Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

keep finding ntuser.dat in C:\programdata folder


  • Please log in to reply
2 replies to this topic

#1 angelo1911

angelo1911

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:42 AM

Posted 18 November 2012 - 03:20 AM

I am running Windows 7 64-bit on a HP notebook and I keep seeing a ntuser.dat file in my C:\programdata folder. I think this is a fake/malware ntuser.dat file because I see this file even though the "Hide protected operating system files" option is checked in "Folder and search options". I haven't done anything out of the ordinary. Please give me your opinion!

BC AdBot (Login to Remove)

 


#2 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:42 PM

Posted 18 November 2012 - 05:14 AM

Hello :)

It's a legit file that should not be deleted. It's supposed to be visible. - http://technet.microsoft.com/en-us/library/cc775560%28v=ws.10%29.aspx

Edited by thisisu, 18 November 2012 - 05:14 AM.


#3 angelo1911

angelo1911
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:42 AM

Posted 18 November 2012 - 05:26 AM

Hi, thanks for responding.

The one in my C:\programdata folder is "ntuser.dat" with all lowercase letters and NOT hidden by default, but the one in C:\Users\"username" is called "NTUSER.DAT" with all uppercase letters and IS hidden by default. Windows will allow me to delete "ntuser.dat" in C:\programdata but NOT "NTUSER.DAT" in C:\Users\"username"

I'm guessing the lowercase "ntuser.dat" is a backup created by Windows 7, but I never authorized any backups.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users