Solved

Decipher Files

Posted on 2004-09-18
29
861 Views
Last Modified: 2013-12-29
When I open certain files they look like this, which is meaningless to me. I want to be able to READ what it says. How can I do that?
0
Comment
Question by:frankoravec
  • 16
  • 5
  • 3
  • +3
29 Comments
 

Author Comment

by:frankoravec
Comment Utility
Oops! I forget to paste the file.

MSCF    é      ,           90  I     ­˜        ø,^  inventory.as UÚNì €CKì]      tUº®‘U €Žãs4Æ
°+Þ­ªîåR«D       ãD±º»BéfÞ°ˆ‚£nˆ£Ì(âöÇqa†qã¡AÁQÆÑç†3*:z|gÆÝw«’tÒéêXI˜3Éát5½Ôýÿ¯þûÝïÿoÝÛBHhå¯à» µ×FTUíÔ‹¯+|`ÕMóÊ^U/Çò×{      ácé3Øý¾p²0oN؉;¡xi¸¶6`ΟÕàÄbÑú:
ï
S 'î¾4Ê„ÅgUl¢¾SL8j‚3uœ³ÀœÅc±ãÊ+Õ•ÖÄ‹Õ      fME4ÔP«Äk&Í
Ûq'Vsq´.\?/V\á„£vqU­½Ài¨™7#À(…²XY],n×Ö:á€qqå# y#ÈßFJ’/Mv\×JÕ—äRÒ7Ô»?·o9q‘µvîÞ/ÃÊ‚³«8R½÷½¯û%ºôøo¤”R˜Dêíü}ëþûÓ±¿X³ü±3£5[]`
8R·GcL¶‰(h ©T³)/¸Ýó짉j(ëW;ñ9³jŽ Q¬×ÏœU_çÔÅc5‹dÍ’*!3¢Š†±¨A      ‹ è€X
³TU^H74zT D         €$•4A´Ó9ϵ‚¤-2+I¢Þ˜uóªµçŒ»g¾Fs’^ÔuÁ#êÃ;uf+ ì` 2@ƒ"      ¢ h3…ŠaŠ"IÁÍQ'      O1Z’-Œ;ДÖ:SîÑ•Û_Ù?ïcM¡VrðŽU‹úp¸{
H C®è“@ú÷¹‰³O›pWÏ      VDzº˜ê¡5úœ†îQ
3îlÜi¨sâ®ïñhÝÔX "ZWŸî¨ØÂ@ÉlŒ ÂÈ_8
E#Ħ¨(      Ñ%‘š€?CL…TS´<à웂sþàœËuÃéNÕ¢½6åãÊ5fè¶^ÏO¹þá¡.œ‚0µß'z¥àHÓÁ*8ÿjm}ƒÓд?K¥ 1ÈJe ”¤­‡ï™þí™}ÿTtõ ¡Ço†ºjûP×2AX0`wÒÌCsÚze£­ÅÍŒýþW‚*Т*ç      (©ˆs³!‹ü%ȹ
#ÊßÕ'=éÿÑ×÷½sců¾~µ ú®ÇF<“éÉ“]ê      Ó,ÍdÄ‘¥ZG<A^<ù0Ó“¿u©'P#Š%&bHðOpkžŒ80áÀÀËþi=QðRôü¯ž;æ­LOÞèRO³ J±$òî Ûöä°]Óúÿ~jÝñü9 ×iÇžõ^¦'ït©'˜)ÈÔ4è^“ž,¾hÙZëz\¸ù†›7¶­ûM¦'Ûr{r[6OšÓSK…ëÁ€ DÈTE ]$¶™%ÑÐMÕ`šªAMo®R¸0 `H˜Rc—½sï¹_
íkmí;–¼zÉè}™.îÉíâñM]Ì!ÇÚå¨b*²Jù•ÂØp
s‚“u>ÊH s¡Oeh€ìŽzN*<X"©É:‘D‰IJ2z4™_ 4`  fV*z>¡'L{Ø¡e7:¯]_öÛ
“_É„ö@nh75‹žbQ5é<öEÀ€*êXA¢ÅT“?Óe•Qj 䟧†U»PŒ]¸ºæ„Ðeï~Xõ—Lv±²B ÔTÞÑ-Æ0%Kc†JUBˆ”ÃÇÕ›ž9þ?Þw·ô´ž( ˜14ÿ4qLÏ Éwš‰’œ<äAJääAIhòÀ’RÇ<h1‹hœTM‚V³H#KŠªŠX
‘Œˆš$›"Á:!`¦Dèb_{’eèª2àÞ§      0‘™*æiŽ™D4UEÄmûÖ¢.¦îŽÆ’ifï»SLâ[‹Š¢``ÉmÑh£EÉ·      ç'«ÀmÑl£EÙ·©¬Q¥œ-*þ]G]U(áI†dZr-RßZäW_Fªäj‘ùÖ"Ò 2@n‹mÅ*¾5)s]¤Z çlÒcÐK쨲ÎL¬µÝd‚…éÓW<ÿƒŒÙp퍿ØcOzòhgá–€äfa,h%’Ͳ¸ºº¨R]—=š‰ˆÆ$ÐÍÂÝ,ÜÍÂÝ,Ü%,\f¾õùßß²Çÿjý–·æ\ÝwýßÚÁÂ_      -YØO…–‰(£„s˜ÆD"óT_uó}E2 ExŠÏ?Ð$š pHL›ú~éï*ú—gÅųß8
”5¨ÆCA•(ϱ™ŒD
ÈT”™,)UtC’» ÀwVo:°¨ÔZzÉKw|:âŸ÷½s d!ó°%]$CÉd¬ˆDQ%,ñqÁD¬Ë ÌLg·µ@rl‹ŒÄã÷Q©cJAìýzxQ ”'ôNÌ¡…E
