Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp:

Area:        Local hard drives
Description: Unknown hidden file 
Location:    C:\Windows\System32\ndptsp.tsp
Removable:   Yes (but clean up not recommended for this file)
Notes:       (no more detail available) 

Doing a Google search for the term, it shows me hundreds of auto-generated, useless pages.

My question is:

Is this something to worry about or is this simply a false-positive which I can safely ignore?

share|improve this question
up vote 2 down vote accepted

It might have been a false positive with "ndptsp.exe", which is normally used by a worm.

The real ndptsp.tsp is a Windows binaries, as per the explanation on it below:

NDPTSP NDPTSP ( Ndptsp.tsp) is a service provider DLL that runs in the context of the TAPI service process. NDPTSP provides a TSPI interface that the TAPI service presents to TAPI-aware applications so that NDPROXY can communicate with user-mode applications. NDPTSP works with NDPROXY to convert user-mode requests to TAPI connection-oriented OIDs (OID_CO_TAPI_ Xxx). For more information about TAPI connection-oriented OIDs, see TAPI Extensions for Connection-Oriented NDIS.

Source from MSDN on RAS Architecture

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.