Trojan or not ?

fdegrove,

Welcome to the forum!

If you want to be sure NTUSER.rhk is not malware, scan the file with VirusTotal:
https://www.virustotal.com/

It is a free online scanning service.

Please post the scan results URL address in your next reply.

fdegrove,

If you deleted NTUSER.rhk, there is no point in using VirusTotal, since it has to scan the file.

The file appears to be an application/octet-stream

fdegrove said:

Hi all,

Not quite sure when this started but roughly somewhere around July I noticed a file called NTUSER.rhk that resides in
"Users\My username".

Googling for the .rhk file extension gave me a bit of a scare as most sites suggest this is associated with Trojan.
Somehow I doubt it as no anti-virus software I ran seems to flag it.
I can delete this file all I want but it keeps on cropping up.
It only resides in my user folder together with NTUSER.DAT.
Does anyone have a clue what it's for or have it too ?

TIA,

Hi.
I just checked and I don't have it in my AU system/user folder. I agree, if it pops up again, upload it to virustotal.com and see what the scanners say about it. If it keeps coming back, that could be a sign of a rootkit. Will be interesting to see what the virustotal scan shows. Then again, it could be some malware, and AVs won't pick that up. Have you run ADWCleaner?

Hi,

cottonball said:

fdegrove,

If you deleted NTUSER.rhk, ther is no point in using VirusTotal, since it has to scan the file.

The file appears to be an application/octet-stream

I retrieved a copy of the file from an image created last night.
Uploaded it to VirusTotal :

MD5 87f1a5944f426b383ebc5e3b168dfff7 SHA1 1dcd6e9d8a09952b617f7d7b042e34670f546a0d
SHA256 61cc385149a1cab8ba6a450ad81cb3a5c579f79b66c1ad887f0522d75269d93f
ssdeep
12288:eTR5DehlV7OEUzACybL475wJQm+mgpwDjsdxlZI+H6nKhXNru63C:e15EbhUzACybL4npyMH/XNru63C


File size 1.5 MB ( 1622016 bytes )
File type unknown
Magic literal
MS Windows registry file, NT/2000 or above

TrID	Windows NT Registry Hive (generic) (100.0%)

VirusTotal metadata

First submission 2016-10-24 09:33:14 UTC ( 5 minutes ago )
Last submission 2016-10-24 09:33:14 UTC ( 5 minutes ago )

File names

NTUSER.rhk

It appears to be benign so I guess it is indeed an application octet-stream as you suggest.
I'll try to find out which app it is but I suspect either Ccleaner or Wise's Registry Cleaner.

Then again, it could be some malware, and AVs won't pick that up. Have you run ADWCleaner?

Yes, I did but nothing suspicious was found.

Thanks for all the help, guys.

EDIT: Found the guilty app: It is Wise's Registry Cleaner and more precisely its Registry Defrag part that generates the file.
A second similar file is created called "UsrClass.rhk" in "C:\Users"UserName"\AppData\Local\Microsoft\Windows".
Just thought I'd let you know.

Cheers,

fdegrove said:

...It appears to be benign so I guess it is indeed an application octet-stream as you suggest.
I'll try to find out which app it is but I suspect either Ccleaner or Wise's Registry Cleaner....

...EDIT: Found the guilty app: It is Wise's Registry Cleaner and more precisely its Registry Defrag part that generates the file.
A second similar file is created called "UsrClass.rhk in C:\Users"UserName"\AppData\Local\Microsoft\Windows.
Just thought I'd let you know.

Cheers,

Great! Thanks for letting us know.

fdegrove,

Can you tell us what sort of Antivirus, malware protection program is installed on your computer.

Also, you may want to consider what is mentioned here:
Registry Cleaners: Digital Snake Oil | Malwarebytes Labs

cottonball said:

fdegrove,

Can you tell us what sort of Antivirus, malware protection program is installed on your computer.

Also, you may want to consider what is mentioned here:
Registry Cleaners: Digital Snake Oil | Malwarebytes Labs