9Ç2Š‚á°
%'ö÷‚x*Íy×U:­ 4U!<wWdÞªLˆHÝ@
€T“¹tԁ¿²Ê«tôOVy•ŽþÉ*¯ÒÑ?YåU:ú'«¼JGÿd•Wé裬òª}”UžÅ£¬ãY<ú—Îå!g?òfôɃK.XÑ㯅O\~ê-{Ú1ò<Ú³ÃFžñÇÓ‰Ÿ#À”r¡hˆ’¬S‘hÀâ#ŽéÞ       @Êd
tÓçDÞ+ÿû7âxåÿF¯üï߈ã•ÿýq¼ò¿#Žgú÷oÄñLÿþ‘Žgú÷uò ÿL¿æÜ Æߟ޾¯Ïnú÷‘þ=MæúJÿP5fÄéŸÿ‰L¢L4‰®J†®ÊªivÓ7ýwÓ7ý»ôÕ
ö þp©ukÅñ×]Ùg»éßGú÷tŸ‹¿õ&ŒMÆYQ•5‰«•7¨2&ZÔ´°¤R`nõßMÿÝôßMÿ      úÿèЊWïà3uÕ#÷Žüß{÷ ÍÙÏâ,wúwØ’‰‹0Ä¥W.í<ô`ïç+÷mÝ"Œ9ùŠB¿ÉÅ
¯HY?*¹öã!ê4qÁH<½ÐžkO®àNœ#L)3ÕqÕNÃ\§awÃýŸ:¹º<Z7#6êBu²:¹â²‰}E,`*±‘Z óþ2RKQ<!\9¼TtÓeÂÎʍïŽ$VL¸f\urˆ…¹ï¸ÖÑ˧HD&â£rØ]'†DƤ0‹ FƒÁk~×¥ ÀéÖçõ)Þ,ɺ>åµºà™«Ïý‘uë9[ïüÒC¿¾:3jWæFû¢,Q›Ã¹ô
ÇŠêK*ÊI
E‘ÔOxZXüê/Ëo¿ëÙ†ï~ø •íÐR¿õ8      ªOTÄæϬE¥Fe…Qš3“#[JJwý’[M`      l¹ó¤˜i"ÐÕ0-‹g³DØ tqë¾/m‡ï£s]’֝ÆÜé„
cžÚ»ánc¯¹ýÚïÞüÙ‹^\Òy6 R9iÃݧ<µsÆ SËïþö›¨Tô³ÌÐ\š;4'yÍXöÐ4츭†BütnxRpj‘ÜÊ)hÊsÇl}eˆòÑÁ›f/Î4mI盆’¦õÙ7èΫÎ9cüšU{¾y¹jË; ÛqånïqÄ´aiþî†ñDä§?-æyˆû(%åá]I­çÌÚ˜…´‰^rÈ 1       €’&¹†_§…ÉÓJþ–€4yZÙ¿ÓR vO›ò%˃Ÿ©•=qúù›w‡ß©ÿzˆûªûÞ ½ñ½oH×/±ÆÀ      QD±)      #H †qÄ!&Ë‘NZbíÍ”¬"aKÙÁâkG|\¾zºÞpÍËW½6$¹7EÁö¼7E¼      Ý!ÿ¶A T’•ì–ï[ùþ-}– ÔîÿáiŸTÞj|S”\¾#½“DømQNËô¾WDúâè•UêE5ÕüXSe7ÄÇÏ™Yƒ$€ʱ)Dëa×Æéšô Ò z¶ýâž»£¿¨\]õBÏ]÷]%O’
<Ÿ7z}Zkòɇ¢`›@ž)‹%*r‚µm(§6ås2E4p†‘ÛXô¶ wf¦…˜^_o¨¯åFÔ¤ž¦) Wé3'/ƒ"Ó$zß퟽ž?yÌUo¯¸ï',ºû¸+àw
þº·Wô¦ù¾d;ÿ.¸iÒqSÇ®z½a\ßà¸ÞƒÝWÝŸ8Ðkßìðt‰™2Ò¨[¼3$I$TVDª†È¿¦ CƐh-¨Ð]¦Æñy³      O–då“ß‹üüφ¥n7§\1rùÛÿpÁÍW]Í/l\8¬‰¾âbjX²Ðk’á      ¹u¤ÐëïÕ@(,G0äc ˆ¸Õ¢0±ƒ¼ßQRHHq˜ÔLaÉÀÅ‚€AŸ7\ÉÏ–Ñi[¸â£€•ä¡´:v¯ò¬ãpa šk:VÆ{2¥õqÍ«ì }‚’Ø%(Ñ{ÿ Û=Ÿ{ηú‘?Ÿ|WÉÇ;ÿšPy‹¡‚,34‰>jEknB ¶ Žòôp}hî¼ÄY{nH ”È–BNàþv$T¤*î
¸ŒÊ"1UM¤º‚Eb Þ 1-%s­sr8‘!       TÌ`ÿhÖ“5YiVè±låŽÃ{‹V­¶
?Ñ—ï*J"Oë?Ýó…:£ Y릪(ñˆóIXs ÈîÎOÐe#ä|˜ÑÓi1Oš__´Ò—óɦƒ{Öèëßëñè‡×ݐÈ×÷ö^µ~¨ K¹à4û­#, ˆ¤Šºa0‘`êˆL2¹bDS-S§&„-»#È8¤~ë/–´]h,„MÊ£ªÏ_žØ0'¯I<W5Ôύ†ù{5éSWÍ      ÖFcÓ¢uSÕqž=¥›&"Òz{°Ìꑵƒ%kE$©aº»ͯzã¥6E4M¥ˆº.¹©“n‰ªj¹óRª
€&(5Ù¥IÑñ[ x3&+Ù׺òÚm_õÿÀåµo,»áэ”.æÜßÛ+kµbÙLQûËDÙ6mæ‘Ø6©¢Ež²¢D’ZìŸW
»çÿ󗊼™òýê”^6Ž      )Š;›'ƒLvWËØÜ )(ʶDmÛ
ŠVI—»ˆoˆx3%k@†oÄÈu¿®¸umÑ®¯N~ÚÚ1(Y (<´§×-ð^]d0"ókma~Õ
U™Î€ÛýKƒºNˆÜºÞƒˆÏá7k<#þD&âWv#î/â™E®‡Rˆo-êÝË« (i†x“ñßß‚WÓ      ŸüÌ      ŽÓ×dÓö+þg×¾¢•ÕÂæÝ…|÷x“bbÓÁíGÍq.nt´#6€lYN”…~BIÔ! $azäšÃÜü“ýE÷',Ùµñ¦îÍéÍ«½†ÈÙ-:¥Ï 0%ˆÄÒµ´öP%®=€º ¨@Æl!{¤ÿ2^o†díÆ‡Ý1ℳõå–Ïy휳2EÐšÜ Øá3Z6 B'Hˆedó¤)"Å$,2…b9ˆmV¤N=ÞLÉ
