What is spXX.sys (XX - random characters) driver?

Security

• Greatis

• AppDatabase

• Utilities

• Delphi/CB

• Visual Basic

• .NET

• just4fun

RegRun Security Suite
Not an antivirus. A powerful tool kit against Trojans, viruses, spyware, adware and rootkits

One-click purchase

RegRun NIVA Platinum - Rootkit Killer

NIVA+CD-ROM

More info:

Know more?

Screenshots

FAQ

On-line manual

Print PDF

Download trial

RegRun NIVA Platinum

Forums

Greatis Forum

International

Join our localization team

What is spXX.sys (XX - random characters) driver? Rootkit or not?

Recently we got a lot of questions regarding the strange drivers with file names similar to
C:\WINDOWS\system32\DRIVERS\spoh.sys
The pair characters after "sp" in the filename are automatically changed at every Windows boot.
It's very annoying problem for users because RegRun and UnHackMe detects the driver as suspicious.
The file doesn't exist on the disk.
Very strange! May it is a rootkit?
We discover the problem and found that the problem is related to well known issue SPTD.
Take a look at our article "What is SPTD####.sys?"
We made the xpbootlog.txt using our Bootlog XP software and found that there is no "spoh.sys" loaded during Windows boot-up process.
But we see the "SPTD.SYS".

But we could not see "sptd.sys" in the Drivers list.
What's happened?
The SPTD driver changed its name in the Kernel Drivers table to the "spXX.sys".
SPTD is not a rootkit.
"SPTD is a new method of access to storage devices that was developed by Duplex Secure Ltd."
SPTD driver is used by Daemon Tools software to copy/mount the protected CD/DVD disks.
The authors of the CD/DVD protection software do not like SPTD and try to prevent using of this software.
SPTD tries to deceive the protection. The war will not be finished.
Look at the SPTD FAQ how to uninstall SPTD software.

We suggest to download updated version of RegRun Suite 5.7 or higher and UnHackMe 4.7 or higher to resolve the issue.
We added the code for detecting SPTD version 1.55.

Would you like to add your opinion?

What's new?

July 3 2009
Updated RegRun Reanimator 6.0.6.43 - freeware software for detecting and removing rootkits/malware.

Look at our new malware removal tests

June 24 2009
Updated RegRun Reanimator 6.0.6.40 - freeware software for detecting and removing rootkits/malware.

June 18 2009
Updated RegRun Reanimator 6.5.6.38 - freeware software for detecting and removing rootkits/malware.

June 8 2009
Updated RegRun Reanimator - freeware software for detecting and removing rootkits/malware.

March 18 2009
Updated RegRun Reanimator - freeware software for detecting and removing rootkits/malware.

December 25 2008
RegRun Platinum Ukrainian 6.00

RegRun Platinum Russian 6.00

December 22 2008
New RegRun Security Suite 6.0 release - best toolkit against rootkits and malware.

December 8 2008
Updated RegRun Reanimator - freeware software for detecting and removing rootkits/malware.

September 8 2008
Windows Explorer Redirection DLLS is a new dangerous Windows startup hole...

September 4 2008
Updated RegRun Reanimator - freeware software for detecting and removing rootkits/malware.

August 28 2008
Updated RegRun Reanimator - freeware software for detecting and removing rootkits/malware.

July 22 2008
RegRun Platinum Ukrainian 5.80

July 18 2008

RegRun 5.8 release
Free for registered users! Download

June 5 2008
RegRun has been reviewed by 3d2f.com Software Directory: RegRun Security Suite is an excellent tool that will reliably protect you from a plethora of existing and emerging threats and will keep malware at bay.

March 7 2008
Partizan.exe is not a worm. Partizan.exe is a part of RegRun Suite, UnHackMe antirootkit. Updated. Symantec fixed false positive.

February 14 2008
Happy Valentine's day!
RegRun 5.7 released

February 11 2008
Spyware Doctor false positive. Partizan.sys wrong detection.

What is spXX.sys?

January 28 2007
Removing Medichi Rootkit

October 26 2007
Removal of Noskrnl.exe and Noskrnl.sys Rootkit (Spooldr clone)

July 25 2007
Removal Baidu rootkit (cnprov.sys)

July 24 2007
Removal Spooldr(ecard.exe) rootkit

June 25 2007
Fixing BSOD
in Winlogon Process

June 4 2007
Removal Areses Trojan

May 25 2007
Virus Feebs rootkit removal story

RegRun 5.5 beta updated

Release RegRun Reanimator 5.5.5.900

April 5 2007
What's this? Rthdcpl.exe - Illegal System DLL Relocation...

March 1 2007
Warning! Rootkit Unhooker

February 9 2007
Read our article about Unreal rootkit...

December 28 2006
Released free Rustock Rootkit(lzx32.sys) removal tool

November 29 2006
A#######.sys is a rootkit?

September 8 2006
Rootkit Removal instructions: ntsystem.exe

April 24 2006
What is BDGuard.sys?

April 17 2006
Virus or not? SPTD####.sys

March 31 2006
What is mc21.tmp, mc22.tmp, mc23.tmp?

January 19 2006
ICQCHK.exe, MSX.DLL free remover... Educational discount...

Services

Ask Computer Guys

Windows startup programs

Articles

Using Registry Tracer...

RegRun against Trojans and Viruses

Specify an order for startup programs

RunGuard prevents a launch...

Using Bootlog Analyser...

They say

"RegRun Security Suite is one of those very rare tool kits that no one who is serious about protecting their PC should ever be without. This toolkit covers all the bases when it comes to eradicating the attempted security threats from malware that we all face - daily. The near real time tech support, direct from Greatis, is nothing sort of superb, something that can be rarely said these days! I have no hesitation in recommending this suite to anyone."

Miles Pearson

Wilders.ORG. Security advisors recommend...

Testimonials

You guys are awesome!!!!
Traci www.pentagonattack911.com

Bob Schmulian:
Absolutely love it and have recommended to many people!

Ian Robinson:
It is FANTASTIC! It has saved my life on more than one occasion since I purchased it less than 6 months ago. I now would not run my system without it... it's worth many times the cost! The service and support are terrific. Helpful - friendly - and accommodating; and generally a reply is received within 12 hours. Just great.

Theodore Soucie:
Since RegRun was installed my system is more stable. I use to experience freezeup daily. I have not had a crash.

Awards

More...