File Investigation Report
NTSD.EXE
Currently being reviewedThe most common objects with the name of NTSD.EXE have yet to be classified as safe by our research department.
If you are concerned that your PC might be infected why not try our Free Prevx Scanner. It will thoroughly check your PC for millions of active Spyware and malware infections and takes less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx.
File Behavior
NTSD.EXE has been seen to perform the following behavior:
- Registers a Dynamic Link Library File
- Injects code into other processes
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Uses DNS to retrieve the IP address for web sites
- Uses your PC to connect to Chat rooms
NTSD.EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Deleted as a process from disk
- Registered as a Dynamic Link Library File
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename NTSD.EXE was first seen on Apr 23 2008 in the following geographical regions of the Prevx community:
- The UNITED KINGDOM on Apr 23 2008
- SPAIN on Apr 25 2008
File Name Aliases
NTSD.EXE can also use the following file names:
- 24105998.SVD
Filesizes
The following file size has been seen:
- 209,374 bytes
- 41,472 bytes
- 51,712 bytes
- 38,400 bytes
- 43,008 bytes
- 115,931 bytes
- 65,670 bytes
Vendor, Product and Version Information
Files with the name NTSD.EXE have been seen to have the following Vendor, Product and Version Information in the file header:
- Microsoft Corporation; Symbolic Debugger for Windows 2000; 5.1.2600.0 (XPClient.010817-1148)
- Microsoft Corporation; Symbolic Debugger for Windows 2000; 5.1.2600.0
- ; ; 1.0.0.0
File Type
The filename NTSD.EXE is used by multiple object types including executable programs,objects.
File Activity
One or more files with the name NTSD.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\docume~1\user\locals~1\temp\fsa7.tmp