wáÈ‚y5¬×wTn~}xÃø÷— Ì?¶      -óŸ#š31K>¼µšÐÌØt{®8]rVÌyêf“ôGçñÔ/šøFÜ™‰QMöïàܧǀ%>Jò8}ò;      ¨¦;—>°ylmÓë»ÅÍ‹G÷žÞ¨j„#E3h2
jˆÙNÝ4÷<Í`I¹ØäÝ„…S~tÍìTן¾GÛQ¾þÉ¢vÕ’¦š®¨;±¢¼Ô(/œ—®ç! ”"
Ú¾‚m~1áÅ«ß”¿¼nÃZs͇zþ¸¸¼8Wvv”Z
ÒûË~K¢ö硾&BíÈ͸˜d¥y¥ Ësó·üò€>æ@Ñ–k„µgGÞǯ
ȸÑâÈïWìü2|ã3g5~rÒ€,žÉ2‰Ø! "9$¹s
DtSDŽH‘e‡áÎÊâ½™ÒáÁKÃ!ÆB$DüÏâ½™’5toZxhÖ5j…ñð¬w·]ùHYaÿ|šøÛÑ/g@Néì€T€#)6c"ÜSB¸¢      J
b‡(      *„¶á÷/ ½™Ò~ ‹Hþó™W0À؆¢ŒÝŒ—@ÉýÅ&Cv0AŒ"m«OYÕ“)mcÓjöÍ Òƒý»ƒ´;H»6Hÿ~àDëÇ×W>xÞIÛ*¶}QÈŽËhïô %2¤aâDD–xxDƒ ‡DhÛ!¶C‘lAêÿÐîÍ”N Rj‡]ƒˆˆû‹;Xbrƒ±™ÄÅ¢dÜIAêÍAºùâÛªõÊýEËÆ ÂçÇnx/Þ?#H= ÷¸£ (A%,9„ûHCœ®÷°PNU\ÒH ls…äÎ* x3ÅðÂÞeK·Îi~àq)ÂÑ8„QHQ(€¨HvÚ{D÷72@„™)ŽÜIC˜7S:‘€B±á™Ãr$e·%­»C’ƒíNJ¼™â!H—,š8 `vcökGv8;p-C” å‘ ìÚ ôfŠà‹ß~pSàûwÒ2DsÜ•>ùï?-{3Åðo.Ýñ_·mØ_´DÖž]{ùÈúç/Ú:~<DÁ0…ïß
çC50z2ÅðμèóèôÆi³Â¦õ[oTóYA®ñ°ñöðæ ð¾?ºÆƒL‘%aw‡=•#q»¯®0ÊÜ}VÛµŒ¥ÌhREEwíTjV/£l¯Æ„"ÑÚxúF\TJÜú»"5›I×ø#!‚ÒŸ”Ýz5%DIL¡H™Ÿ­¬uÔ9qŒZ;±Üâı¹¡†xó3c¦¤'Z^ب|)0Û¸ñ¤'ÎœöÖÜšvôضWr|ÿý"6æ؇3Þ7ÏlD&CÛ]M&ÉԁŠ p~Áсf4      Žf´‘@»jüKç¾qÒþ¢¾6ïÞuƾþ…•—¾…ùÜbÜ1? †"aNþà©bØIv;a¼¸ëöB
"áæ 6vÿ6ÁðfEÖBì˜Wþû"³XM 6fXº¾HtÛ+}©‰lÙ=Ö9VßÀ ð\›­Ž!(›™™Qµ¶0µLJM17V&f¤4Ú©½æŽ(g`ɐ½‚æ ‚ ÆFÆVž:æfVžXç{yùHŸ‡œ„ujs›Ùó¾XÊø`gG??Wh¼ƒ'
-ÌÍaÇ       ûK MFÚ9h<†¾N§Œ—t•7ýe‚±      ékÀzÀnÿ0Ó4Hï²à¼D†þ•/Ò¡ÝPG¬Û‘¾?—Ð"{X–ñ+ÍMz)8Jœq@Õ^¿ºslQqŒ¡1 Sí0¤­CK³4I*-ÖJ`£~2â¨kâÛìÂÞšr@+Gpû§°/¶y¬õÃ9Íkåœý^¿T/à!ÝWp4m‰ÜA*¼ éÇmÁõ6Põæ†æ ”aÜ+çl ¡bdt…±)¬Õßuñè®}ëœW¯˜ÚUÁØä‚0éCÝ0–ùa£Ìäâ”dhc¼|ÀPÇÈÌ \íc-éØÉHlñ¤'6Òí`×j‹¹,¸|-°UÀòX-‘‡ô#·v
ÍA›ÑuM“-Ì 
óÄXõj’jlDÄÐÛ½Ä9³¾‡ a-‰ÂÉÈÃ;ÑÃ]ÛÖº\SIÕ®(ikLm¡kL
ÍÌuHZ\LC—XÀˆÃ&«Z
#ÑïCFôÇÝXH-16ë÷ó÷sÅV*€Õ »Ìp5X[ 1BR[9äJFz{ 2û?ééÅâK‚{ŽK3¦cÂð>ÎÈrzhi¦€¶Ì%e ]Ýv5DÔ–‚„âjjidêæh kº+ÁÐÐÅH×ÉÙÙ\P¸Y9ƒn¸‚صÞÐ~VÏ      
'Ï¡/»Ì!cÙ¥6͏$uI¡‰ž¹‘ž±™¡‘ž¡¹¡ñ`Yf      pŽ$ö²3*ˆˆ‹™ô ߇w>Õª[Ò‚rl‰¹‘Ž1¸1†oÃ
\c[Wj€p õ.Å¡0
° ¥Îá’lS@$HÃA˜Ìf,;ñá¼`û…õïÎ+€*VpÂ6¨*yPÛââämÕ¥ëÞ^‚§Ú"&H=ê°ëât¬ »›;æà=^c”¯ÊŒï@¡áâÂÀPÂDzÞM—ñ4uùÑ›EO†v³ˆ‹ÁÔÈÚ*BÜ2Ki>„€¾‡µ™Œ=¬4<¨
m'(ºk[ ®Uˆ`"ÖµGqô¼†Î^[È=y‘ŸÆÇhyíÙwñZâÿ‚¤§®ìÕ?Ú      µš„ƃ’(±0&±´$¿|Ô¤Nj^b¨²RÀKÀ~Ö#ØpN,QT_”XÊU„Jl;šš›">J†&„ÏÁzH¤¡¡……ªYcÓLI6ËØhš)ªY ÓùÀ1º«ÅœCþN»wï—ÂЖ˜s\ŸÉØ‚ç‹’¸      ±‰'ØÁNÚ*¼˜{3ßk×ë¯|J9t¿© '=e ÜÆ$«ÎŽäþ ÷&æ ã!a:ˆ°2'e0‹¨°YˆÖ°
0
 
