xpcc187a.dll what is this?

bcool · Post by **bcool** » February 7th, 2004, 11:41 am

Does anyone know if xpcc187a.dll has anything to do with Mozilla or MozillaFirebird builds?
It is a strange file that just recently appeared in \Windows\System32 on WINXP SP1.

By the way, the file itself has attributes hsa, hidden, system, archive.

----
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7a) Gecko/20040204 Firebird/0.8.0+ (stipe)

j-gray · Post by **j-gray** » February 7th, 2004, 4:21 pm

Hmmm.... I'm running WinXP Pro w/SP1 plus all current patches. I don't find the file in the System32 directory or anywhere else on my system. If you check under the Version tab in Properties does it give any useful info?

shill · Post by **shill** » February 7th, 2004, 4:24 pm

I would do a full scan with Spybot-S&D.

old momokatte · Post by **old momokatte** » February 7th, 2004, 4:38 pm

I couldn't find any matches for xpcc187a.dll on Google or anywhere else, which is unusual for a DLL file. It could be something new and unidentified (spyware, worm, etc.).

bcool · Post by **bcool** » February 7th, 2004, 4:58 pm

Thanks folks. It hasn't been on my system for very long - at the very most - since February 2, 2004.

I take a fingerprint of my hard drive and monitor all changes to files. That's how I caught this one. But the only thing I could get from it in a hex viewer that made any sense to me was a file name entry:EVALCHECK.DLL.
Of course the WINXP registry is silent on both Xpcc187a.dll or evalcheck.dll.
For now, I have the mysterious file isolated and secured. I asked here because I saw "XPCC" in the filename and for some reason this reminded me of some of the entries in xpti.dat and xpconnect.xpt - part of MozillaFirebird.

FYI: Spybot, HijackThis, Regedit, Norton AV 2003, TDS-3 Trojan Defense - all silent on this!!

Thanks for your help. It was a shot in the dark...