Suspicious file in C:\Windows?

I just have no idea what this is. No extension or anything. No strange processes going on and nothing's really wrong with my computer though. I was thinking it could have been an orphaned file or something from a chkdsk that may have ocurred when my father had restarted the computer one morning (and I'm guessing he hadn't skipped the chkdsk, which I was too lazy to disable upon startup).

Just wondering if I could get some closure here, thanks.

Windows 7 x64 Home Edition, running Avira, Teatimer, have done scans with MBAM and SAS.

Can you post the scan results of MBAM and SAS?

Can you post the scan results of MBAM and SAS?

I don't have the logs readily available. But I assure you that the MBAM one was clean and the SAS one had only the standard tracking cookies.

Should I try opening up the file in notepad?

Edited by Geordi, 21 February 2011 - 04:09 AM.

yes open the file up in notepad it is located in the logs tab on MBAM and not sure in SAS.

yes open the file up in notepad it is located in the logs tab on MBAM and not sure in SAS.

Well, I was actually referring to the file mentioned in the original post. As it has no extension, was wondering if i should attempt opening it with notepad just to see.

I just rescanned with MBAM and nothing was found, you can take my word that the SAS was just cookies.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5828

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/21/2011 4:24:01 AM
mbam-log-2011-02-21 (04-24-01).txt

Scan type: Quick scan
Objects scanned: 165174
Time elapsed: 3 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Is there any information under the other tabs?

-- Note: If you cannot see the file extension, it may be hidden and you will need to reconfigure Windows to show extensions for known file types.

Anytime you come across a suspicious file for which you cannot find any information about, the file has a legitimate name but is not located where it is supposed to be, or you want a second opinion, submit it to one of the following online services that analyzes suspicious files:

• Jotti's virusscan
• VirusTotal
• VirSCAN

In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis.

Edited by quietman7, 21 February 2011 - 07:55 AM.

Also can you perform a full scan using SAS and MBAM, a quick scan may not have scanned that area of the Windows Directory.

Apparently it's just some text file left over from an old virus according to some comments at virus total.

http://www.virustotal.com/file-scan/report.html?id=4dd8aaa8bd9f90459d4dc82aeddf5dcd439a7cd27b70a067e2c6ca904c717c83-1298153447

This would make sense considering when i last cleaned up a virus. I'm gonna go ahead and guess that this is safe to delete then? I'll run an ESET later tonight too, I suppose.

Edited by Geordi, 21 February 2011 - 04:02 PM.

Let ESET Run, and see if it detects it. What virus did you remove?

Let ESET Run, and see if it detects it. What virus did you remove?

http://www.bleepingcomputer.com/forums/topic354998.html/page__p__1982559#entry1982559
http://www.bleepingcomputer.com/forums/topic363051.html/page__p__2032634#entry2032634

But as you can see, somehow this file in the windows directory hasn't popped up until sometime this month. Quite strange.

I really haven't had any computer problems since those threads. Only thing was some hiccuping graphics which was fixed through updating the video drivers.

Should be noted too that none of the virus scanners at virus total detected anything malicious in the file. Just going off the words of 2 people that it is a text file from a malware. The file itself doesn't seem to be malicious though.

Edited by Geordi, 21 February 2011 - 04:23 PM.

You know it may be worth it to see if there are other remnants by having the Malware Team take a look at it.

If you want to take that route, then Please follow the instructions in ==>This Guide<==.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include the link to this topic in your new topic and a description of your computer issues and what you have done to resolve them.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

Once you have created the new topic, please reply back here with a link to the new topic.

Okay, I may do that.

Just to let you know, I found an old bleepingcomputers thread and the guy had the same md5 file with a different filename and they just advised him to delete it. (http://www.bleepingcomputer.com/forums/topic373606.html)

I may run an ESET overnight and do as you suggested, not sure though. Just ran a fully updated MBAM full scan and it found absolutely nothing. Here's the log.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5832

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/21/2011 9:35:01 PM
mbam-log-2011-02-21 (21-35-01).txt

Scan type: Full scan (C:\|)
Objects scanned: 480264
Time elapsed: 1 hour(s), 28 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)