1

Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp:

Area:        Local hard drives
Description: Unknown hidden file 
Location:    C:\Windows\System32\ndptsp.tsp
Removable:   Yes (but clean up not recommended for this file)
Notes:       (no more detail available) 

Doing a Google search for the term, it shows me hundreds of auto-generated, useless pages.

My question is:

Is this something to worry about or is this simply a false-positive which I can safely ignore?

1 Answer 1

2

It might have been a false positive with "ndptsp.exe", which is normally used by a worm.

The real ndptsp.tsp is a Windows binaries, as per the explanation on it below:

NDPTSP NDPTSP ( Ndptsp.tsp) is a service provider DLL that runs in the context of the TAPI service process. NDPTSP provides a TSPI interface that the TAPI service presents to TAPI-aware applications so that NDPROXY can communicate with user-mode applications. NDPTSP works with NDPROXY to convert user-mode requests to TAPI connection-oriented OIDs (OID_CO_TAPI_ Xxx). For more information about TAPI connection-oriented OIDs, see TAPI Extensions for Connection-Oriented NDIS.

Source from MSDN on RAS Architecture

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .