Oem17.inf -

Or, to match the original name:

You can then disable, update, or roll back that specific driver.

: The “Rove” malware family (2018) used oem17.inf to install a kernel-mode rootkit on Windows 7 and 10 systems. The .inf file was poorly written, referencing a non-existent [DefaultInstall] section. Analysts spotted it because the file had no digital signature and contained hardcoded paths to C:\Windows\System32\drivers\bad.sys .

If you see strange registry keys (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Run ), unusually named files, or obfuscated strings—stop. You may have found malware.

The typical file path is: C:\Windows\System32\DriverStore\FileRepository\