LVL 6

Expert Comment

by:caza13
Comment Utility
0
 
LVL 13

Expert Comment

by:gonzal13
Comment Utility
It seems that the files are in another language like Japanese. You would need the language for the file.

Limited experience.

gonzal13(joe)

0
 
LVL 3

Expert Comment

by:BenReynolds
Comment Utility
Gonzal13 is correct. The files look to be not English. Look at the end of the url (.de, .jp, .uk, etc.). If the URL has a two-letter extension at the end, you are likely dealing with a non-English URL. You can look up the country by going to
http://www.bitmedia.com/cc/url1.htm
among other google searches. Here's a google search URL http://www.google.com/search?sourceid=navclient&ie=UTF-8&q=url+country+codes
Good luck.
0
 
LVL 32

Expert Comment

by:_
Comment Utility
What kind of files?
What are you opening them with?
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
frankoravec

Where did you get the files, and what file extension is shown at the end of the file names.

If they were created by your system by an application, then I suspect that they are either data files that contain machine code that is not intended to be read, or they have been saved in a format that is incompatible with the version of the application that you intended to read them with.

It looks to me as if you have used the "Open With" Right-Click option on files with no extension, and have opened them in Notepad.  A Word document (.doc) might resemble the gobbledegook that you are seeing above, due to the non-printable extended ascii characters, but I would expect to see at least some of the printable text strings that made up the document if this WAS the original format.

One of the simplest utilities that you can use to see SOME of the content, is the Right-Click > QuickView option IF you chose to install QuickView as an optional extra.  You can still do so now by going to Control Panel > Add/Remove programs > Windows Setup > Accessories and checking the "Details" button.  Check the QuickView item and then click "Apply" and it will install from your CD.  No Promises, but it MIGHT show some of the content.

If the file was supposed to have had a file extension for some type of IMAGE file, eg. jpg, gif, etc, and was encoded as that file type, then QuickView would probably show the image.

I use QuickView Plus which is now sold by Jasc, who also sell Paint Shop Pro.

Another simple utility that adds a new Right-Click entry for ALL file types is PEEK.  It extracts textual content out of the file without messing with it, and opens it in NotePad (or WordPad if too large).  Download the following .zip file and extract the contents to their own folder using WinZip.  Right-Click on the file PEEK.INF, and select "Install".  It will install and register PEEK.DLL (to C:\Windows\ShellExt) that will then allow you to see a lot of the content of any file you choose to "Peek" into.

http://members.ping.at/mlubich/peek11.zip

Usually the best clue you have about the file format will be somewhere right near the start of the file's contents when viewed in Notepad.  For instance, a jpg image may have JFIF right on the top line.  That's the type of encoding used to create the file.

Your example shows MSCF where I would expect to see this, and there is also what appears to be the filename "inventory.as".

Here's what I have ascertained about the .AS file format:

http://www.learnthenet.com/english/html/34filext.htm

http://whatis.techtarget.com/fileFormatA/0,289933,sid9,00.html

http://filext.com/

http://filext.com/detaillist.php?extdetail=as&Submit3=Go%21

Extension: AS
Applix Spreadsheet
http://www.applix.com/index.asp

Extension: AS    
Dispatch Alaska/Horizon Timetable File
http://two-wugs.net/dispatch/  

Extension: AS  
Macromedia Flash Action Script
http://www.macromedia.com/support/flash/action_scripts.html

IF these files are ones without an extension, then perhaps the easiest way to see if you have an associated application would be to rename one with an .as extension and see if the icon changes.  The file name "inventory.as" would tend to infer a spreadsheet or timetable file.

