|
Posted by =?Utf-8?B?YWxhbiBhcm5vdHQ=?= on July 23, 2008, 8:34 am
If you were Registered and logged in, you could reply and use other advanced thread options
While looking into system perfomance, i found a folder with 400,000+ 384 byte
files, each with a guid as filename. there is one other file alongside folder
s-1-5-19 called CREDHIST
the folder is c:\documents and settings\localservice\application
data\microsoft\protect\s-1-5-19\
it shows as size 163MB, on disk 1.77GB creation date april 2008
it causes problems with search and virus scan although a dos scan reports it
and its contents to be clean. (mcafee) i alkso have windows defender
installed and it does not report any problems.
the folder i found originally was c:\documents and
settings\localservice\application data\microsoft\media
centre\protect\s-1-5-19\ but i deleted that to see what would happen and the
first named folder appeared in its place.
i am concerned that this is a trojan of some sort. however, it is possible
that it is a genuine microsoft system folder since s-1-5-19 is a localservice
id.
can anyone shed some light please?
| 
XML site map