Why are some capital

vbimport

#1

Hello,

I was noticing that some of my processes are showing up in capital, (EXPLORER.EXE), that used to be lowercase. I cant find anything on the web about this. Does anyone know what this is about?

I checked the usual reg entries for any trojans and everything was clear.

Using XP

Thanks


#2

My guess would be because the original (dos) filename is in capitals as well. You could test this of course by executing an “all normal letters” executable.


#3

Yes the filename is all capital. However, they werent like this when everything was first installed. For example IEXPLORE.EXE is all capital but the iexplore in the dllcache is lowercase. Strange what could be changing them? What is the “all normal letters” executable you are talking about I am unfamiliar with this.

Thanks


#4

Originally posted by ntloser
[B]Yes the filename is all capital. However, they werent like this when everything was first installed. For example IEXPLORE.EXE is all capital but the iexplore in the dllcache is lowercase. Strange what could be changing them? What is the “all normal letters” executable you are talking about I am unfamiliar with this.

Thanks [/B]

You could try to execute an MS-DOS command (say “lower.exe” or “CAPITAL.EXE”) to check if it’s because of the filename.

You could als try the same trick with Win32 executables.


#5

I just had a look at my process list. It obviously depends on the utility you are using to see your process list. You could write your own version of Spy or something similar and show all processes for example in lowercase.

What the Windows Task manager does is - picks up the executable name as it was at compile time and show it.

I compiled three executables, each time giving three different cases when creating the executable. The ‘Case’ was preserved when displaying the same every time. So I guess its no ‘mystery’.

The filename has nothing to do with the process name that its shown up as.


#6

Originally posted by ExpertTech
[B]I just had a look at my process list. It obviously depends on the utility you are using to see your process list. You could write your own version of Spy or something similar and show all processes for example in lowercase.

What the Windows Task manager does is - picks up the executable name as it was at compile time and show it.

I compiled three executables, each time giving three different cases when creating the executable. The ‘Case’ was preserved when displaying the same every time. So I guess its no ‘mystery’.

The filename has nothing to do with the process name that its shown up as. [/B]

well , my reply was just a wild guess that sounded most logical. :slight_smile:

Thanks for the info !


#7

thanks


#8

Hmm maybe it has something to with order of priority??
Never heard that one before but I have seen it from time to time


#9

could be a windows update that changed the file in some way