|
BDGuard.sys
Recently I received a message from a user.
He complains about Hacktool Rootkit detected by Norton on his computer.
The file has name "bdguard.sys" and it is located in the c:\windows\system32\Drivers.
I checked his log file and I found the driver is not a hidden rootkit.
It can be successfully deleted from the disk and from registry without problems.
But it is appeared again after reboot.
I tested log file again and googled for bguard.sys.
I make a guess that bdguard.sys make be related to Baildu toolbar (http://www.baidu.com).
Baidu Toolbar has the uninstaller and my client successfully used it.
Conclusion
- If you agree with Bauidu license agreement - no problem.
If not, use its uninstaller to correctly remove from a computer.
- The Norton's name "Hacktool Rootkit" describes the wide range of the programs used the kernel driver.
Anyway it is not a hidden rootkit and it can be removed by deleting it from Windows startup.
|
RegRun Security Suite
