"Desktop icons" folder

[Stan Brown]

I've got Win 7 Home Premium with Aero on a Dell laptop, and have
started doing some customizations. I have a folder on my desktop
called "Desktop Icons". I remember seeing that when I first got my
computer, and I thought I got rid of it, but maybe I am remembering
wrong.

In any event, that folder contains one entry, a file called
PreConnect_1jyhry45mdgv3m55rygfk5un.exe
It's a file, not a shortcut, and it's 347 KB in size. Properties
shows the description as "AutoIt v3 Compiled Script". Google turns
up some information on AutoIt but not on this file. The last-modified
date is a week before I bought my computer.

1. Does anybody have any information about this file?

2. Is a "Desktop Icons" folder part of Windows, or can I get rid of
it? It seems daft to have a folder called "Desktop Icons" *on* my
desktop. That folder's not in the customizable list that I get when
I right-click the desktop and select Personalize. I've searched
Google for "folder named desktop icons" and "folder called desktop
icons" and "desktop icons folder" but found nothing apropos.

 

[Paul]

I've got Win 7 Home Premium with Aero on a Dell laptop, and have
started doing some customizations. I have a folder on my desktop
called "Desktop Icons". I remember seeing that when I first got my
computer, and I thought I got rid of it, but maybe I am remembering
wrong.

In any event, that folder contains one entry, a file called
PreConnect_1jyhry45mdgv3m55rygfk5un.exe
It's a file, not a shortcut, and it's 347 KB in size. Properties
shows the description as "AutoIt v3 Compiled Script". Google turns
up some information on AutoIt but not on this file. The last-modified
date is a week before I bought my computer.

1. Does anybody have any information about this file?

2. Is a "Desktop Icons" folder part of Windows, or can I get rid of
it? It seems daft to have a folder called "Desktop Icons" *on* my
desktop. That folder's not in the customizable list that I get when
I right-click the desktop and select Personalize. I've searched
Google for "folder named desktop icons" and "folder called desktop
icons" and "desktop icons folder" but found nothing apropos.

http://en.wikipedia.org/wiki/Autoit

With files like that, if the properties don't tell you anything about it,
I use a hex editor to scan through the file for interesting things.

You can also upload the file to virustotal.com and have it analyzed.

Paul

 

[Stan Brown]

http://en.wikipedia.org/wiki/Autoit

Thanks, but I already researched AutoIt. My question was about this
file specifically, since it's an .EXE and there's no way to tell what
it's for.

With files like that, if the properties don't tell you anything
about it, I use a hex editor to scan through the file for
interesting things.

You can also upload the file to virustotal.com and have it analyzed.

I tried. I clicked Browse and selected the file, and it appeared in
the box all right. Then I clicked Send File and nothing happened.

 

[Paul]

Thanks, but I already researched AutoIt. My question was about this
file specifically, since it's an .EXE and there's no way to tell what
it's for.


I tried. I clicked Browse and selected the file, and it appeared in
the box all right. Then I clicked Send File and nothing happened.

I can find one example of a PreConnect here, and the malware advisor
is having the owner delete it, with a regular "del" command. The Hijack
This says it is packed and Autoit, and the packing step will make it harder
to examine. (You probably can't search for text inside the file that way,
until you unpack it. And I have trouble with that. Although I did give
File Roller a try in Linux the other day, and discovered it could bust
one flavor of packing. That was a surprise. I normally use 7-ZIP for
burrowing into files, but 7-ZIP doesn't have unpackers for everything.)
One reason for using Virustotal, is in the detailed analysis section,
it may show what kind of packer is being used to compress the file.

http://www.bleepingcomputer.com/forums/topic345066.html

Other than that, I'm not finding a lot of references to it. Not that
the search engines I use are doing good wild carding any more.

A site like Virustotal, could be attacked by things like botnets,
they could be having server problems, or it might just be the browser
you're using.

I just tried Virustotal right now and got "Server error! The server
encountered an internal error and was unable to complete your request".
So it looks like they're in need of some maintenance.

Paul