C:\Documents and Settings\xxxxx\Local Settings\Temp : {215E4984-0C07-49DC-8012-3247783A10EE}

MD5: E30BE6078F3502CE82BE83FBE2E63909

This ADS re-spawns after reboot . I can't find any rootkit or malware evidence on my test system aside from this ADS .

Is this a normal file ? If it is google is not being any help .

I have exported it and submitted it to virustotal , it scans clean . Hex-editing also turns up nothing (its only 12 bytes) .

My test machine is XPSP1 BTW .

Thanks

Found it!

Here you go. It's at Sunbelt as Backdoor.Nibu

The dll is at the bottom of the list.

Definitely malware.

_________________

Microsoft MVP Consumer Security 2006, 2007 & 2008

Awesome , thanks .

It looks like I may have stumbled on this a while ago : /postlite171327-lhel32+dll.html .

I am going to try and track down the lingering file that is re-spawning the ADS .

You are most welcome.

That would be a good idea. Sunbelt is the only one with text on this threat.

_________________

Microsoft MVP Consumer Security 2006, 2007 & 2008

Well I don't think I will ever get to the bottom of this one : /t172910-.html

Glad it didn't burn more than that. In the old days (maybe they still do?) we always kept a CO2 Fire Extinguisher in the computer room (mainframe). You never know when the circuits will fry.

_________________

Microsoft MVP Consumer Security 2006, 2007 & 2008