how to find and remove DRIVER and DRIVER SETTINGS

[clever_j]

hi guys


I recently got hit by the Peacom virus.. where wincom32.sys is the culprit.. i was gettinig BSOD like ****.. after investigating, using windbg, research etc etc.... i confirmed that the BSOD is being caused by the wincom32.sys driver, which actually is the Peacom virus.. the virus itself is does not cause BSOD error by design, but KASPERSKY has killed this virus, and its files etc.. however, there seem to be a device driver instruction or setting still left in the system.. because in the BSOD the faulting module is:

wincom32.sys


I have REMOVED/UNINSTALLED this device already from the device manager, issuing first:

RUN> set dvcmgr_show_nonpresent_devices=1
RUN> dvcmgmt.msc

locating the wincom32 entry and successfully uninstalling it..

but.. IM STILL GETTING THE DARN BSOD! the debug info is still reporting wincom32.sys as the culprit..

so i searched the registries for "wincom32" entry... none found..

what's weird also is the faulting module, as shown in winDBG, is located in

\??\C:\WINDOWS\system32\wincom32.sys

take note of the highlighted..

\??\C:\WINDOWS\system32\wincom32.sys

what does that mean? where is this windows "instruction"? so i can KILL IT ONCE AND FOR ALL!

please advice. .

 

[MrCoffee]

No idea, all I can suggest is take out your system restore and delete all instances of wincom32.sys from your drive.
if you're unlucky you may have a rootkit but I don't think Peacom includes a proper rootkit but this smells of one.

try blacklight

 

[clever_j]

no instances of wincom32 anywhere on my drive, not even in my registries..annoying..

 

[Ste]

Windows Repair.
If Still. Back up info. Reformat. Reinstall.

 

[clever_j]

If Still. Back up info. Reformat. Reinstall.

yep this'd be my last recourse..

anyway, can you guys tell me atleast, where the LIST OF DRIVERS that are loaded on startup are located? an ini file? registry hive? coz i swear, if it's being loaded still, there's gotta be something there in my system that tells it to.