VOGONS


Strange Mystery Files?

Topic actions

First post, by rfnagel

User metadata
Rank Oldbie
Rank
Oldbie

(Mods, sorry if I posted this in the wrong section, wasn't sure which forum to post it in)

Hi Folks,

I was wondering if anyone might know the origin of these files. A Google search results in almost nothing, with only a rare obscure mention here and there to the effect of "I found these on my hard drive, what are they?".

Here are the files (listing from my current P4 2.666GHZ running Windows XP SP2):

C:\WINDOWS
08/03/2004 09:51 PM 12,955 GUXBPI.DLL
08/03/2004 09:51 PM 4,323 LISTDR.EXE
08/03/2004 09:51 PM 16,955 RESDUX.DLL
08/03/2004 09:51 PM 11,907 ROP12.EXE
08/03/2004 09:51 PM 14,907 SERPOP.EXE
08/03/2004 09:51 PM 6,932 VIR32Z.DLL
08/03/2004 09:51 PM 4,422 WAPSYS32.DLL
08/03/2004 09:51 PM 6,332 ZSCAPP.EXE

C:\WINDOWS\SYSTEM
08/03/2004 09:51 PM 4,808 MAPX16W6.DLL
08/03/2004 09:51 PM 19,466 MAPX32W6.DLL
08/03/2004 09:51 PM 5,554 MCIOLPE.DLL
08/03/2004 09:51 PM 4,889 MIXPOT.DRV
08/03/2004 09:51 PM 7,489 MMECPY.DRV
08/03/2004 09:51 PM 18,466 MXP32Z.DLL
08/03/2004 09:51 PM 14,643 PCISYS32.DRV
08/03/2004 09:51 PM 6,554 TIPCONV.DLL
08/03/2004 09:51 PM 17,643 VGASYS2.DRV

All of the files are completely binary (with no readable text or version information contained in them), and the EXEs are *NOT* actually executables (they don't run). A virus scan using several anti-virus packages results in nothing (all of them are clean).

Almost all of the files that are close in filesize (such as ROP12.EXE and GUXBPI.DLL) have the exact same contents, with additional binary data appended at the end of the larger of the two files.

Now, for the extremely strange things:

I have found these exact same files on my old 486DX100 (circa 1992-2009), my P233MMX (circa 1997-2008), as well as my current new(er) PC (P4 2.666GHZ). The 486 has MS-DOS v6.22 with WFWG311, the P233MMX has Windows 98 SE, and the P4 has Windows XP with SP2. I have also found these files on my father's P4 2.8GHZ running Windows XP with SP3.

These files are *NOT* on my mother's Dual Core 3GHZ PC (running Windows XP with SP3), or on my old AMD500 (circa 2001-2009, running Windows 98 SE). In the case of my AMD500, I primarily used that PC for about a year and a half (it was on more than it was off <G>), before building up my current P4 (that I've been using 100% for about 6 months now).

Another *REALLY* strange thing:

On each of the PCs that I've found these files on, the date stamps of *ALL* the files are *EXACTLY* what the current installed OS is:

e.g.

WFWG311 - 11/01/1993 03:11 AM
W98SE - 04/23/1999 10:22 PM
WXPSP2 - 08/03/2004 09:51 PM

etc...

Any idea of where these came from? Apparently it just HAD to have been something that I've installed on the PCs in question at some time or another (prolly some real *OLD* software, I'm sure <G>), and strangely enough, they are not on my AMD500 (which I used extensively for about a year and a half, and had installed a LOT of software on; especially old stuff).

Rich

[...who HATES 'mystery files', including the "System Volume Information" directory... that I just recently figured how to get in to <LOL>!]

Rich ¥Weeds¥ Nagel
http://www.richnagel.net

Reply 1 of 5, by ripsaw8080

User metadata
Rank DOSBox Author
Rank
DOSBox Author

Executables, including DLLs, will usually have *some* readable text in their headers or library dependencies, even if they are compressed with UPX or some such. Do they at least start with the (in)famous "MZ" executable signature? If not, then they are data files masquerading as executables, and that doesn't sound like a good thing. In addition to virus scans, have you checked for malware on the machines in question? I've used SpyBot Search & Destroy to clean the machines of several friends that weren't very careful about the stuff they downloaded and ran on their machines... BonziBUDDY indeed... 😜

Reply 2 of 5, by rfnagel

User metadata
Rank Oldbie
Rank
Oldbie
ripsaw8080 wrote:

Executables, including DLLs, will usually have *some* readable text in their headers or library dependencies, even if they are compressed with UPX or some such.

Yep yep, quite true.

ripsaw8080 wrote:

Do they at least start with the (in)famous "MZ" executable signature?

