Help: What's afaf1_s.dll

[PhilB66]

Please help identify afaf1_s.dll (in \WINDOWS\system32\ folder) and what it does. Google search yields nothing.

[Curt]

1) check the various dates it can tell, about installation, and 2) perform a search for changes made at that time, and 3) Windows will reveal what you were doing at that time, so you'll get a hint from where the bastard came.

[mouser]

dont have it on my pc.  perhaps you could zip and attach it and one of the more reverse-engineer skilled people on the forum could have a look at it?

[PhilB66]

Thanks Curt and mouser, I have already tried that... 

It's listed as a hidden system file but when I try to rip the .dll I get "file is not EXE or DLL" message. I opened it with notepad but all I could see is some strange characters *qò and it's only 5 bytes in size.

I attach the file. Maybe someone could tell what it is.

[lanux128]

it's also worth a try to upload the file to virustotal or jotti to have it scanned..

[mouser]

it's only 5 bytes big?  seems like it might be a copy protection data file masquerading as a dll -- i.e. a program you installed might have created it to keep track of when the trial period started, etc.

[PhilB66]

Done that too... nada ( That was in response to lanux128 suggestion)

[PhilB66]

it's only 5 bytes big?  seems like it might be a copy protection data file masquerading as a dll -- i.e. a program you installed might have created it to keep track of when the trial period started, etc.

Thanks mouser, that might be it but how could I tell to which program it belongs (and wtf it is cluttering system32 folder  ) 

[lanux128]

as mouser mentioned it's too small to be a DLL, it's more likely to be a beacon file.. and it's hard to say what might have dropped it into the system folder (recent downloads, visited websites, installed programs).. delete the file and retrace what you were doing earlier to see if it comes back..

[PhilB66]

Thanks lanux128. Already renamed the file to .bak. See if I manage to find out which program created the file.

[f0dder]

Grab sysinternals' Process Monitor (not * Explorer), set a filter for the file name... and keep PM running for a while.