy Points:
    216
    I would backup all of my files and format the disk, reinstall windows.
     
    moral hazard, May 30, 2010
    #2
  3. Baserk

    Baserk Notebook user

    Reputations:
    2,503
    Messages:
    1,794
    Likes Received:
    1
    Trophy Points:
    56
    As it seems to be residing in your driver map, make sure to have any necessary drivers ready as a backup if you start cleaning out.
    I'd suggest to use a second opinion by downloading MBAM/Malwarebytes'Antimalware and run a quick scan.
     
    Baserk, May 30, 2010
    #3
  4. Joel

    Joel coffeecoffeecoffeecoffee

    Reputations:
    1,059
    Messages:
    1,663
    Likes Received:
    0
    Trophy Points:
    55
    With viruses in System32, it's just best to backup your files and reinstall Windows, save you trouble later if you happen to "accidentally" remove an important file.
     
    Joel, May 30, 2010
    #4
  5. Polarix

    Polarix Notebook Evangelist

    Reputations:
    148
    Messages:
    600
    Likes Received:
    0
    Trophy Points:
    30
    Polarix, May 30, 2010
    #5
  6. gerryf19

    gerryf19 I am the walrus

    Reputations:
    2,275
    Messages:
    3,990
    Likes Received:
    0
    Trophy Points:
    105
    There is no description of your hardware or your OS in your post. It is impossible to give you give you good advice.

    iastore.sys is an intel storage drive used by sata drives and RAID setups. Without it, your computer will not run (if it is an sata or raid based system)

    It could be a false alarm, but it could be real. Are you noticing any odd behavior? Have you run any other software to try and confirm (try gmer)

    I have run into many infected machines where infected drivers result in odd behavior--specifically search engine redirection.

    The solution is to replace the file with a known good file. How that is done depends on your level of expertise and resources.
     
    gerryf19, May 31, 2010
    #6
  7. perrin_aybara

    perrin_aybara Notebook Consultant

    Reputations:
    183
    Messages:
    185
    Likes Received:
    3
    Trophy Points:
    31
    Upload your file to 'virustotal.com' before you start reinstalling, deleting and removing things. This will identify if this is indeed a virus.
     
    perrin_aybara, Jun 1, 2010
    #7
  8. Joel

    Joel coffeecoffeecoffeecoffee

    Reputations:
    1,059
    Messages:
    1,663
    Likes Received:
    0
    Trophy Points:
    55
    Yes, try this. I don't know why I didn't think of it!
     
    Joel, Jun 1, 2010
    #8