Application Driver Auto Removal Service (01)

[KrautzFergen]

Hi, first post.  Greetings to BV and hello everyone.  I can't figure what this is..

Application Driver Auto Removal Service (01)

"This service automatically uninstalls Application Driver after the last application used the driver is uninstalled. After the driver is uninstalled, the service uninstalls itself as well. If an application requires Application Driver is reinstalled, the driver as well as this service will be also reinstalled at the first run of the application. This service is not constantly operating, and does not use memory. It is launched automatically on operating system startup and unloads itself from memory after completing all tasks described above."

(appdrvrem01.exe svc)

It's free of malware..

   Little help, anyone?

~Krautz

[couttsj]

The only information I could find is that it is a backdoor trojan:
http://www.greatis.com/appdata/d/a/appdrvrem01.exe.htm
It supposedly has been around since June 30, but none of the majors list it. Where did you get the file? I suggest that you submit it to VirusTotal for analysis.

J. A. Coutts

[KrautzFergen]

I've submitted it to every online scanner that I know of, including VirusTotal.  It's supposedly clean.  It popped up >2 weeks ago.

[couttsj]

The fact that the only information I could find suggested that it was a virus (90% of it in a foreign language), and nobody lists it as a legitimate file, would tend to suggest that it actually is a virus. I would strongly recommend that you get rid of it.

J.A. Coutts

[couttsj]

Further research indicates there is an associated file that goes along with the exe file:
C:\Windows\system32\Drivers\appdrv01.sys
C:\WINDOWS\system32\appdrvrem01.exe

All research indicates that it is a backdoor trojan, and none of the AV vendors are able to detect it, although some suggest that it is suspicious. The infected computers were all cleaned up with HiJackThis.

J.A. Coutts

[KrautzFergen]

Thanks for your input.  Its service description alone is highly suspicious.  I'm taking care of it now.