Not sure about the MSCF part, but I don't think is has anything to do with the Morning Star Christian Fellowship (http://www.mscf.co.uk/) or even the Molecular Science Computing Facility (http://mscf.emsl.pnl.gov/)  :-)

More likely, the "F" is the "File" or "Format" part of an acronym for the generic file type.



0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Actually, the MSCF could easily be an acronym for MicroSoft Cabinet Files (MSCF), ie. a .CAB file, and perhaps the .AS file was previously wrapped up in a .CAB file.

If so, then here's a resource for you to check out:

http://www.tbcnet.com/~clive/vcomwinp.html

DUMPCAB.ZIP -- DumpCAB.EXE is a utility to examine the internal structure of Microsoft Cabinet Files.

http://www.tbcnet.com/~clive/dumpcab.zip

Quote:
DumpCAB.EXE runs under DOS and includes 'C' source code in the Zip file.. Standard .CAB files use a compression format called MSZIP, this is the same as PKWare's Deflate encoding.

More info
http://www.microsoft.com/workshop/prog/cab/
http://www.kyz.uklinux.net/cabextract.php

Check out the "Identifying characters" part of the first entry on the following page pertaining to the .TSK file type:

http://filext.com/detaillist.php?extdetail=TSK


Of course, the page quoted above is verging on illegal disassembly of licensed files, but worth a look ;-)
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
alternatively, email the file to me at  "microscoff_sucks  AT hotmail DOT com" and I'll see if I can figure it out.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Interesting page (table) here on "File Signatures" that quotes:

Hex Signature:
4D 53 43 46

File Extension:
CAB   Microsoft cabinet file
or
PPZ   Powerpoint Packaged Presentation

ASCII Signature File Description:
MSCF

Try changing the file extension to a .CAB file and see if the Right-Click option from WinZip allows you to "Extract to..." or rename as .PPZ and see if it unpacks and runs a packaged PowerPoint slideshow created by exporting a .ppt or .pps file from PowerPoint.

That should keep you busy for a while.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
And so will doing a file search for "Files Containing...."  "MSCF".
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
In case you were wondering about the .PPZ file type, renaming the file as inventory.ppz isn't going to help you much.  If you have ever used PowerPoint 97 or 2000's "File > Pack & Go" option, you will have been aware that this creates a packaged file (pngsetup.exe) wherever you chose to create it, and also an ancilliary file that is used when the distributed presentation is unpacked to run (pres0.ppz).

So I think we can safely discount the .ppz file type unless you remember doing something like this recently, and the .ppz file has been left floating around.  It doesn't match the format of yours, but the thing we have to bear in mind with your posting is that this page won't support and display all the characters from your file properly.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Anyway, I came here to ask a question, and have become side-tracked by yet another interesting question of yours frankoravec.  Yours are never simple are they.
0
 
LVL 32

Expert Comment

by:_
Comment Utility
: D
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
frankoravec, have any of the comments and suggestions above helped you to decipher the file9s) yet?
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 

Author Comment

by:frankoravec
Comment Utility
BillDL,

It's not that my questions are "never simple", it's that I'm dumb and there's not much you or the experts can do about that.
The files were generated by me on an MSN website for their Deluxe Stock Screener. I input certain criteria for each such file that searches for stocks that meet my criteria. The files used to reside in C:\ program files and were used when I accessed that website to run the program for a particular set of criteria. MSN “improved” their website and, in spite of many hours of discussion with MSN, I have not been able to access that program. I did not have a hard copy of the criteria, which is what I am trying to get from these files.

To open the file, all I did was click on the file. After that, if I click on file>open, *.txt is shown as the file type.
QuickView was already checked. BillDL, what CD are you talking about? The file would not show an image, it is strictly text that defines the criteria.
I downloaded Peek.dll to the desktop and can’t find peek.inf. This is what I get when I open peek.dll with notepad.
That’s as far as I got. Sorry I haven’t been able to digest the rest. I’ll work on it over the weekend, BillDL.
Thanks, all for helping.
0
 
LVL 32

Expert Comment

by:_
Comment Utility
OK. DLL files are used by the OS and are binary files, not text. That is why they look strange. I don't think you will find what you are looking for in there, but maybe someone knows of a good hex viewer if you want to look anyway.
0
 
LVL 6

Expert Comment

by:caza13
Comment Utility
Resource Hacker™ has been designed to:

1. View resources in Win32 executable files (*.exe, *.dll, *.cpl, *.ocx) and in Win32 resource files (*.res) in both their compiled and decompiled formats.



For example:

1 VERSIONINFO
FILEVERSION 4,8,1,881
PRODUCTVERSION 4,8,1,881
FILEOS 0x10001
FILETYPE 0x2
{
BLOCK "StringFileInfo"
{
      BLOCK "040904E4"
      {
            VALUE "CompanyName", "Microsoft Corporation"
            VALUE "FileDescription", "Microsoft PID"
            VALUE "FileVersion", "4.08.01.0881"
            VALUE "InternalName", "PID.DLL"
            VALUE "LegalCopyright", "Copyright © Microsoft Corp. 1994-2001"
            VALUE "OriginalFilename", "PID.DLL"
            VALUE "ProductName", "Microsoft® DirectX for Windows®  95 and 98"
            VALUE "ProductVersion", "4.08.01.0881"
            VALUE "OLESelfRegister", ""
      }
}

BLOCK "VarFileInfo"
{
      VALUE "Translation", 0x0409 0x04E4
}
}


If your .dll file isn't Win32 executable it can't be opened by Resource Hacker.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Thanks for the update, that sheds some light on the origin and nature of the file(s).

