iqvw64e.sys identified as a threat
Posted: 16-Aug-2018 | 1:47AM · 7 Replies · Permalink
I have used NPE a few times and often it flags up iqvw64e.sys as a threat. Sometimes it successfully removes this and other times fails. I am obviously concerned from what I have read that there really is a piece of malware hiding in this file. On the NPE report it has no details on the file. I have searched the c drive for the file and found it in 3 places:
c:\ProgramFiles\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.6992.1236
c:\ProgramFiles\Dell\SupportAssist
c:\Apps\334CH\includes\aa\internal
I used VirusTotal to scan each which reports them as clean. I an not hugely IT literate so would value any feedback about how reliable these results might be.
Re: iqvw64e.sys identified as a threat
Posted: 16-Aug-2018 | 11:15AM · Edited: 16-Aug-2018 | 11:25AM · Permalink
Hi Calvin5:
There are multiple threads in this forum about Norton Power Eraser (NPE) detecting iqvw64e.sys as a possible threat on Dell computers - see frankwich32's June 2018 thread iqvw64e.sys identified as threat for one example. More information about the Intel Network Adapter Diagnostic Driver file iqvw64e.sys (the 64-bit Intel QV Windows Module E) can be found at https://www.file.net/process/iqvw64e.sys.html.
Please note that the NPE is a very aggressive scanner that is designed to be used as a rescue tool in emergency situations when your operating system becomes unstable or you believe you have deeply embedded malware that cannot be detected by a standard antivirus / anti-malware scan. The NPE is prone to false positive detections and can sometimes remove important system files and registry entries (see Larry_A's thread Ran NPE and Now Computer Won't Boot to Windows for one example), and most users in this forum generally advise against using this tool for routine scanning. From the main Norton Power Eraser Tutorials page:
If you submit your iqvw64e.sys file to Symantec for a false positive analysis at https://submit.symantec.com/false_positive/ as SoulAsylum suggested then they should be able to give you a definitive answer if this is a legitimate Intel driver used by your Dell Support Assistant software or malware trying to disguise itself as iqvw64e.sys. You said you already uploaded the file to VirusTotal.com site (https://www.virustotal.com/#/home/upload) for a second-opinion scan, and VirusTotal has an excellent reputation for detecting suspicious files and is frequently recommended in this forum. VirusTotal will scan the digital signature (the file's unique SHA-256 or MD-5 hash) with ~ 70 different antivirus scan engines (e.g., Bitdefender, Kaspersky, McAfee, Symantec/Norton, etc.). A VirusTotal rating of 2/67, for example, would mean that only 2 of 67 antivirus scan engines flagged your file as suspicious / malicious and you could be relatively certain that your file was safe.
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Premium v22.15.0.88