Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Questionable File?


  • Please log in to reply
9 replies to this topic

#1 ajshark

ajshark

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:59 PM

Posted 29 January 2009 - 04:08 AM

Hello all! This is my first post on the bleeping computer site. Looking for some help determining what this mysterious file may be... or what it may be a part of.
I saw a strange file in my C:\Windows folder (not the system32 folder) that was named "system32". I know it may seem obvious, but I don't think it's a legitimate file. The file has no extension, and also has an internal name of "ntdll.dll"...?
I also ran Filealyzer on the file and saved the report. I was able to easily remove the file to a USB flashdisk without any trouble from my system. Almost like it was a leftover file from... something. I'd like to get some opinions if you will.
Like I said.. no problems from removing it. No virus detection, no spyware detection, or anything. But something smells funny. If you would like me to upload the actual file just let me know. Otherwise I'm just attaching the filealyzer report.

Thanks for any help you can provide. It may help to uncover something more sinister.

Attached Files



BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:03:59 PM

Posted 29 January 2009 - 12:37 PM

Try submitting the file for a jottiscan
http://virusscan.jotti.org/
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 ajshark

ajshark
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:59 PM

Posted 29 January 2009 - 04:04 PM

Thanks for that. I'm in the process of that now. I'll let you know what it says.

#4 ajshark

ajshark
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:59 PM

Posted 29 January 2009 - 04:17 PM

The results showed nothing. This is all I got from the site...
Copy/Paste:

Service load: 0% 100%

File: sytem32
Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: bb5cbffc096497506167bce1d9690ef2
Packers detected: -

This is a mystery because I know there should not be a file called ' system32 ' in my C:\Windows folder.
Also forgot to mention my comp. specs. They are as follows:

Operating System Microsoft® Windows XP Professional
Manufacturer Dell Inc.
Model Removed
Serial Number Removed
Asset Tag
Number Of Processors 1
Processor Description Intel® Core™2 CPU T7600 @ 2.33GHz
Total Memory 2048MB
Total Hard Drive 186GB
Display 1920 x 1200 pixels, true colour
BIOS Version DELL - 27d7061b Phoenix ROM BIOS PLUS Version 1.10 A07

Edited by Orange Blossom, 09 February 2009 - 09:56 PM.


#5 ajshark

ajshark
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:59 PM

Posted 02 February 2009 - 05:25 PM

could a moderator remove the Serial Number from this Quote. Thanks!

~ Removed as requested. ~ OB

Edited by Orange Blossom, 09 February 2009 - 09:58 PM.
Remove unnecessary quote. ~ OB


#6 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:01:59 PM

Posted 03 February 2009 - 12:13 AM

could a moderator remove the Serial Number from this Quote. Thanks!


You should be able to go back to your post and edit it to remove that serial number from your post. I see that even tho it was removed from the quote, it is still there in the post that you originally posted the serial number in.

Edited by Stang777, 03 February 2009 - 12:15 AM.


#7 ajshark

ajshark
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:59 PM

Posted 09 February 2009 - 05:55 AM

I tried, but didn't see a way to edit the original post. If I missed something I'm sorry. NEWBY you know!

#8 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,264 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:12:59 PM

Posted 09 February 2009 - 06:02 AM

If I remember correctly you must edit your post within the first twenty four hours.

You might wish to PM a moderator and ask them to delete this. If you scroll down to the bottom of the forums page and click on moderator a list of them will appear. Click on the name of the moderator you wish and the choice to send a message will be one of the options in the drop down menu.

Edited by dc3, 09 February 2009 - 06:06 AM.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#9 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,264 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:12:59 PM

Posted 09 February 2009 - 06:13 AM

Use the link below to go to the forums page and follow the instructions that I posted previously.

http://www.bleepingcomputer.com/forums/

Edited by dc3, 09 February 2009 - 06:20 AM.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#10 ajshark

ajshark
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:01:59 PM

Posted 09 February 2009 - 06:21 AM

http://www.bleepingcomputer.com/forums/


I found it. Thanks alot. Your a great help!
Becha couldn't help out with the file problem that I have now could you? HA!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users