Replace system file in Windows 10

Rhino666

AVG has found an IRP HOOK issue with nine sub files of HIDUSB.SYS
The anti-virus software cannot remove the problem and the AVG forum has not come up with advice for me or some others with the same problem.


Is there any way to replace the HIDUSB.SYS system file to get rid of this problem?

forgotmyname

Why does it not remove them after a restart?

Get something else. Malwarebytes should work. But dont use that computer
to download it.

You will probably need to enable safe mode if not already enabled. You need to
delete the files in safe mode or before windows starts.

esuhl

You could try running the following command at an elevated command prompt:

sfc /scannow

More info at the link below:
http://www.tenforums.com/tutorials/2895-sfc-command-run-windows-10-a.html

Also, I find Avast's Rescue Disk works where other antiviruses fail. Ideally on another PC, download and install Avast (removing any other antivirus software first), then select the option to create a "Rescue Disk" -- a bootable CD or USB.
https://www.avast.com/en-gb/free-antivirus-download

Rhino666

Thanks for the replies.
I have tried a few things unsuccessfully and one included rkill and Malwarebytes but downloaded on the machine and not safe mode.
Will try your suggestions tomorrow and report back.

debitcardmayhem

there are reports (oldish) with avg and false positives https://www.google.co.uk/search?q=HIDUSB.SYS+irp+hook&ie=utf-8&oe=utf-8&gws_rd=cr

This one http://www.bleepingcomputer.com/forums/t/586158/irp-hook-rootkit-computer-slow-and-freezes/ may be helpful, but you don't say which version of Windows you are using.

As an aside I don't rate AVg but that could be just me.:cool:

esuhl

debitcardmayhem wrote: »

As an aside I don't rate AVg but that could be just me.:cool:

I used to like it, until I got sick of it giving false-positives on software I was working on.

And then, friends' PCs started getting infected with things that AVG hadn't blocked and was unable to remove.

It's definitely a lot better than not having an antivirus at all, but I prefer Avast.

paddyrg

If it's a false hit on a system file, you'll never get rid of it - Windows is self-healing, and the moment you destroy a core system file it will replace it.

Riccardos_2

HIDUSB.SYS is a USB miniport driver. I checked that file on my Windows 10 laptop and it's not digitally signed at all. It's possible that's an issue we don't need to handle, I think.