Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I have been infected by rootkit.win32.agent.biiu.

I boot up with 'Last Known Good Configuration' and do a full scan with Kaspersky. It catches many c:\windows\drivers\?.sys and either deleted or quarantined them.

How can I restore the original/correct .sys file? Boot with safe mode after full scan perhaps?

share|improve this question

3 Answers

up vote 4 down vote accepted

Chances are that those .sys files were just viruses, and not legitimate files. None the less, it wouldn't be a bad idea to click start, run, and type this:

sfc /scannow

It will prompt you for your Windows CD and repair any files that have recently been replaced. Be sure to re-run Windows Update after doing this.

You can find more information on this command at http://msdn.microsoft.com/en-us/library/aa382541(VS.85).aspx.

share|improve this answer
This is so useful, thanks! After sfc scan, it didn't found any thing wrong. However, I have a question for those virus .sys files. Since they are not necessary for WinXP at all, how do they get loaded or executed? Does WinXP load everything in drivers folder? Thanks. – Stan Sep 15 '10 at 7:45
1  
@Stan - the viruses place themselves in that location and arrange for themselves to be triggered (Window's shouldn't run them by default, but they'll just add themselves to the relevant lists). They do this so that people don't notice (for example, in Task Manager) and/or are scared to touch them (because they are "system" files) - it's a psycological trick against the user to reduce the chance of detection and removal. – DMA57361♦ Sep 15 '10 at 7:53
up vote 0 down vote

You could restore to a system restore point if they were confirgured to save and you have a save point that's before the virus infection, but not too old as to be painful.

share|improve this answer
up vote -1 down vote

the .sys files are compressed in the Windows CD so i dont think it can be extracted, but how about installing winxp on a virtual machine and then copy and paste the .sys files from there?

i dont think that u lost all the system files - just some files that were infected - so its not risky to replace them

share|improve this answer
You can definitely get files of the Windows disc. Easiest method is to run sfc. – Brad Sep 15 '10 at 13:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.