Strange file being installed

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

Hello all - I realize this may not be the proper venue for
this question, but I don't really know where else to start
and trust the clever minds in here might be able to help...

I have a little program called 'Win Patrol' installed which
warns me when anything that I have not approved is trying
to install on my computer. Today it keeps warning me that a
file called cwindows/system32/cnvfat.exe has been
detected which was not previously installed on my computer
and whether I approve the addition of this program to my
startup.

I keep saying "no" but the warning keeps popping up. This
looks like a Windows file to me, but I have no idea what it
is (there is no additional info available on it) and why
all of a sudden this would be happening.

Any ideas out there please? Thanks!

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

On Thu, 20 May 2004 10:07:21 -0700, Swiss wrote:

> Hello all - I realize this may not be the proper venue for
> this question, but I don't really know where else to start
> and trust the clever minds in here might be able to help...
>
> I have a little program called 'Win Patrol' installed which
> warns me when anything that I have not approved is trying
> to install on my computer. Today it keeps warning me that a
> file called cwindows/system32/cnvfat.exe has been
> detected which was not previously installed on my computer
> and whether I approve the addition of this program to my
> startup.
>
> I keep saying "no" but the warning keeps popping up. This
> looks like a Windows file to me, but I have no idea what it
> is (there is no additional info available on it) and why
> all of a sudden this would be happening.
>
> Any ideas out there please? Thanks!

cnvtfat.dll is a WinNT file. Can't find anything on cnvfat.exe

Not much help... maybe check when the file was created on your disk and
using Search by date, find other files that came on to the system in the
same time frame. This little exercise might at least help to hook the
mystery file up with a main application whose name will ring a bell.

--
Sharon F
MS-MVP ~ Windows XP Shell/User

Archived from groups: microsoft.public.windowsxp.newusers (More info?)

On Thu, 20 May 2004 12:07:44 -0700, anonymous@discussions.microsoft.com
wrote:

> Sharon, thanks for your reply - I did a search for
> cnvfat.exe and it came up in windows/system32; it's 49kb
> size and just says 'application' - no mention what it is
> associated with....grrrr!!

I figured that you knew that much about the file from your last post. It's
other files that were installed on the same day that will possibly give
useful clues. Example: Install large program XYZ.exe and it adds some files
to the Windows folder as well as its own.

When using Start> Search, use Other Search Options (or similar depending on
how you have search setup). Do not type in a file name. Use the "Specify
Dates" optin and select the same date in both calendars as the one shown
for the cnvfat.exe file It's not a foolproof method but it's one that has
helped me track down the source of a mystery file in the past. Sometimes it
pans out, sometimes it doesn't.

My gut feeling is the same as the other advice you received earlier: Check
for malware (bad software: spyware, adware, trojans, etc). Using a
familiar looking and sounding name is a common trick that these things use
to slip files onto our systems.

--
Sharon F
MS-MVP ~ Windows XP Shell/User