Core.sys Removal From XP Pro?

Q. How do I remove C:\WINNT\system32\drivers\core.sys?
LVL 1
kvnsdrAsked:
Who is Participating?
 
SheharyaarSaahilCommented:
is it a server?
i mean, it looks like from your comment that you have not restarted or ran the scan in safemode yet?
0
 
SheharyaarSaahilCommented:
get SuperAntiSpyware
http://www.superantispyware.com/

install and update it
update your antivirus program too
boot under safemode and scan your system with both of them
let them to clean your system and restart back in normal mode to check out the results.
0
 
r-kCommented:
You can also just boot from the XP CD in recovery console mode and delete the file. Or boot from the UBCD for Windows and do the same etc.

But it might be better to identify and describe the problem befoe deleting files. What are the symptoms and why do you want to delete just this one file?
0
Live Q & A: Securing Your Wi-Fi for Summer Travel

Traveling this summer? Join us on June 18, 2018 for a live stream to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

 
kvnsdrAuthor Commented:
So far my research indicates it's not a Windows file.
0
 
r-kCommented:
Here are a couple of things to try:

(1) Right-click on that file, select Properties and examine date/time. Then click on the Version tab and see who created it.

(2) Submit that file to http://www.virustotal.com/ and/or http://virusscan.jotti.org/
 for analysis.

Did you try Superantispyware as suggested by S.Saahil?

It's possibly part of a rootkit. Download RootkitRevealer from http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx and scan your hard drive. Save the resulting log to a text file because you may need it later. Copy-and-paste it here if anything interesting. If the log is very long then just post the first 30 lines or so.
0
 
kvnsdrAuthor Commented:
So far no good, looks like I'll need to reboot and manually delete it.
0
 
kvnsdrAuthor Commented:
It's an Windows 2000 Workstation.
0
 
SheharyaarSaahilCommented:
okk....so we can still try the safemode removal with it....can't we? :)
0
 
kvnsdrAuthor Commented:
I'm going to the client sometime soon and let you know...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.