mysterious aux.exe and inability to start in safe mode

[Jana McPherson]

Dear All,

I was recently alerted to the presence of a mysterious
file entitled aux.exe in my Windows/system32 directory.
The reason I noticed this file is that my anti-virus
software (Sophos) is unable to scan the file and indeed
gets stuck on it for hours. As far as I can tell from
backups, the file has been on my system since May 20 this
year. It does not seem to have done any harm so far, in
that I have not noticed any problems (other than not being
able to scan for viruses) and there are no suspect entries
in the systems registry. However, as I cannot move,
rename or delete the file, and do not know where it came
from, I am somewhat suspicious. The Sophos anti-virus
support team seems out of its depth on this. They have not
heard of this file being a virus, but think I might be
able to remove it in safe mode. The trouble is that my
computer will not start in safe mode (I get a stop error
screen). In contrast, the machine operates quite happily
in normal mode.

Has anyone else had a similar experience? Does anyone know
what aux.exe does? It does not seem to be a crucial, or
indeed authentic Windows file, since it does not appear on
other machines running windows 2000 and only exists on
mine since May. Does anyone know how to remove it? I have
tried directly selecting it in Windows explorer to
delete/move or rename it, but while I can select all other
files in the directory, the explorer freezes as soon as I
place my cursor over aux.exe . I have also tried deleting
it through command prompt with the command DEL. I then get
an error stating that the filename or syntax is wrong. I
gather this may be because aux is a reserved name in
windows. Is there any way around this?

My system operates on Windows 2000 Professional and has a
NTFS file partition.

Help would be much appreciated!

Jana

 

[Gary Smith]

Try opening a commnad prompt window and typing:
del \\.\C:\Windows\system32\aux.exe
(Note the period between \\ and \)

Another alternative is:

del "\\?\C:\Windows\system32\aux.exe"

I was recently alerted to the presence of a mysterious
file entitled aux.exe in my Windows/system32 directory.
The reason I noticed this file is that my anti-virus
software (Sophos) is unable to scan the file and indeed
gets stuck on it for hours. As far as I can tell from
backups, the file has been on my system since May 20 this
year. It does not seem to have done any harm so far, in
that I have not noticed any problems (other than not being
able to scan for viruses) and there are no suspect entries
in the systems registry. However, as I cannot move,
rename or delete the file, and do not know where it came
from, I am somewhat suspicious. The Sophos anti-virus
support team seems out of its depth on this. They have not
heard of this file being a virus, but think I might be
able to remove it in safe mode. The trouble is that my
computer will not start in safe mode (I get a stop error
screen). In contrast, the machine operates quite happily
in normal mode.

Has anyone else had a similar experience? Does anyone know
what aux.exe does? It does not seem to be a crucial, or
indeed authentic Windows file, since it does not appear on
other machines running windows 2000 and only exists on
mine since May. Does anyone know how to remove it? I have
tried directly selecting it in Windows explorer to
delete/move or rename it, but while I can select all other
files in the directory, the explorer freezes as soon as I
place my cursor over aux.exe . I have also tried deleting
it through command prompt with the command DEL. I then get
an error stating that the filename or syntax is wrong. I
gather this may be because aux is a reserved name in
windows. Is there any way around this?

My system operates on Windows 2000 Professional and has a
NTFS file partition.

 

[Guest]

Thank you Gary!

I used the \\.\ technique to rename the file ("ren
\\.\c:\windows\system32\aux.exe delme") rather that delete
it, simply because I didn't quite have the courage to
delete a file of unknown function in that directory. As
soon as I did that, my anti-virus software was able to
check the file and inform me that it was hiding a Trojan.
I am now in the process of clearing that. I hope this info
helps others who might have similar trouble.

Jana

 

[Gary Smith]

Thanks for the feedback. I'm glad the problem is solved. Renaming a file
instead of deleting it is always the safer course of action when you're
uncertain. In this case, I didn't recommend renaming because I knew that
"aux" is a reserved device name in DOS and Windows, and no legitimate file
would ever be given such a name. Any time you see a file with a name like
aux.* or con.* or prn.* you can be sure that it's nothing you want.