Hidden files?

Discussion in 'malware problems & news' started by AndyXS, Jul 7, 2009.

Thread Status:
Not open for further replies.
  1. AndyXS

    AndyXS Registered Member

    Joined:
    Mar 17, 2009
    Posts:
    44
    Anyone any idea what these hidden files are?


    C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-0.C7483456-A289-439D-8115-601632D005A0

    C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-1.C7483456-A289-439D-8115-601632D005A0
     
  2. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Hi, good question ?

    I found both those files in this Vista PC a few days ago. I was going to post about them, and the following info, but after my Vista RK experience, i decided not to. Anyway as you've now got these, i'll post with what i've discovered.

    -

    Using Winpatrol's Hidden files i found this

    MSFT_USER_WPDFS_01_00_00.WDF

    Looked strange, so i Googled and found lots of entries, all bad !

    Decided to run ComboFix but before i did, i did a few online scans with, ESET and Symantec which found nothing.

    Ran combofix, and along with ALL the System restores, the following was detected and deleted c:\windows\system32\AVSredirect.dll

    Since then i've discovered this about AVSredirect.dll https://www.wilderssecurity.com/archive/index.php/t-195771.html

    Part of SUPER media player i downloaded several days ago, so not connected at all. It didn't flag MSFT_USER_WPDFS_01_00_00.WDF i've now uninstalled Super.

    Found that, and another in System32/Drivers

    MsftWdf_Kernel_01007_Inbox_Critical.Wdf

    103C_HP_CPC_KX752AA-ABU SR5501UK_YC_0Pres_Q3CR824_E83WEv3PrA1_49_IBoston_SMSI_V1.0_B5.08_T080430_WUH1_L409_M1013_J160_7Intel_8Celeron E1200_91.6_#080902_N10EC8136_Z_G808629C2_OTSSTcorp CDDVDW TS-H653Q ATA Device.MRK

    And these in System32

    7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

    7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

    The first one looks like some PC identifier, but what the heck is it doing in in Drivers ? Ever seen a Driver with such a long name before ?

    And the other two, really long names too ?

    So if anyone can identify any/all the above, i would be very grateful.
     
  3. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Related to Microsoft's Product Activation, encryption container.
     
  4. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Meriadoc

    What, all the ones i listed as well, or just these 2 ?

    C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-0.C7483456-A289-439D-8115-601632D005A0

    C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-1.C7483456-A289-439D-8115-601632D005A0

    Thanx
     
  5. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Sorry StevieO I was replying about the same time as yourself...those 2 yes.
     
  6. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Meriadoc

    Aha.

    Any ideas about the others ?
     
  7. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Can you open the .mrk file in notepad? Does the contents tell you anything?

    .MRK file could contain information for the hardware, or peripheral/device.
    .WDF MSFT function driver?
     
  8. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Meriadoc

    Yes, i made a copy and changed the extension to .txt

    It lists things connected with, Processor, BIOS, ComputerSystemProduct,Vendor, VideoController,DriverVersion etc etc.

    Msft_User_WpdFs_01_00_00.Wdf = Zero Bytes so nothing in there.

    All that's in the 3 Byte MsftWdf_Kernel_01007_Inbox_Critical.Wdf is the letter a

    Obviously nothing to worry about, but they never showed up before, and there have been no hardware/driver etc changes, so ?

    Thanx for responding.
     
Loading...
Thread Status:
Not open for further replies.