Roaming\sp_data.sys ?

[asianmusicguy]

I have a file in \AppData\Roaming\sp_data.sys  no signs of any issues the file pre dates the purchase of my computer i bought it may the file has a date of February its a new asus laptop when i look it up i get conflicting reports all scans normal

 

[Firefox]

You could always upload the file for analysis to see if its malicious.....

Upload the file to VirusTotal

• Open your favorite web browser, and go on virustotal.com;
• From there, click on the Choose file button and wait for the Windows Explorer to open;
• Browse to the file below, select it and click on Open;
  
   \AppData\Roaming\sp_data.sys
   
• Once done, click on the Analyze button;
• If you get a message that the file was already analyzed, click on the Re-analyze button;
• At the end of the analysis, copy and paste the VirusTotal report URL in your next reply;

[asianmusicguy]

11 hours ago, Firefox said:

You could always upload the file for analysis to see if its malicious.....

Upload the file to VirusTotal

• Open your favorite web browser, and go on virustotal.com;
   
• From there, click on the Choose file button and wait for the Windows Explorer to open;
   
• Browse to the file below, select it and click on Open;
  
   \AppData\Roaming\sp_data.sys
   
   
• Once done, click on the Analyze button;
   
• If you get a message that the file was already analyzed, click on the Re-analyze button;
   
• At the end of the analysis, copy and paste the VirusTotal report URL in your next reply;
   

 

https://www.virustotal.com/en/file/d1ec75516ae4f8d478b483f635e8f7f323ccb429a6a8be4aeac4280c02982fc9/analysis/1470322406/

[David H. Lipman]

Quote

File size 165 bytes

Magic literal

ASCII text, with CRLF line terminators

TrID	Generic INI configuration (100.0%)

 

Junk File.  Not Malicious.

[asianmusicguy]

next question how did it get there and may it be safely removed ?

[David H. Lipman]

I don't know how it got there and it may or may not be an artifact of some malware from some past event.

It can be removed with no sequelae.

[asianmusicguy]

ok booted into safe mode as a precaution and removed the file does this warrant any sort of deeper invistagtion over in the malware thread or you do not believe so? 

Thanks again David  

[David H. Lipman]

No, I don't think it warrants further investigation and you did not have to boot into Safe Mode.

It is an INI file and thus it is interpreted for configuration settings.  Nothing more.

[Firefox]

@David H. Lipman, thanks for the backup David...

[asianmusicguy]

it came back after restart

[Firefox]

11 minutes ago, asianmusicguy said:

it came back after restart

If it came back then its possible that some software you have installed on the system recreated the file.  As already stated its not malicious.

[David H. Lipman]

Download Process Explorer from Microsoft's Sysinternals

Go to;  Find --> Find Handle or DLL

Enter;  sp_data.sys

Then choose;  Search

It will tell you what is using that file if it is open by a program.

For example:

I have ~DF375AD743804B0B26.TMP in my %TEMP% folder and I want to know what is the program that is using it.

 

Now I know it is Pegasus Mail ( aka; PMail ) that has created it and has its File Handle Open.

 

[asianmusicguy]

no matchs

[David H. Lipman]

OK.  That means the File Handle isn't held open.

It is created, modified and read on-the-fly.

There is another Microsoft Sysinternals utility called Process Monitor.

The objective is to clear ALL filters. ( "CTRL + L"  or from Pulldown menu;  Filter --> Filter ) by highlighting them and chossoing "Remove"

Then a create a "Path" filter that "contains" the text "sp_data.sys".

Then delete the file "%APPDATA%\sp_data.sys while running Process Monitor and hopefully it will log what recreates it.

** NOTE:   I must admit I haven't used Process Monitor in quite a while so I am "rusty" and have forgotten the best practices in using it.

[Firefox]

Another thing you can try....

How about you zip up that file in question and upload it here on your next reply so we can have a look at the file, perhaps it may shed some light as to what is creating it.

Thanks

[asianmusicguy]

there we go 

sp_data.zip

[David H. Lipman]

[Main]
Mode=1
ColorTemperature=50
IsSupportEyeCare=YES
DefaultEyeCareMode=2
DisplayVersion=3.13.0004
GradualInterval=250
GradualLevel=240
IsSupportedMode=1

They are innocuous INI directives and unfortunately they don't shed light on what is creating and using those directives.

[Firefox]

Being that this is an ASUS computer its quite possible that this may be what is creating the file...

http://www.asus.com/Microsite/2015/display/eye_care_technology/

Maybe look through your installed software and see if you have anything installed mentioning this technology.

Edited August 5, 2016 by Firefox