Computing.Net > Forums > Security and Virus > Suspicious files

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Suspicious files

Reply to Message Icon

Name: Derek
Date: October 5, 2002 at 14:32:46 Pacific
OS: W98SE
CPU/Ram: PentIII/128M
Comment:

I do not readily jump to the conclusion that specific files are spyware (despite claims) but I have strong suspicions about amcompat.tlb & nscompat.tlb that can appear in c:\windows\system. Mine were both "updated" by a freebie CD program called PhotoPro, although I did prove that they were present on my system before that.

I searched Google and there were many claims that amcompat.tlb was Aureate spyware. One site claimed however that amcompat.tlb is a legitimate and "important" MS file but I found no evidence to support this and it is not on the W98SE CD. Neither file was detected by Ad-Aware.

Other files were implicated (most of which are on the W98SE CD) and I have no reason to suspect these. Partly true claims often get exaggerated...

--

This is what I found:

Examination of these file in text format made me think that they were far too interested in what you were doing with media.

When the program "Dependency Walker" was run it said:
"No DOS or PE signature found. This file is not a valid 32-bit or 64-bit Windows module".
Other files with the extension .tlb opened quite normally.

When PhotoPro was installed a new registry entry arrived for "Progressive Networks/RealPlayer". RP is renowned for spyware.

The registry references related to TypeLib.

--

For the time being I have removed and zipped the two files, keeping the registry undo's. So far nothing untoward has happened.

Can anyone throw more light on the purpose of these files, particularly whether they have a legitimate function? I am also interested in what programs require their use.

Thanks folks

Derek



Sponsored Link
Ads by Google

Response Number 1
Name: Bryan
Date: October 5, 2002 at 15:59:34 Pacific
Reply:

Had a look at these. They are not standard tlb files. amcompat says it has something to do with Microsoft Active Movie and nscompat says it has something to do with Microsoft Net Show. Very suspicious though.


0

Response Number 2
Name: Jim Beau
Date: October 5, 2002 at 16:45:18 Pacific
Reply:

Adaware didn't find them?You could try Spybot search and destroy and see if it detects those files as spyware.You can download it from wilders.org in the free tools section.Just take tempfile plug-in update first,then you can take the rest of the updates(language files aren't necessary unless you use non-english language).Spybot has a feature where you can high-light a detected program and click on "more information" to find out about it.It's the only Spyware detector I really like.Regards.JB


0

Sponsored Link
Ads by Google
Reply to Message Icon

Related Posts

See More







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Suspicious files

suspicious file www.computing.net/answers/security/suspicious-file/14334.html

Suspicious Files/ www.computing.net/answers/security/suspicious-files/10075.html

suspicious file outgoing OE6 mail?? www.computing.net/answers/security/suspicious-file-outgoing-oe6-mail/22003.html