Nope, nothing at all but binary 'gobbledygook'.

ripsaw8080 wrote:

If not, then they are data files masquerading as executables, and that doesn't sound like a good thing. In addition to virus scans, have you checked for malware on the machines in question? I've used SpyBot Search & Destroy to clean the machines of several friends that weren't very careful about the stuff they downloaded and ran on their machines... BonziBUDDY indeed... 😜

Yep, I tried SBS&D (as well as AdAware) on the PCs that I could (couldn't run them on the MS-DOS PCs, of course), nada. Real strange that Googling and Yahooing doesn't result in any info on these files.

P.S. Really strange about those files on the 486... I haven't installed any new software or used that PC 'seriously' for quite a few years now... those files must have 'popped' up literally eons ago.

Rich ¥Weeds¥ Nagel
http://www.richnagel.net

Reply 3 of 5, by rfnagel

User metadata
Rank Oldbie
Rank
Oldbie

Mystery files solved!

OK. So I did a bit of thinking, and was trying to remember what 16-bit Windows programs that I had installed on the PCs that had the files (including my ancient 486, as well as my current PC), but hadn't installed on the PCs that didn't have the files. I then used Total Commander's file search feature that can look for any given text contained in a group of files.

Apparently, these files must have been generated/copied by some old MIDI software that I used to use by a long-since gone company "Roni Music Software" ( dead link -> http://home1.swipnet.se/~w-11396 - Wayback Machine archive -> http://web.archive.org/web/19981203145624/htt … net.se/~w-11396 ). The program are relatively little-known MIDI sequencers and utilites, the "Sweet" line of products:

"Sweet MIDI Player" -> SWMIPL.EXE
Contained the following text:
GUXBPI.DLL
MXP32Z.DLL
PCISYS32.DRV
ROP12.EXE

"Sweet MIDI Harmony Maker" -> SWMIHARM.EXE
Contained the following text:
LISTDR.EXE
MMECPY.DRV
TIPCONV.DLL
VIR32Z.DLL

"Sweet Little Piano" -> SWLIPI16.EXE
Contained the following text:
MAPX16W6.DLL

"Sweet Sixteen MIDI Sequencer" -> SWEET_16.EXE
Contained the following text:
MAPX32W6.DLL
RESDUX.DLL
SERPOP.EXE
VGASYS2.DRV

"Sweet MIDI Arpeggiator" -> SWMIARP.EXE
Contained the following text:
MCIOLPE.DLL
MIXPOT.DRV
WAPSYS32.DLL
ZSCAPP.EXE

The explaination as to why these were on my current PC was simply when I first installed WinDoZe XPee... experimenting to see what would and would not function under it <BG>. And of course, they were on my 486, as that was my primary MIDI composing PC up until several years ago.

I must have at some point in time also installed the utilities on my P233MMX (to see if they would work under W98SE), but apparently never got around to installing them on my AMD500 (but, I never had a MIDI keyboard connected to that PC in the first place).

Anyhow, file mystery solved <G>! 😀

P.S. I have a hunch the files are prolly used for copy protection by the afore-mentioned software.

Rich ¥Weeds¥ Nagel
http://www.richnagel.net

Reply 4 of 5, by leileilol

User metadata
Rank l33t++
Rank
l33t++
Another *REALLY* strange thing: […]
Show full quote

Another *REALLY* strange thing:

On each of the PCs that I've found these files on, the date stamps of *ALL* the files are *EXACTLY* what the current installed OS is:

e.g.

WFWG311 - 11/01/1993 03:11 AM
W98SE - 04/23/1999 10:22 PM
WXPSP2 - 08/03/2004 09:51 PM

etc...

Microsoft always had a habit to re-stamp the time of the files to the build time, it applies to more than just their operating systems, but their entertainment titles as well.

apsosig.png
long live PCem

Reply 5 of 5, by rfnagel

User metadata
Rank Oldbie
Rank
Oldbie
leileilol wrote:

Microsoft always had a habit to re-stamp the time of the files to the build time, it applies to more than just their operating systems, but their entertainment titles as well.

Yes, I've seen that (annoying) behavior before with MS stuff.

In the case of the "Sweet" line of products though, I think that those MIDI utilities are the ones that are actually re-stamping the times of the files when initially copying them to their respective directories (probably part of their copy protection, which is what I have a hunch that the original purpose of the files are).

Or, maybe they time-stamp the files to the OS's build time simply to attempt to hide them from the user with the rest of the cazillion files that make up the OS (re: a copy protection thing again).

Rich ¥Weeds¥ Nagel
http://www.richnagel.net