Strange file in %userprofile%\AppData\Local

AndyTampa

Member
What is the System File in %userprofile%\AppData\Local named "ℤ™☠" (without the quotes)?

It is only 8 bytes large and was last modified 12/9/12.

Is it supposed to be there?

Is it from an infection?
 

My Computer

System One

  • Operating System
    Windows Vista Home Premium SP2, 32-bit
    Manufacturer/Model
    Retrofitted Refurbished Gateway
    CPU
    AMD
    Motherboard
    ASUS M3A78-EM
    Memory
    4 GB
    Monitor(s) Displays
    Acer 22-in Flat Screen Monitor
    Keyboard
    Logitech K350 Wireless Keyboard
    Mouse
    Logitech M705 Wireless Mouse
Run a full antivirus scan
Download and run a full scan with Malwarebytes
Use eset online scanner and make a scan. This one catches a lot.
 

My Computer

System One

  • Manufacturer/Model
    Dell XPS420
    Memory
    6 gig
    Graphics Card(s)
    ATI Radeon HD3650 256 MB
    Sound Card
    Intergrated 7.1 Channel Audio
    Monitor(s) Displays
    Dell SP2009W 20 inch Flat Panel w Webcam
    Hard Drives
    640 gb
    Cooling
    Fan
    Keyboard
    Dell USB
    Mouse
    Dell USB 4 button optical
    Other Info
    DSL provided by ATT
Googling the filename suggests another possibility: Did you purchase Verizon Wireless from a Z Wireless retailer?
 

My Computer

System One

  • Operating System
    Vista Home Premium x86 SP2
    Manufacturer/Model
    HP Pavilion Elite m9150f
    CPU
    Intel Q6600
    Memory
    3 GB
    Graphics Card(s)
    NVIDIA GeForce 8500 GT
Googling the filename suggests another possibility: Did you purchase Verizon Wireless from a Z Wireless retailer?

I performed a Google search, but G will not search for those characters. It transcribed them into ZFS and searched for that. Those are ALT characters. To answer your question, this is my Desktop and I do not have Verizon Wireless on it and I wouldn't know what a Z Wireless Retailer is.

Richc46, I cannot run Malwarebytes on my computer. It is incompatible with my Kaspersky Internet Security. I uploaded the file to VirusTotal and no virus was detected and not by my Kaspersky either. However, that doesn't mean it isn't a piece of something else which could signal an infection or it could be an actual Microsoft system file. Nobody has told me yet if it is or isn't in their system. It could also be a file from something I have installed.

Does anyone else have it?
 

My Computer

System One

  • Operating System
    Windows Vista Home Premium SP2, 32-bit
    Manufacturer/Model
    Retrofitted Refurbished Gateway
    CPU
    AMD
    Motherboard
    ASUS M3A78-EM
    Memory
    4 GB
    Monitor(s) Displays
    Acer 22-in Flat Screen Monitor
    Keyboard
    Logitech K350 Wireless Keyboard
    Mouse
    Logitech M705 Wireless Mouse
By the way, if I look at the file from a command prompt window, it is a Hidden & Read-Only file named "ZT?". The question mark is part of the file name. It is not a wild card. I can't Google that either. It only brings up for .ZT files. This file does not have an extension. It's name is "ZT?" in a command prompt and "ℤ™☠" in Windows Explorer.
 

My Computer

System One

  • Operating System
    Windows Vista Home Premium SP2, 32-bit
    Manufacturer/Model
    Retrofitted Refurbished Gateway
    CPU
    AMD
    Motherboard
    ASUS M3A78-EM
    Memory
    4 GB
    Monitor(s) Displays
    Acer 22-in Flat Screen Monitor
    Keyboard
    Logitech K350 Wireless Keyboard
    Mouse
    Logitech M705 Wireless Mouse
There is no such file on my system. Have you looked at the file properties for clues? Did you own the PC in 2012? Where did you buy your router? I was perfectly sincere regarding Google results:

Z Wireless.JPG

It's a good sign that VirusTotal detected nothing. You could move the file and see if that breaks something.
 

