up vote 1 down vote favorite
share [g+] share [fb]

In the users folder, I have, apart from my account and Public, a folder named user, with subfolder /LOCALS~1/temp and RegCheck.exe inside. Any idea what this is, and if I can remove it?

link|improve this question
100% accept rate
feedback

3 Answers

up vote 1 down vote accepted

First, being in the temp folder, it can be deleted. Second, a quick Google search says that it is malware, which would jive with a Windows-sounding file being in the temp folder.

http://www.threatexpert.com/files/regcheck.exe.html

Supplemental: While you can still delete it, I found other another reference that is not malware: http://www.runscanner.net/lib/regcheck.exe.html

Only if you are curious, you could right click it and go to the details tab, and see if says that some company you recognize made it. If so, they probably did, and it was left over from an install. If it empty, probably a bad file.

link|improve this answer
+1 Often malware and location points to that here. – Dave M Jun 7 '11 at 14:06
It looks like that, but being a "user", it makes me somewhat more wary of deleting it. It might be a legitimate file, and I'd hate to break something by deleting it. – Teknophilia Jun 8 '11 at 15:33
@Teknophilia Thank you for marking the answer. I just saw your last comment. You can always delete files in that temp folder. The worst thing that happens is that it tells you it is in use (hopefully be a legitimate program...see below). When performing virus removal, I always delete the contents of that folder because, for some reason, viruses often hide there, and stay "in use", so they don't delete. So once I delete everything, I can usually look at what is left, and have strong suspicions if there is a virus based on the names of what is left. – KCotreau Jul 5 '11 at 22:04
feedback
up vote 1 down vote

I regularly clean out the users temp folder, its where legitimate programs leave junk behind, its also where malware sometimes stores it files.

link|improve this answer
feedback
up vote 0 down vote

Looks as if there was some wrong configured software that wrote to a folder named user rather than %user%. But since this file is inside the temporary items folder of the non-existent user "user", you should be able to remove it without breaking anything.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.