keyboard.sys and mouse.sys in loaded drivers - How to delete them?

[Rakanoth]

There are two sys files (which are usually drivers AFAIK) in my system32\drivers folder. I don't know how they these two files were installed on my system. I might have put them there as I was trying to develop a mouse statistics program.

 

I cannot delete them. I tried to delete them in safe mode but I could not.

I can see these two drivers loaded in my system on DriverView (https://www.nirsoft.net/utils/driverview.html). I am attaching a screenshot:

https://i.imgur.com/BlaaQWX.png

 

I tried various programs such as Erase (https://eraser.heidi.ie/) and IOBit Unlocker (https://www.iobit.com/en/iobit-unlocker.php) but I haven't been able to delete them.

I cannot find them in the output of "sc query" command.

Any idea how I can delete them?

[Radium_Angel]

34 minutes ago, Rakanoth said:

Any idea how I can delete them?

Why do you want them gone?

[Rakanoth]

1 minute ago, Radium_Angel said:

Why do you want them gone?

They don't seem to be needed anymore. Are they related to the any hardware I use? I don't think so.

[Radium_Angel]

5 minutes ago, Rakanoth said:

They don't seem to be needed anymore. Are they related to the any hardware I use? I don't think so.

.....Do you not use a keyboard and mouse?

[Rakanoth]

1 minute ago, Radium_Angel said:

.....Do you not use a keyboard and mouse?

Yes but these sys files aren't from Logitech or Microsoft. Just because their name are mouse.sys and keyboard.sys doesn't necessarily mean these files are there for the mouse and keyboard to work properly.Or maybe they are necessary. That's why I am asking. Look at from which company they are from. It says "Oblita".

[Radium_Angel]

12 hours ago, Rakanoth said:

Yes but these sys files aren't from Logitech or Microsoft. Just because their name are mouse.sys and keyboard.sys doesn't necessarily mean these files are there for the mouse and keyboard to work properly.Or maybe they are necessary. That's why I am asking. Look at from which company they are from. It says "Oblita".

You can wipe them out using a bootCD (like a linux environment) but if Windows won't let you remove them, there's probably a good reason for that. Unless you have a rootkit...

 

[Radium_Angel]

12 hours ago, Rakanoth said:

Oblita

BTW...this may be of some use

http://www.oblita.com/interception.html

 

[Rakanoth]

I was not even able to remove in Safe Mode. So, I tried to remove them by tampering with their registry entry. But after then my keyboard and mouse completely stopped working and as a result of them not working I was not able to login into my Windows account. So, I have done a Windows repair with a windows installation disk. After the windows repair, the drivers were still there and they were loaded into the windows.

 

I started researching how to remove them on google. On their Github repository, I came across the following issue:

https://github.com/oblitum/Interception/issues/79

 

So I downloaded the latest release and executed the following command: "install-interception.exe /uninstall". After I executed the command and restarted my system I saw it did not do the rick either. So, I installed the Interception by launching install-interception.exe. Then I restarted and then I uninstalled with "install-interception.exe /uninstall" again. After all this, the driver has been successfully removed.

[homeap5]

Do you have system installed on old 20GB drive that is slow and have very limited space? No? Then leave that tiny files and focus on more interesting things. Paranoid in cleaning is the best way to destroy your system.

 

System do not use drivers when there is no hardware.

[Rakanoth]

On 6/19/2019 at 11:36 AM, homeap5 said:

Do you have system installed on old 20GB drive that is slow and have very limited space? No? Then leave that tiny files and focus on more interesting things. Paranoid in cleaning is the best way to destroy your system.

 

System do not use drivers when there is no hardware.

I don't want drivers to be loaded when I have no idea what they are doing. You should not keep such drivers in your system either. Drivers can be abused by malware.