1. Compaq DL380G2, Win2K SP3, Recovery Console option installed
2. a virus scan reported Viking.lu infection in arcldr.exe and arcsetup.exe in c:\.
3. File info:
arcldr.exe:
242176 bytes in size
created 12-7-99
modified: 7-22-02
File version: 1.0.0.0
no other entry in properties page except this: Language: Chinese (PRC)
arcsetup.exe:
255488 bytes in size
created: 12-7-99
modified: 7-22-02
File version: 1.0.0.0
no other entry in properties page except this: Language: Chinese (PRC)
4. Versions in c:\WINNT\$NtServicePackUni
arcldr.exe:
148992 bytes in size
created: 4-6-07 (when I ceated this system)
modified: 12-7-99
property info is not displayed as in versions above (?)
arcsetup.exe:
162816 bytes in size
created: 4-6-07 (when I ceated this system)
modified: 12-7-99
property info is not displayed (?)
5. Versions in c:\WINNT\ServicePackFiles\
arcldr.exe:
150528 bytes in size
created: 7-22-02
modified: 7-22-02
property info is not displayed (?)
arcsetup.exe:
163840 bytes in size
created: 7-22-02
modified: 7-22-02
property info is not displayed (?)
I'm hesitant to have the virus scanner "fix" these two files.
Questions:
1. are the ones in c:\ valid?
2. If not, can I replace them directly?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Sounds like a false positive. To be on the safe side, submit these files to these two web sites:
http://www.virustotal.com/
http://virusscan.jotti.org
They will scan against a variety of AV engines and let you know the results within a few minutes.
1. Yes, I;m aware of the RC connection as I noted.
2. Yes, I'm aware of the repair options in Win2K but I've never initiated them and am afraid to do so on my main system in its now damaged state.
3. As there appeared a high chance that these files were infected I was leaning toward letting the AV program disinfect them. I first let it do so on other minor EXE files and examined the results. Indeed, the cleaned file was correct, in function and property data displayed. Reading up a bit, the virus simply attaches itself to the "front" of the real program, executing itself and displaying its property info.
I then applied the disinfection to these files and all is well.
However, it would still be worth knowing if I can simply copy these over from the service pack location or are they customized. Doing a file comparison of two copies of these correct files, from two systems, shows no differences. So, I am reasonably confident that a simple overwrite will work.
...and indeed it works. I tried it on another system with success.
Business Accounts
Answer for Membership
by: RajendraDewaniPosted on 2007-07-21 at 10:54:09ID: 19540083
These files are used when you activate the options "Windows Recovery Console" at boot time.
Microsoft Knowledge Base Article - 238359
Described in the technet site of Microsoft, search for "arcsetup.exe".
http://www.microsoft.com/t
Differences Between Manual and Fast Repair in Windows
This includes the Ntldr, Ntdetect.com, Arcsetup.exe, and Arcldr.exe files that are used for booting various computers. The optional Ntbootdd.sys file is never checked.
http://support.microsoft.c