I believe that what you had while accessing that online site via a toolbar, or similar type of application, were "data" files that acted as databases to store your settings, preferences, etc.  Although you say that "it is strictly text that defines the criteria", and you would therefore have thought that the files would be in some type of editable or legible as text when opened, what coral47 has stated about files in "binary" format is probably true of them.

"Conversion" takes place when the correct application loads and interprets that file as having the type of content it needs and expects.  For instance the *.qif file type used by the application Quicken, contains text when viewed in a standard text editor, but also contains particular non-printable characters that allow it to load into MS Money or Quicken to display the contents in a tabular format like a spreadsheet.  The process is reversed where you have an application that has a function to export data into a variety of other file formats.

We still haven't confirmed whether the file contents that you copied from notepad and pasted below your question ARE from a file named "inventory.as".

The "MSCF" right at the start still steers me towards the idea that this file is or has been subjected to some kind of packaging and/or compression, or IS a package rather than a single file.  I suggested the possibility earlier that MSCF is an acronym used for "MicroSoft Cabinet File".

Let me demonstrate something for you, if you just follow my directions and do likewise:

1. Start Menu > "Run" option > and type WINREP > then click "OK"
2. Without touching anything, Click the "Next" button and the "Save As" dialogue will appear
3. Browse to your desktop or somewhere like that, or just leave it as c:\windows\helpdesk\winrep
4. Leave the suggested file name or change it to something like "test", and it will save as a .cab file
5. Close Winrep
6. Locate the .cab file you just created,
7. Hold the SHIFT key, and RIGHT click the file
8. Select the "Open With" option
9. UNCHECK the box at the bottom "always use this program to open files of this type"
10. Scroll down to, and double-click on NOTEPAD
11. The file will be too large, and will open as plain text in Wordpad if you let it.

Look at the first entry, and you will see MSCF and somewhere on the first few lines you will see something like these text strings (if you saved to the default folder):

C8\WINDOWS\helpdesk\winrep\$$$.brt
C8\WINDOWS\helpdesk\winrep\$$$.nfo

Those are actually the files that Winrep.exe packed into this .cab file, and if you unpacked it with Winzip, it would create the folders listed in front of the file name.  The files would eventually be found in the final sub-folder named "winrep".

If you compare the contents of YOUR file, you will see that they are remarkably similar.

The reason I have gone to such lengths to do this by demonstration goes back to my earlier comment where I suggested that you try renaming one of the files to .CAB instead of whatever file extension they currently show.

If my hunch is correct, you MIGHT have a .CAB file that has lost its file extension, been renamed as another file type, or your Windows Explorer "Folder Options > View" settings are hiding the file extensions of known file types.  .CAB files won't always automatically show the slightly fancy open folder icon, but instead might have the standard windows flag icon used for unknown file types.  IF it IS a .CAB file, then viewing it in Notepad (as you pasted earlier) is showing "inventory.as" as the single file packed into it.

When you download MS Office Templates and the like from a Microsoft site, they download as .CAB files that you have to unpack with WinZip to get at the contents.  Their reason for using .cab files is that Online "download and install" processes will unpack the .cab file to your TEMP folder, copy the files to where they should be, and then delete the .cab file.  More normally they end up left over in your TEMP folder.

Are you seeing all the file extensions in Windows Explorer?

Tools > Folder Options > "View" tab
Set it to show all files and not to hide known extensions
Click "Apply"
Close and reopen Windows Explorer and see if the files now show a file extension.

If this WAS the case, then NOW try renaming one of the files and include .CAB at the end of the file name, or change it from what it was showing.

RIGHT-Click the files you have and select "Properties".  What does it say under the section "MS-DOS Name"?

Unfortunately, even IF this is or was a .cab file AND DOES contain the file "inventory.as", then it still won't help you unless the .as file is editable in NotePad or you still have an installed application that sets a file association and allows it to be opened.

This is where PEEK might help, and my above suggestions about viewing ALL files might be hiding PEEK.INF from you.  You said in your most recent feedback comment:

"I downloaded Peek.dll to the desktop and can’t find peek.inf. This is what I get when I open peek.dll with notepad".

You DON'T need to open peek.DLL, but the peek.INF file SHOULD be in that download.  I've just tested it again, and the downloaded zip file most definitely contains Readme.txt, peek.DLL, and peek.INF.

Have another go with it and see if you can locate peek.inf.  This utility allows you to see an awful lot about what the file contents are.

As far as the Deluxe Stock Screener that allowed you to interface with MSN's stocks and shares, I can only imagine that they have discovered some security exploit or a loophole that compromises security, and have chosen to only allow you to save profile info on THEIR servers instead of downloading content to your computer.

To answer your question about the CD that I referred to, I think you are talking about my suggestion to install QuickView from your Windows CD.  As you already have it installed, just ignore this.

Bill
0
 
LVL 13

Expert Comment

by:gonzal13
Comment Utility
BillDll:

I have learned allot from your very detailed comments. you certainly, as I do, enjoy helping members

gonzal13(joe)
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
I certainly do enjoy trying to help, Joe.  I just wish I could get my hands on those files to dig into them and see what I can make of them, but I suspect that they may contain some personal settings created by frankoravec while dealing in stocks and shares and it might not be appropriate for anyone else to see the content.

Maybe we could make some money investing in something that he was onto as a real earner, like google shares  :-)

frankoravec.

Are these files likely to contain info that nobody else should see?  If not, do you have the facility to zip a couple of them up in WinZip with password protection (using your login name) and upload them somewhere for us to download from a link placed here?  My hotmail email address is in the 12th comment above this if you wish to email it to me.  If you prefer not to, and I am not pressurising you in any way because all members reserve the right to privacy and anonymity on EE, please feel free to email me with the files as attachments.  I would provide all the necessary feedback in this question without involving myself in discussion outwith EE.

