[Every1is=]

http://www.virustotal.com/file-scan/rep ... 1305815260

I was trying the "new" Google Chrome BitDefender Quickscan extension and it found 1 infected file. Assuming it was a false positive, but wanting to know for sure, I ran it through VT, almost a 10% hitrate as you can see in the link. So at this moment I am unsure what to think about it.

Bitdefender quickscan reports:
C:\Windows\system32\explorer.exe --> Worm.Generic.324167 --> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell"

The explorer.exe file in System32 MD5: 8b88ebbb05a0e56b7dcc708498c02b3e C:\Windows\system32\explorer.exe
And the C:\windows\explorer.exe MD5: 332feab1435662fc6c672e25beb37be3 C:\Windows\Explorer.exe

Running on Windows 7 x64 Pro, SuperAntiSpyware and Eset Smart Security installed on the system.

False positive? Or new beasty?

[EP_X0FF]

False positive? Or new beasty?

This is 32 bit version of Explorer. It is inside SysWow64 folder, not in System32.
Yes, this is false positive. Probably it's because scanner is 32 bit.

[Every1is=]

Ok. Thanks!
But... how does it work then? The file really is in that location. (?)

[EP_X0FF]

File System Redirector

[Every1is=]

LOL, I love you
I did know about the symbolic links, but not about this. (yep, I understand these are 2 totally different things)

[zico_guru]

Is default kenrel path is (C:\windows\system32\) in windows 7? or is redirected?....plz help

[EP_X0FF]

Is default kenrel path is (C:\windows\system32\) in windows 7? or is redirected?....plz help

What does the following mean?

[zico_guru]

is system file like winload.exe,kdcomm.dll,windows kernel, is redirected to another place in harddisk?i mean where is the path of those file ? is it "C:\windows\system32"?
i am getting problem in reversing those file in ida pro....plz help

[EP_X0FF]

is system file like winload.exe,kdcomm.dll,windows kernel, is redirected to another place in harddisk?i mean where is the path of those file ? is it "C:\windows\system32"?
i am getting problem in reversing those file in ida pro....plz help

I answered on this question few posts before.