My c:\windows folder has a couple of strange files: "Dõ„" and "@ù#"

[terminal157]

My c:\windows folder has a couple of strange files: "Dõ„" and "@ù#"

Without quotes, no extension. Anyone know what they are and if they're legit?

Thanks.

 

[willworrior]

They dont see legit to me. Try to do a virus search. Otherwise i recommend factory reset

 

[Bumpkin]

Windows install and updates sometimes leaves strange files behind.

If you are not having any problems, don't worry about them.

 

[tom982]

If you are not having any problems, don't worry about them.

That's exactly what malware writers want you to think. You can never be too careful when you're potentially dealing with malware.

Upload the files to VirusTotal and Mediafire:

http://www.virustotal.com

Free Cloud Storage - MediaFire

Post both links here please. Then hopefully an expert will be able to assist you Results dependent.

Tom

 

[Layback Bear]

Well if in question of those things run a complete updated scan with your anti virus.
My computers don't have such things.

 

[Bumpkin]

I just assumed anyone with enough smarts to post on this forum would have already run several anti virus and malware scans!

I suppose it's better not to assume anything!

 

[karlsnooks]

Without quotes, no extension. Anyone know what they are and if they're legit?

Thanks.

Welcome to SevenForums.

Follow this procedure to truly cleanse your computer:

HOW TO USE MICROSOFT'S OFFLINE MALWARE REMOVER
Windows Defender Offline
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.
· is a free standalone, bootable malware and virus remover from Microsoft.

Download Windows Defender Offline (about 785 kB)
You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.


INSTALLATION:
· Requires an Internet Connection.
· Insert 512 mB or larger USB stick into a usb port.
· Run the downloaded program--mssstool64.exe or mssstool32.exe
· NEXT button
· Choose the option On a USB flash drive that is not password protected
· NEXT button
· NEXT button
.
The install program will:
· format the usb stick using the NTFS format.
· download less than 230 mB.
· name the USB stick WDO_Media32 or WDO_Media64
· use less than 300 mB.

How to UPDATE the Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download less than 65 mB.

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.

 

[gladson1976]

It could also be a corrupted entry in the MFT (Master File Table)

Try running this in an elevated command prompt

chkdsk c: /f /v

(You may have to restart the system for the disk check to start)

 

[karlsnooks]

gladson,
since to good ol' dos days, chkdsk has evolved:
CHKDSK [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]] [/B]


volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
filename FAT/FAT32 only: Specifies the files to check for fragmentation.
/F Fixes errors on the disk.
/V On FAT/FAT32: Displays the full path and name of every file
on the disk.
On NTFS: Displays cleanup messages if any.
/R Locates bad sectors and recovers readable information
(implies /F).
/L:size NTFS only: Changes the log file size to the specified number
of kilobytes. If size is not specified, displays current
size.
/X Forces the volume to dismount first if necessary.
All opened handles to the volume would then be invalid
(implies /F).
/I NTFS only: Performs a less vigorous check of index entries.
/C NTFS only: Skips checking of cycles within the folder
structure.
/B NTFS only: Re-evaluates bad clusters on the volume
(implies /R)

The /I or /C switch reduces the amount of time required to run Chkdsk by
skipping certain checks of the volume.

==================================
His disk will be NTFS formatted and not FAT fomatted.

The /R includes /F. End result: CHKDSK C: /R to check the C: drive.
============================================

Let's await the results of the offline malware scan.

Then running chkdsk never hurts anything.

karl

 

[terminal157]

Hey, thanks for the replies folks. I have run scans with no hits. I tried opening the files in notepad (should've tried this before posting, sorry) and to my surprise they both seem to be text files with only this inside:

[KeyList]
Count=0

Which gave me something to google, and it turns out I'm not alone. It's been posted about in this very forum. The file names are always different and no one seems to know where they come from. The files themselves appear harmless and I see no other signs of a compromised system, so I'm not sure what to think. :huh:

 

[karlsnooks]

Did you run Windows Defender Offline? Yes or No.

 

[mike1977]

It's named ø’ on my computer. According to Programs and Features, the only thing that was installed on the date of this file was Microsoft SQL server 2005 Compact Edition [ENU].