Jump to content



Recommended Posts

I noticed that in Device Manager, under "non-plug and play drivers", there's entry named "oreans32" with exclamation mark on it. There's exclamation mark, because i don't got file oreans32.sys on System32/drivers folder. Anyway, there's still oreans32 service entries in registry.


I read that this oreans32 might be spyware/virus. I just wonder that can i remove that entry from Device Manager and also those reg. entries?

Link to comment
Share on other sites

oreans32 is part of Themida protection




Its used in quite alot of programs such as games to prevent piracy, it is also being used by some trojans like backdoor IRCBots as they can make it alot harder for the files to be analysed by preventing people reverse engineering or dissembling the files and also by preventing them being run in a virtual environment


If you do not still have the oreans32.sys file on your system then it's fine to remove its service but make sure the file doesnt exist first as the program that added it will not start if the service is missing,


Goto Start > Run > Search

Click All Files and Folders

Then scroll down to More Advanced options and place a check next to Search system folders, Search hidden files and folders and Seach subfolders

Then scroll back up to the All or part of the file name: area and enter this to be searched for then click Search




If its found then leave the service in place but if its not then goto start > run > and type


sc delete oreans32


Press OK and you will just notice the cmd screen open then close and the service will be removed on the next reboot



Link to comment
Share on other sites

I still wonder why i got those entries, but NOT that oreans32.sys file...? Could it be that some spyware remover identified this oreans32 as spyware, and removed that oreans32.sys from my system and left those entries behind?


Also wonder why this oreans32 was installed in first place? And what installed it?


Does anyone else got this oreans32?


Quote from another forum: service named "oreans32" with driver "C:\Windows\system32\drivers\oreans32.sys" can be found in "Non-Plug and Play Drivers" section of Device Manager (You have to check "Show hidden devices".)


Screenshot from my system: http://xs315.xs.to/xs315/07195/oreans32.jpg

Link to comment
Share on other sites

Its really not possible to say what installed it but it may of been a program or game you installed at some stage then removed and it may of left the oreans32 service behind,


It's possible a spyware remover added it to their database so it was removed on your system but the file and service is harmless as its a genuine program, like alot of things though its starting to be abused by trojan writers as it also helps them to avoid being detected by Antivirus companies so some vendor may of added it by mistake.


Here's an example of a backdoor IRCbot (rBot) I got yesterday thats packed with Themida


STATUS: FINISHEDComplete scanning result of "lol.exe", received in VirusTotal at 05.10.2007, 21:56:38 (CET).


Antivirus Version Update Result

AhnLab-V3 2007.5.10.0 05.10.2007 no virus found

AntiVir 05.10.2007 TR/Agent.1376901

Authentium 4.93.8 05.10.2007 no virus found

Avast 4.7.997.0 05.10.2007 no virus found

AVG 05.10.2007 no virus found

BitDefender 7.2 05.10.2007 DeepScan:Generic.Malware.G!SKI!!FLMPWX!!BVPkprng.8F04B991

CAT-QuickHeal 9.00 05.10.2007 no virus found

ClamAV devel-20070416 05.10.2007 no virus found

DrWeb 4.33 05.10.2007 no virus found

eSafe 05.10.2007 no virus found

eTrust-Vet 30.7.3624 05.10.2007 no virus found

Ewido 4.0 05.10.2007 no virus found

FileAdvisor 1 05.10.2007 No threat detected

Fortinet 05.10.2007 no virus found

F-Prot 05.10.2007 no virus found

F-Secure 6.70.13030.0 05.10.2007 no virus found

Ikarus T3.1.1.7 05.10.2007 Backdoor.VB.EV

Kaspersky 05.10.2007 no virus found

McAfee 5028 05.10.2007 no virus found

Microsoft 1.2503 05.10.2007 no virus found

NOD32v2 2256 05.10.2007 no virus found

Norman 5.80.02 05.10.2007 no virus found

Panda 05.10.2007 no virus found

Prevx1 V2 05.10.2007 no virus found

Sophos 4.17.0 05.08.2007 no virus found

Sunbelt 2.2.907.0 05.05.2007 VIPRE.Suspicious

Symantec 10 05.10.2007 no virus found

TheHacker 05.10.2007 no virus found

VBA32 3.12.0 05.10.2007 no virus found

VirusBuster 4.3.7:9 05.10.2007 no virus found

Webwasher-Gateway 6.0.1 05.10.2007 Trojan.Agent.1376901


Aditional Information

File size: 1376901 bytes

MD5: 3bf608ac273c8df9d2dd66bd0040240f

SHA1: 6fd719fd44de5d2a55be7bdd0bebe508423f1ebe

Bit9 info: http://fileadvisor.bit9.com/services/extin...2dd66bd0040240f

Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.


If you dont have the file though just delete its service to remove it from your system as its likely just a leftover entry from a program you have used in the past if the file doesnt exist.



Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.