Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is the point.

I set Windows to display all the hidden files and protected operating system files but even after that, my antivirus (Kaspersky) is still getting a ".dll" file on "c:\windows\system32" saying it's a riskware 'Hidden.Object'.

I tried to find this file everytime but it's not there. So I asked one of the developers to create a service that verifies the folder each 5 seconds and, if it founds the file, copies to another place.

If it copies to another place with the same name and extension, I still can't find the file on the other folder but Kaspersky now founds both. If I keep the same name but with a different extension, like ".temp123", I still can't find the file. Lastly, I created an empty text file and renamed with the same name as the other one, the file just gone too.

After all this research It's clear that every file with this same name on this specific server gets cloak, doesn't matter the file extension. I created a file with this same name on another server and nothing happens, the file is still there without problem.

How can I found this kind of file? How can I "uncloak" it? How can I know what this file is doing?

share|improve this question

2 Answers 2

looks like rootkit, use rootkit revealer from sysinternals suite http://technet.microsoft.com/en-us/sysinternals/bb897445 , or boot to rescue mode (may or may not help) or boot another system (linux from cd for example) or insert disk to another computer

share|improve this answer

As well as hidden files there's also "protected operating system files" that you could make sure are shown as well. It's worth a shot:

  1. Double-click "My Computer" on the desktop.

  2. Select "Tools" - "Folder Options".

  3. When the "Folder Options" multi-tabbed dialog box appears, select the "View" tab.

  4. Scroll down to "Hide protected operating system files (Recommended)" and check or uncheck the box as desired.

  5. Click "OK" to close the dialog box.

share|improve this answer
    
Ok, sorry. When I said "all hidden files" I was including those too. Just edited the questions to make it clear. Thank you –  homemdelata May 10 '10 at 22:33
    
There are no other ways to hide files (except the file system metadata, which all start with a "$"). –  Chris S Jul 10 '10 at 1:55
1  
sounds like you've been rooted! –  tony roth Mar 30 '11 at 1:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.