Changes to system files kernel32.dll, user32.dll, shell32...

Archived from groups: microsoft.public.windowsxp.general (More info?)

On Sun, 12 Jun 2005 16:26:25 -0400, _RR <_RR@noemail.com> wrote:

>Do MS Hotfixes alter any of the files above? The latest run of AVG
>(Free) picks up changes in those files, but I've known AVG to
>mistrigger once in a while.
>
>Every incoming file gets checked with AVG, so I'm not sure how
>anything AVG-detectible would have got in. I'll double-check with
>another virus checker later, but I'd rather be cautious for now if
>there could be any kind of virus/spyware.
>
>It occurred to me that MS's own Hotfixes may change those, so I don't
>want to do an unwarranted repair install, especially given that those
>same hotfixes would need to be reapplied.
>
>Running XP SP1 (not anxious to jump to SP2 yet).

PS: As mentioned in another post, "Virus/Spyware checkers' the stats
on the files flagged by AVG are:

kernel32.dll 930,816 bytes, 6/17/2004 12:58:36pm
ntoskernel.exe 2,040,832 bytes, 3/1/2005 9:33:36pm
shell32.dll 8,348,672 bytes, 3/11/2005 9:51:16pm
user32.dll 561,152 bytes, 3/2/2005 2:20:04pm

I've located mention of all files/sizes via Google *except for*
ntoskernel.exe, so at this point, that's the main one that I'd like to
corroborate. Does anyone have a file that matches that file
size/date?

Note that the actual size is listed via 'properties.' Normal dir
listing is probably binary 1000's (==1024). Also, it appears that the
infamous MS date-stamping mechanism may affect the date by timezone.
This would probably depend on whether your system partition is FAT32
or NTFS. (They store file dates and account for daylight savings time
in different ways. A particularly retarded piece of engineering,
given that it can screw up file backups across networks).

Anyway, if anyone has a chance to r-click ntoskernel.exe in
Windows\System32, go to properties, and match the size and date above,
I'd love to hear from you. I'm pretty sure the other files are valid.