Strange file in C:\Windows

[pwr]

Hi,
I'm using the RTM with the good hash, and I just noticed a file in c:\Windows, named:

˜øª

It contains:

[KeyList]
Count=0

Anyone else have this? It seems to have been created on the date that I installed.

 

[zigzag3143]

Hi,
I'm using the RTM with the good hash, and I just noticed a file in c:\Windows, named:

˜øª

It contains:

[KeyList]
Count=0

Anyone else have this? It seems to have been created on the date that I installed.

Wher did you get the image, and were any language packs used?

Ken

 

[pwr]

Wher did you get the image, and were any language packs used?

Ken

Image was the x64 Zukona, with the hash matching the technet post.

No language packs installed, although I use danish input language.

 

[masterB]

It looks strange. I don't have that file.

 

[pwr]

Weird indeed. I might try a reinstall just to see if it pops up again.

 

[pwr]

Sorry for getting back so late! The file is not present upon reinstalling. I will keep a lookout for it, as it may have appeared after I installed a program (haven't installed them all yet).

I am getting another strange behaviour though (lol). The first time i press the "show desktop" button next to the clock, after the system has booted up, it plays the windows startup sound. =)

 

[visy199]

Did you scanned your pc for viruses?

 

[pwr]

There's no viruses unless they are included in official drivers etc. That's all I've installed. OS and drivers, messenger, firefox and addons (noscript, adblock).

Edit: Doing a scan with Mbam now, will do one with avira next.

 

[copernicus]

You could have a virus in some of your personal files.

 

[pwr]

True, but I have not even touched any of them, they are on a seperate drive =)

The scan is still running.

Edit: well nothing with mbam, avira won't update (slow as hell, trying to work it out)

 

[Antman]

Those characters are your language packs translation of a code page that you do not have installed. AFAIK, the only way to correctly translate them is to install the MUI for the original language. I would try Russian, then Chinese.

 

[poin2]

I'd look in Control Panel-> Programs and figure out what else you installed then.

It's likely some natural thing that came in with something else you installed.

Every now and then over the months/years I've had things like that show up (often in C: instead of C:\Windows), but I can usually trace them to a particular install, as though it left a log file behind or didn't put it in the right place.

And I had the desktop sound thing happening too -- both when I went to the desktop via my middle mouse button (programmed for it), and via that right corner thing, and via Windows-D. Don't think it's happened since testing the current updates that are out there though. Was happening very consistently prior.

 

[Snufffed]

I am getting another strange behaviour though (lol). The first time i press the "show desktop" button next to the clock, after the system has booted up, it plays the windows startup sound. =) - (There's no viruses unless they are included in official drivers etc. That's all I've installed. OS and drivers, messenger, firefox and addons (noscript, adblock).

From the two files you say (i'd lke to see if SNIP) I'd have to say your DL is infected.
Its not a clean install with all the extras. and could you post your HASH CK not some What it should be hash ck.

 

[Muad Dib]

I saw it in my v7232 installation and deleted it.

Just checked and now it's filename is:

(+^

with contents:

[KeyList]
Count=0

Has not appeared in my Retail 7600 Technet install yet. But I have not finished re-installing all the apps.

Looks like temp trash to me. Did not hurt anything when deleted as far as I know.

 

[swarfega]

hmm i have a file called ¸úÑ with the same content.

@pwr: did you activate your copy of windows?

 

[pwr]

Thanks for the replies guys! Glad to hear that I'm not the only one who had the weird sounds

As for the weird filename, it has dissapeared now, even though I do use danish input formats (but english language).

I did not activate it, and I don't have plans to use any loaders etc. I'll prolly test it for the full 120 days and then decide if I wanna get a copy.

The hash of my iso is the same as the technet:

SHA-1: 326327CC2FF9F05379F5058C41BE6BC5E004BAA7

And I just checked the iso again it it matches.

I might just reinstall again, just to see if the weird startup sound issue goes away =)

Snuffy: I'll try dling each driver/messenger from the source. I MIGHT have installed them from another drive from the last time I dled them, which increased the chance that they were infected.

Edit: Just noticed something. In task manager when I click on show processes from all users - 2 "dllhost.exe COM SURROGATE" entries appear, and then quickly dissapear. This might be nothing more than having to do with loading the taskmanager or something - but did look suspicious. Does anyone else have that? =)

 

[Snufffed]

Edit: Just noticed something. In task manager when I click on show processes from all users - 2 "dllhost.exe COM SURROGATE" entries appear, and then quickly dissapear. This might be nothing more than having to do with loading the taskmanager or something - but did look suspicious. Does anyone else have that? =)

That should be OK

 

[pwr]

That should be OK

I thought so =)

 

[pwr]

Antman: From math to mcdonalds, that's quite a leap =)

 

[swarfega]

and not necessarily in the right direction