Rootkit Removal - Mystery File

After running AVG's Anti-Rootkit Free it detected a "hidden file". The rootkit path is C:WINDOWS\system32\com1. C:WINDOWS\system32\com1 has also been listed after defragmentations as being a 150 KB "unmovable file". Is it friend or foe?

Needless to say, it hasn't been identified as a threat by my other anti-virus and anti-malware applications.

AVG's Anti-Rootkit's standard warning message about running the risk of not being able to reboot after removing a rootkit, if that is what this thing is, has me a little concerned. Can be safely removed?

Thanks for your time.

 

Hi hrothgar,
Welcome to the Malware Forum!

There are many hidden files on the computer and most of them are legitimate. This may be for the com1 port. You might run a couple more rootkit scans at the Alternate Scans and see what kinds of information they pick up. There may be one that would identify it better.

abri

 

Thanks abri, it could indeed be legit although I haven't yet been able to identify what its function is. Strangely, the file can't be located through "search" (XP Professional) but its presence/existence has always been indicated after defrags as an unmovable file.

 

Okay hrothgar,
I don't know if you read the link Chaslang posted, but I believe he is suggesting that you run Trend Micro's online scan called Housecall. You can find a link to that at the Alternate Scans by scrolling down to the Free Online Scanning tools. That particular scan is the last one in the list. Let me know what you come up with.
abri

 

OK, I ran a second scan with Panda because I couldn't get Trend Micro to install. Panda also identified an "unknown" rootkit using file path C:WINDOWS\system 32\com4.rnx exactly as AVG had. It gave me an option to "clean" (without warnings) so I went ahead and did so. Whether "clean" means wiping a (possibly legitimate) file or only the surgical removal of a rootkit hidden somewhere is beyond me. I ran an anti-virus scan afterwards and no threats were found. So far everything functions as it should.

My thanks to abri and Chaslang. I'll check back to see if either of you has any additional comments.