Bill
0
 

Author Comment

by:frankoravec
Comment Utility
I did the WINREP thing and the only thing that looked familiar to me was my recollection of your comment that mentioned inventory.as file. That struck a note because each of the eleven files that I have contain inventory.as in the first line. Also, I believe that I was in error stating that they were .txt files. All I know is that my files, when created, were text and numerals. Previously, I did check properties on all the files and they are MSDOS .INV files.
I'm not ordinarily a quitter, but I'm going to take you up on your offer to look at the files yourself. I'm about at the end of my rope with this stuff and in way too deep for comfort.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Thanks.  Got the emailed attachment, but unfortunately it is a shortcut to a folder that must have existed on your desktop containing the files.  The attachment is a .LNK file, which is a standard windows shortcut.  You won't normally see the file type except by doing a Right-Click > "Properties" on it and looking at the MSDOS Name.  In this case, the attachment comprises the file "deluxe stock screener files.lnk" and the "Target" is shown as "C:\WINDOWS\Desktop\deluxe stock screener files".

You possibly have the default option of making shortcuts display the small black arrow turned off and hadn't noticed that this was a shortcut.  It wouldn't have been possible to select an entire folder and send it as an attachment.  It would force you to select one or more files from within the folder.

Not sure how this came about, but maybe you could use WinZip or something and zip up the folder as a single zip file and email that as an attachment.

Assuming that you have Winzip installed, and that it is set to show the right-click menu option, just Right-Click on the actual folder on your desktop, and select "Add to deluxe stock screener files.zip".  This will create a zip file that can then be emailed as an attachment.  I will then report back with my full findings here.

Failing that, just email 2 or 3 of the separate files as attachments.  Unless they contain code that is seen by ISP's and virus scanners as potentially dangerous, they should arrive OK.

Regards
Bill
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Thanks, Frank.  Received the zipped file OK this time.  That was strange what happened before.

Let me explain for the benefit of continuity in this question what I immediately notice:

Several files with names that appear as
eg. A73607C153E1B64AA93D7722FCCDA64FCC8E17CD.inv

2 things immediately struck me about the file names.  The .INV file types, and the fact that the naming conventions appear to be similar to registry keys or, more correctly, CLSID's (Class Identifiers) or GUID's (Globally Unique Identifiers).

Here's a key taken at random from HKEY_CLASSES_ROOT\CLSID with the file name of one of the .INV files shown below it, but broken into chucnks with -'s

{A73BEEB2-B0B7-11D2-8853-0000F80883E3}
{A73607C1-53E1-B64A-A93D-7722FCCDA64F   CC8E17CD

Remarkably similar, wouldn't you say, but obviously exceeds the length of a standard CLSID.  It's certainly a hexadecimal value, and you can imagine the uniqueness of a hex number that length.  Uniqueness would obviously be a requirement if this kind of file related to monetary matters.

So, what's an .INV file.  Obviously it implies "inventory", but what created it?

From http://filext.com/detaillist.php?extdetail=INV, here's the possibilities:

INV Rogue Spear Inventory File  
INV Windows Update file  
INV Lineage Inventory File (NCsoft Corporation)
INV dnaLIMS Invoice File (dnaTools)

I reckoned the "Windows Update file" to be the most likely until I spotted the one at the bottom that has yet to be fully documented by them:  MoneyCentral.Investor.Inv.10 - MSN Money Investor File, which explains the "INV" in the context of "INVestor".

I keep going back to my hunch based on the acronym right at the start of the file's contents, namely "MSCF" and the Hex Signature 4D 53 43 46, which I deduced could be an acronym for "MicroSloth Cabinet File".  This fitted in with what I believed to be a packaged file named "inventory.as".

I was puzzled about what the .AS file type would be, and quoted possibilities from http://filext.com/detaillist.php?extdetail=as&Submit3=Go%21.

My leaning was towards a "spreadsheet" of some kind, which would go along with the "financial" aspect, but I hadn't noticed that one of the "yet to be documented" ones on that page related to the compression program "Stuffit" (StuffIt.Encoded.File.Expand - StuffIt Encoded File).  That would make sense in relation to a compressed file.

Here's what I've done so far:

1. Renamed one of the files to a short numeric name with a .CAB extension rather than the existing .INV one

2. Extracted the contents with WinZip to the file "inventory.as".  This does not work if you rename the file as a .zip file.  WinZip will report that it is an invalid archive.

3. Renamed the "inventory.as" file as txt, doc, rtf, wri, and a variety of other formats.  It is no more legible in Word or WordPad than in NotePad, so the symbols are not formatting ones used by a rich-text editor.  As an .xls file, it isn't in a format recognised by Excel, and renamed as a .csv file doesn't help to open it in Excel either.

Renaming as a .reg file won't help, because a .reg file is really just a plain ascii text file anyway, and it certainly isn't a database file or powerpoint file that is recognised by the respective MS Office applications.

I have deduced from the legible content that this is a setup file with a roughly similar content as an .INS file, but haven't yet cut through the non-printable characters to see exactly what it did or what registry entries etc it created.  This result surprises me, as I felt that it would probably be some type of tab or comma-separated database record of user settings originally set by the program that allowed interaction with the MS Stocks and Shared search.

I will update further once I've checked this out a bit more.


0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
Frank, here's my final verdict.

Here's a snippet from the first .as file I looked at after removing all the non ascii (non-printable) characters.  I am not completely sure whether this is the response file that has logged what Windows Update detected, or whether it is the instuction file that is telling Windows Update to check if certain files exist as specified versions or higher.