My Computer

System One

  • Operating System
    Vista Home Premium x86 SP2
    Manufacturer/Model
    HP Pavilion Elite m9150f
    CPU
    Intel Q6600
    Memory
    3 GB
    Graphics Card(s)
    NVIDIA GeForce 8500 GT
I have no doubt that you put that text in the search box, there are no results. All results begin with Z instead of ℤ, which is a different character. It is Hidden and Read-Only, so you won't see it unless you are viewing Hidden files and Protected System files.

I searched my entire computer for all files created on that date and found the majority are overwhelmingly from Roboform, but some seem to be found in other files and locations.

I have written to Roboform and asked them if it is their file. I had uninstalled Roboform a few months ago and don't know why I found 200 other files from it. They have responded and said it doesn't look like one of their files.
 
Last edited:

My Computer

System One

  • Operating System
    Windows Vista Home Premium SP2, 32-bit
    Manufacturer/Model
    Retrofitted Refurbished Gateway
    CPU
    AMD
    Motherboard
    ASUS M3A78-EM
    Memory
    4 GB
    Monitor(s) Displays
    Acer 22-in Flat Screen Monitor
    Keyboard
    Logitech K350 Wireless Keyboard
    Mouse
    Logitech M705 Wireless Mouse
Does anyone else have this file on their computer?
 

My Computer

System One

  • Operating System
    Windows Vista Home Premium SP2, 32-bit
    Manufacturer/Model
    Retrofitted Refurbished Gateway
    CPU
    AMD
    Motherboard
    ASUS M3A78-EM
    Memory
    4 GB
    Monitor(s) Displays
    Acer 22-in Flat Screen Monitor
    Keyboard
    Logitech K350 Wireless Keyboard
    Mouse
    Logitech M705 Wireless Mouse
It's a good sign that VirusTotal detected nothing. You could move the file and see if that breaks something.

Generally unless you know what a file does if you didn't create it you shouldn't touch it. Now since it passed a Virus total scan then you really don't have anything to worry about. So you can leave it or risk breaking something by removing it. Personally I would leave it. But you can follow Vistaar's suggestion and move it and the continue to use your system and look for any issues.

It is incompatible with my Kaspersky Internet Security.

This should not be the case since malwareabytes isn't antivirus software. Worst case scenario is that either software detects the other as a threat. Do you have something to the contrary from Kaspersky?
 

My Computers

System One System Two

  • Operating System
    Windows 8.1 Industry Pro x64
    Manufacturer/Model
    HP Pavillion Elite HPE-250f
    CPU
    Intel i7 860 Quad core 2.8 ghz
    Memory
    8 gb
    Graphics Card(s)
    ATI Radeon HD 5770 1 gb ram
    Monitor(s) Displays
    Alienware 25 AW2521HF
    Screen Resolution
    1920x1080 &1680x1050
    Hard Drives
    1 TB x2
    Other Info
    https://www.cnet.com/products/hp-pavilion-elite-hpe-250f/
  • Operating System
    Windows 2012 R2 Data center/Linux Mint
    Manufacturer/Model
    Dell Poweredge T140
    CPU
    i3 9100 3.6GHz, 8M cache, 4C/4T
    Memory
    8GB 2666MT/s DDR4 ECC UDIMM
    Screen Resolution
    1680x1050
    Hard Drives
    1 TB & 360 GB x2
    Other Info
    https://www.dell.com/en-us/work/shop/productdetailstxn/poweredge-t140?~ck=bt
This should not be the case since malwareabytes isn't antivirus software. Worst case scenario is that either software detects the other as a threat. Do you have something to the contrary from Kaspersky?
My memory is not the greatest, but I believe Kaspersky refused to complete the install until it was removed. My Kaspersky isn't just anti-virus software either. It is Kaspersky Internet Security which also looks for malware, phishing email, spam, anti-virus, spoof sites, and network threats.
 

My Computer

System One

  • Operating System
    Windows Vista Home Premium SP2, 32-bit
    Manufacturer/Model
    Retrofitted Refurbished Gateway
    CPU
    AMD
    Motherboard
    ASUS M3A78-EM
    Memory
    4 GB
    Monitor(s) Displays
    Acer 22-in Flat Screen Monitor
    Keyboard
    Logitech K350 Wireless Keyboard
    Mouse
    Logitech M705 Wireless Mouse
Back
Top