Does CCE load any temporary sys driver during the scan?
On Win7 the DriverView tool [DriverView: Loaded Windows Drivers List] reports a driver with .sys loaded from Windows/System32/Drivers. this file does not exists. it disappears after second reboot after scan (first need for CCE).
That doesn’t seem something from CCE.
Fortunately, CCE comes with amazing KillSwitch tool!
To see if Killswitch can help locate that driver, please see enclosed snap.
Find “System” in “Processes” , right click on it and select “Properties” and then go to “Modules” tab and find that driver and right click on that and select “Open Containing Folder”.
Please see if that helps.
Thanks
-umesh
Yes, I used it and other tools. The driver is dynamically loaded at runtime. I suspect CCE. Because it only happens during the CCE scan.
GMER is loading driver for scan too but at least it shows this driver as “…(GMER)” in own list.
Could you check with CCE developers on that?
CCE loads ccekrnl.dat which driverviewer can show as seen in the attached report. Note remove the .txt extension.
Yes and this driver file is present in CCE folder.