What is this file? owcstp16.dll

Viruses and worms
1

I have for a few days now, when I log to my computer in the am get this warning about this file being Mal ware. I am not sure at this point if should be deleted or not. Avast program gives me 2 options: Delete or ignore. So far I chosen ignore. Do you have any data on this file and is dangerous to my computer? Any recommendations would be appreciated. Thanks… Gary

2

Only two options? Seems strange… Or it was Webshield with “Abort connection” or it will have other options like “Send to Chest”…
Can you inform the file as being a false positive? (click on the bottom right of the virus warning message).

To know if a file is a false positive, please submit it to VirusTotal and let us know the result. VirusTotal has a file size limit of 10Mb. You can use VirScan also.
If it is indeed a false positive, send it in a password protected zip to virus@avast.com. Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

Maybe you need to disable Hide protected operating system files and enable View hidden files and folders to manage the file(s).

3

This is on the rootkit scan, 8 minutes after boot and it uses a heuristic method which may not be 100% certain of the detection hence the two options and I believe the default option is Ignore. So I would suggest you follow that advise and allow the file to be sent to avast for further analysis.

Well google might know what owcstp16.dll is or is associated with, http://www.google.co.uk/search?q=owcstp16.dll. There are some hits that would consider it undesirable and you may have other issues.

See http://info.prevx.com/aboutprogramtext.asp?PX5=9DC66C24B828A20D3E5200C30D6C5E00553710C0.

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).

  1. SUPERantispyware On-Demand only in free version.
  2. MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
4

let’s see what the virustotal analysis will show… we can whitelist the file in case of an false alarm…

5

Hi Maxx_original,

This non-malicious file goes back quite some time, because it is found on Win98 SE/ME.

Universal Serial Bus Controllers (USB):

Code
USB 2.0 Root Hub Device
Service: OWC (OrangeWare Corporation)
Date: 1.30.2002
File Version: 2.0.6.1
Copyright (C): OrangeWare Corporation, 2002

This is a file that gets installed by Intel USB 2.0 driver update software.
Some downloaded it and tried to install it in error on their XP machine.
As it is for Windows 98/ME on XP you can abort the install, and leave owcstp16.dll in your program file folder. As you have XP, you can now safely delete it.

If you are using 98SE/ME the file is valid and should not be deleted and there avast could have produced a FP,

In the case of OWCSTP16[n].DLL this is malicious Software. In that case your PC is infected.
File size: 16056 bytes
MD5: 9dc66c2428a20d52c30d6c5e553710c0
SHA1: 1e8c422402323544a1392f03e7d752080235db33
PEiD: -
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=9DC66C24B828A20D3E5200C30D6C5E00553710C0

F-Secure 6.70.13260.0 2008.03.11 Smalldoor.GRT
Prevx1 V2 2008.03.11 Generic.Malware
Norman 5.80.02 2008.03.10 Smalldoor.GRT
The file called OWCSTP16[n].DLL is considered unsafe and there may be other infections on your PC,

polonus