My feeling is that this is the response file that first asks the question, and then compiles the results.  Based on what it finds, Windows Update will then suggest what updates are required, or just install them automatically after performing the check.

In any event, it is clear that these files are NOT data files storing your preferences saved while accessing the Microsoft "Deluxe Stock Screener" website.  It could well be that the interaction required that certain patches and updates were applied before the site was accessible, and this could be accounted for by what I think is Internet Explorer firstly being updated to allow for 128-bit encryption.  This is a pre-requisite of Internet Banking, and Internet Explorer 5 as installed in a standard Win98 installation (but not 5.01) has to be updated this way with a patch.

This is what I think the process is doing, but I would have to verify this by actually checking a live Windows update session.

***
Windows Update .dll called to check if the file RSAENH.DLL (Microsoft Enhanced Cryptographic Provider) exists in EITHER the directory c:\windows\system32 OR (symbol || means OR) in directory c:\windows\system.
***

wudetect.dll,Expression 8
_DetExpr=E1 || E2
_E1=FileVer,windir,system32\rsaenh.dll
_E2=FileVer,sysdir,rsaenh.dll

***
Windows Update .dll called to check if the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{long-id-number}
exists and, if so, whether the value matches the version number 5,50,4207,2800 or is a more recent version.  I don't know what this relates to, because my registry doesn't have the key {BC4D15E2-66F9-40CB-8AE1-E1405D3D08B9} listed.  The && symbols mean AND, so it seems to need to know if a DWORD value in that key named "IsInstalled" indicates a 1 for Yes.
***

wudetect.dll,Expression 8 ,_DetExpr=E1 && E2

_E1=RegKeyVersion,HKLM,Software\Microsoft\Active Setup\Installed Components\{BC4D15E2-66F9-40CB-8AE1-E1405D3D08B9},Version=,"5,50,4207,2800"

_E2=RegKeyExists,HKLM,Software\Microsoft\Active Setup\Installed Components\{BC4D15E2-66F9-40CB-8AE1-E1405D3D08B9},IsInstalled,DWORD,1

***
It then appears to need to check if the update patch "Q261255" has already been installed.  This is an Outlook Express update listed here: http://support.microsoft.com/default.aspx?scid=kb;en-us;261255&sd=tech.
***

wudetect.dll,Expression 8
_DetExpr=E1 && E2
_E1=RegKeySubStr,HKLM,Software\Microsoft\Windows\CurrentVersion\Internet Settings,MinorVersion,sz,"q261255"

_E2=RegKeyExists,HKLM,Software\Microsoft\Active Setup\Installed Components\{3CA73EDC-4EE6-4548-8064-268921E8BD50},IsInstalled,DWORD,1

There's no sense in detailing the contents of the rest of this first file, because it follows in the same pattern performing a thorough check of your Windows installation and other MS Application components as you would expect from Windows Update.

Each of the renamed .inv files work equally well as .cab files to extract a copy of inventory.as from within them.

ALL of the inventory.as files extracted from the .cab files follow exactly the same format, but examine different areas of the installed version on the target computer, eg. one looks at Internet, another looks at Media Player and other components like Games, etc.

I am quite sure that these files have absolutely no significance or connection with Microsoft's "Deluxe Stock Screener" apart from the possibility that it was something that was foisted onto your system as a compulsory check before you were allowed to access the site and interact with it.  That would certainly account for the fact that the files seem to be the residual settings or data files for your foray into the online world of Stocks and Shares.

Sorry if this is a disappointment to you.  I can email you the files back if you wish, but in my opinion there is no sense in pursuing this further unless there are some other files that you would like me to inspect and untangle.

What I am NOT sure of is whether Windows Update would need to consult these files for verification to save it having to run through the same palaver again when run.  In their ziped format, the files are only 93 KB in size, and unpacked are about 650 KB along with their extracted content, so space isn't really a concern if you decided to keep the files.

I can try and ascertain whether the files are needed by Windows Update again, but I would delete them if it were me.  I don't use Windows Update for Win98 as I have all the updates stored locally that I need.

Regards

Bill
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
I don't suppose that you have a lot more of these .INV files on your system and, by pure unfortunate coincidence, emailed me the handful that happen to be "Windows Update Files", where others MIGHT be the undocumented ones mentioned in an earlier command and detailed as "MSN Money Investor Files"?

If so, I reckon you would get an immediate idea by doing as I did and then using "PEEK" to inspect the extracted .AS files.

Just a thought.
0
 

Author Comment

by:frankoravec
Comment Utility
I have the 11 files I sent to you, the same 11 in C:\Window\Update folder and the same 11 unzipped. They are all one and the same.
0
 
LVL 38

Accepted Solution

by:
Insignificant Volunteer earned 125 total points
Comment Utility
Pity about that Frank.  Well, that's my final conclusion then - files created and left over from one or more Windows Update sessions.

Regards
Bill
0
 

Author Comment

by:frankoravec
Comment Utility
BillDL,
You certainly deserve a big A for effort and I know that you truly wanted to help me.
Experts Exchange can really be proud to have you on ther team.
Thank you.
0
 
LVL 38

Expert Comment

by:Insignificant Volunteer
Comment Utility
You're right there, Frank.  I really had hoped that we might recover some of your old settings/data files from your stocks and shares adventures.  I hate it when the conclusion doesn't find what it needed, but at least there is a final resolution.  The only thing that I hate more than that is when a resolution cannot be found, ie. just some weird quirk of Windows that couldn't be explained, accounted for, or fixed.

As I said before, your questions certainly are some to get your teeth into.  I've kind of backed away from the typical error message questions, and "my computer won't start" ones because I like these interesting ones.

Thank you, Frank.
0

Featured Post

Wish Marketing would stop bothering you?

Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

Join & Write a Comment

Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now