Author Topic: weird file  (Read 5433 times)

0 Members and 2 Guests are viewing this topic.

Offline Axon

  • VIP
  • King
  • *
  • Posts: 2047
  • Cookies: 319
    • View Profile
weird file
« on: March 05, 2013, 03:51:11 am »
Just found this in my usb stick, look at the modification date  :o

Offline Corrupted_Fear

  • Knight
  • **
  • Posts: 336
  • Cookies: 34
  • Is dangerous to go alone! Take this! @xxxx[{:::::>
    • View Profile
Re: weird file
« Reply #1 on: March 05, 2013, 04:10:47 am »
Future self giving you a powerful detection tool that will be needed in your upcoming mission that you are unaware of currently?

by | Angel | Devil |

"Welcome to le trove that is my home. Welcome to EvilZone." -- DeepCopy

Offline Zesh

  • Royal Highness
  • ****
  • Posts: 699
  • Cookies: 42
    • View Profile
Re: weird file
« Reply #2 on: March 05, 2013, 04:21:22 am »
Future self giving you a powerful detection tool that will be needed in your upcoming mission that you are unaware of currently?

Aha, most likely :P

Offline proxx

  • Avatarception
  • Global Moderator
  • Titan
  • *
  • Posts: 2803
  • Cookies: 256
  • ФФФ
    • View Profile
Re: weird file
« Reply #3 on: March 05, 2013, 04:54:28 am »
Just found this in my usb stick, look at the modification date  :o

Yeah either the above :P
Or maybe youve used a machine somewhere that had the time settings changed.
Some punk.

Or the other obvious awnser.
Wtf where you thinking with that signature? - Phage.
This was another little experiment *evillaughter - Proxx.
Evilception... - Phage

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: weird file
« Reply #4 on: March 05, 2013, 08:19:32 am »
Or it's a piece of virus... if you say you found it on a USB stick, then it makes sense. Why would Windows put NTDETECT.COM on a usb stick for no reason.

Offline Fur

  • Knight
  • **
  • Posts: 216
  • Cookies: 34
    • View Profile
Re: weird file
« Reply #5 on: March 05, 2013, 08:21:14 am »
File times can be changed easily.
Code: (Csharp) [Select]
// Change a file's last accessed time to the 1/1/2037 at 00:00:00.
DateTime newDate = new DateTime(2037, 1, 1);
File.SetLastAccessTime("path/to/file", newDate);

9/02/2038 at 03:14:08 is the maximum 32-bit unix time, after which is will reset to 1901.

Looks like the typical result of a usb spreader to me.
0/10 would not run.

Sorry if I sound like Captain Obvious.
« Last Edit: March 05, 2013, 08:30:36 am by Fur »

Offline Axon

  • VIP
  • King
  • *
  • Posts: 2047
  • Cookies: 319
    • View Profile
Re: weird file
« Reply #6 on: March 05, 2013, 08:36:55 am »
I haven't used it in a couple of weeks or more,but recently a friend of mine used it to transfer movies between his computer to another friend's computer at the office. I just asked my friend and he said he only used it to transfer movies.
« Last Edit: March 05, 2013, 08:37:54 am by Axon »

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: weird file
« Reply #7 on: March 05, 2013, 08:51:32 am »
Several viruses use the modification date to a certain number of years in the future to mark files that they have infected. So they can prevent infecting files more than once.
Have you uploaded it to virustotal or similar?
You should notify your friends if that is a virus.
« Last Edit: March 05, 2013, 08:53:56 am by Deque »

Offline Axon

  • VIP
  • King
  • *
  • Posts: 2047
  • Cookies: 319
    • View Profile
Re: weird file
« Reply #8 on: March 05, 2013, 09:07:43 am »
Hold on... I think I know where this file came from, a while ago my older brother had some malfunctions in his Windows XP PC, the problem as I remember it was that C://WINDOWS/system32 doesn't exist, so he downloaded some fix file or something like that, and used my usb to burn this iso file on it, anyway next to this file there is a folder called I386 and it's filled with windows shit.


So I think this is a false alarm. However, I also have two files named WIN51 and WIN51IC, and both of them were modified on Monday,Nov 7 1988.
« Last Edit: March 05, 2013, 09:10:06 am by Axon »