Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp:

Area:        Local hard drives
Description: Unknown hidden file 
Location:    C:\Windows\System32\ndptsp.tsp
Removable:   Yes (but clean up not recommended for this file)
Notes:       (no more detail available) 

Doing a Google search for the term, it shows me hundreds of auto-generated, useless pages.

My question is:

Is this something to worry about or is this simply a false-positive which I can safely ignore?


It might have been a false positive with "ndptsp.exe", which is normally used by a worm.

The real ndptsp.tsp is a Windows binaries, as per the explanation on it below:

NDPTSP NDPTSP ( Ndptsp.tsp) is a service provider DLL that runs in the context of the TAPI service process. NDPTSP provides a TSPI interface that the TAPI service presents to TAPI-aware applications so that NDPROXY can communicate with user-mode applications. NDPTSP works with NDPROXY to convert user-mode requests to TAPI connection-oriented OIDs (OID_CO_TAPI_ Xxx). For more information about TAPI connection-oriented OIDs, see TAPI Extensions for Connection-Oriented NDIS.

Source from MSDN on RAS Architecture

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.