Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Suspicious office docs in Windows system folders


  • Please log in to reply
3 replies to this topic

#1 humbledude

humbledude

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 28 February 2014 - 03:07 PM

Hello,

 

I hope someone can help me. I found these files below. I'm concerned about their legitimacy. 
 

MsolrmProtector.ppt 

MsolrmProtector.doc 
MsolrmProtector.xls 

I searched online and found nothing. All 3 above are unreadable and repeated in each of these system folders below:

 

C:\Windows\SysWOW64\MSDRM

 

C:\Windows\System32\MSDRM

 

C:\Windows\WinSxS\amd64_microsoft-windows-r..ement-client-v1-api_31bf3856ad364e35_6.3.9600.16384_none_d8bbfce3673b985a

C:\Windows\WinSxS\amd64_microsoft-windows-r..ement-client-v1-api_31bf3856ad364e35_6.3.9600.16383_none_d8bafe7f673c7c3a

C:\Windows\WinSxS\x86_microsoft-windows-r..ement-client-v1-api-(there are 5 more similar system folders, each with one of the 3 files I found. I could barely sit still long enough to type these and I can't cut and paste from the log I found them in.)

 

The PC has Windows 8.1 Pro x64, Office 2010, AVG Internet Security Edition 2013 and SpyBot.

 

Thanks



BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,264 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:06:41 AM

Posted 28 February 2014 - 04:50 PM

You can submit files to be scanned by 40+ security programs at VirusTotal - Free Online Virus and Malware Scan

Keep in mind that one or more of that many scanners could report a false positive result. Let us know if anything is found. Copy and paste results.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 humbledude

humbledude
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 03 March 2014 - 05:44 PM

I found it.

A Serif font, and my eyeglasses, would have helped. B)

It's MsoirmProtector, not MsoLrmProtector

http://support.microsoft.com/kb/2843630



#4 buddy215

buddy215

  • Moderator
  • 13,264 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:06:41 AM

Posted 03 March 2014 - 07:55 PM

Good.....thanks for letting us know....happy surfin'...


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users