What Is Microsoft "Boot Time Removal Tool"?

Question

I'm working on a Windows 7 computer. The owner reports that they believe the computer has been infected by malware and that they had an overseas company attempt to fix the problem but that something they did rendered the computer unable to boot.

I've found a somewhat suspicious driver file named trjaaake.sys located in C:\Windows\System32\Drivers. The file was only recently created/modified although it appears to me that it was created/modified about two days after the assumed infection. Under the version tab for this file I see the following:

Description: Boot Time Removal Tool
Company: Microsoft Corporation
File Version: 1.1.16.0
Internal Name: BootTimeRemoval
Original File Name: BTR.sys
Product Name: Microsoft Malware Protection
Product Version: 1.1.0016.0

The file appears to be signed with a digital signature but I don't know how to tell if the signature is legitimate/valid.

I submitted the file to Virus Total and all 42 different antivirus engines report that the file is OK. Norton File Insight also says that this file is used by thousands of computer users and that it has been given a trusted rating.

I did find a file in C:\Windows\Temp called BootClean.log. It contains the following (I've changed the username to "[redacted]"):

Boot Time Removal Tool started
Error 0xc0000034 opening (\??\C:\Users\[redacted]\Desktop\SMART_HDD.lnk) for reparse check.
Unable to strip attributes from \??\C:\Users\[redacted]\Desktop\SMART_HDD.lnk with error 0xc0000034
Error 0xc0000034 removing: \??\C:\Users\[redacted]\Desktop\SMART_HDD.lnk 
Error 0xc0000034 opening (\??\C:\Users\[redacted]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SMART_HDD.lnk) for reparse check.
Unable to strip attributes from \??\C:\Users\[redacted]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SMART_HDD.lnk with error 0xc0000034
Error 0xc0000034 removing: \??\C:\Users\[redacted]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\SMART_HDD.lnk 
Error 0xc0000034 opening (\??\C:\ProgramData\1yfOZG3BLWgtFb.exe) for reparse check.
Unable to strip attributes from \??\C:\ProgramData\1yfOZG3BLWgtFb.exe with error 0xc0000034
Error 0xc0000034 removing: \??\C:\ProgramData\1yfOZG3BLWgtFb.exe 
Removed \??\C:\Users\[redacted]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\smart hdd\ 
BTR Completed Successfully

So I guess my question is, does anyone know what this file is? Is it maybe part of Microsoft's Malicious Software Removal Tool?

Answer 1

A good place to start might be to run sigverif - this might help validate the signature. From there, if it's signed by a company you trust, it's not likely to be your issue; otherwise, you may want to delete it.

On the other hand, once a machine is compromised, it can't really be trusted from that point on. I'd suggest backing up personal files and any other non OS-specific data, and reformatting / reinstalling the OS.

Answer 2

These files are actually dynamically created by Windows Defender. The purpose is to remove malware at reboot that infected your system.

Take a look that the properties of each file and you'll notice the names are random and they are digitally signed by the Microsoft Certificate Authority. Upon reboot the .SYS files will actually disappear once they have served their intended purpose, which is to remove malware at reboot.

THESE ARE GOOD FILES AND NOT BAD!!!