Changed file in Win XP

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Gene Felch wrote:

> My antivirus reported changes in the following files:
>
> File Size Created Modified
> Kernal32.dll 909,816 8/23/01 6/17/04
> User32.dll 574,464 8/23/04 12/28/04
> Shell32.dll 8,443,904 12/21/04 12/21/04
>
> The above were obtained from the properties of the files in System32.
> The supposed changes occured in the past 24-48 hrs.
>
> 1. Does WIndows update ever change files without updating the dates
> created and modified.
> 2 . Do the dates and sizes above correspond to legitimate Windows
> files?
>
> Thanks
> 1.

Are you typing "Kernal32.dll" exactly the way you see it? If so, you
have a virus. The real Windows file is "kernel32.dll". Make sure your
av is current and the definitions are updated and do a scan in Safe
Mode to be sure you are clean.

Malke
--
MS MVP - Windows Shell/User
www.elephantboycomputers.com
In Memoriam - MVP Alex Nichol
The world is diminished without him.

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Note only do AV software check date/time changes, but also size changes.

The norm for software fixes, patches and updates will changed date/time
stamp, maybe the size, and the version number.

--
Star Fleet Admiral Q @ your service!
"Google is your Friend!"
www.google.com

***********************************************

"Gene Felch" <Gene Felch@discussions.microsoft.com> wrote in message
news069F718-2DC8-4151-AED5-8F74FFF4CC74@microsoft.com...
> My antivirus reported changes in the following files:
>
> File Size Created Modified
> Kernal32.dll 909,816 8/23/01 6/17/04
> User32.dll 574,464 8/23/04 12/28/04
> Shell32.dll 8,443,904 12/21/04 12/21/04
>
> The above were obtained from the properties of the files in System32. The
> supposed changes occured in the past 24-48 hrs.
>
> 1. Does WIndows update ever change files without updating the dates
created
> and modified.
> 2 . Do the dates and sizes above correspond to legitimate Windows files?
>
> Thanks
> 1.
>
>