unknown file...

[RxK]

Any idea what this file is ?
C:\hdfjawja.sys
hrs flags are on.
Gogl comes up blank.
Virustotal reports nothing unusual.

...can't find my darned hex editor to see what's in it...

TIA

regards, Richard

 

[PA Bear [MS MVP]]

Why do you ask, Richard?

What anti-virus application or security suite is installed? What
anti-spyware applications (other than Defender)? What third-party firewall
(if any)?

 

[db ´¯`·.. >]

http://tinyurl.com/4zvcq5

 

[RxK]

....can anyone recommend a malware free hex-editor download, ...mine seems to
have vansiehd into thin air !

TIA

regards, Richard

 

[Pegasus \(MVP\)]

...can anyone recommend a malware free hex-editor download, ...mine seems
to have vansiehd into thin air !

TIA

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm

 

[RxK]

BiiiiIIIIIIIIg thanks Pegasus, am much obliged
.....I recognised it {..by desktop icon } ...straight aways when I
right-clicked the XVI32.exe file "Send to Desktop | Create Shortcut,"
....that's the hex editor I'd used for ages, ...well older version I suppose,
.....the I used to have - and couldn't find - how perceptive of you !

regards, Richard

 

[MAP]

Any idea what this file is ?
C:\hdfjawja.sys
hrs flags are on.
Gogl comes up blank.
Virustotal reports nothing unusual.

..can't find my darned hex editor to see what's in it...

TIA

regards, Richard

I submitted a file to virus total and came up blank as well, a week later I
resubmitted it and got several hits, something new needs time to be
discovered, try it again.

 

[RxK]

....after more time on this hdfjawja.sys file,
http://www.all-nettools.com/forum/archive/index.php/t-242.html
....seems to have one with a similar filename - the contents of the file seem
to be several strings like:-
!ATYN1FZMH4DPG3QSBU81LSO6AD0CRMF3ZTJE4VHK*

I'm wondering if it's something to do with PerfectDisk.

....regards, Richard

 

[RxK]

....after a bit more research, I'll be keeping a closer eye on BCwipe, when I
use it, I think it's this program that drops a *sys file into my boot-drive
root-directory !

regards, Richard

 

[Volodymyr M. Shcherbyna]

I'd start from decompiler rather then from hex editor. IDA Pro is an
excellent utility. If you have to chance to get it, you can at least use
Depends Walker to see the import table of driver to analyze in general what
it does.