Windows 10 Suspicious looking file

[FutureGaming1]

So about a week ago, I saw that "How do you want to open this file?" message on startup. I didn't do anything, but it started annoying me. I disabled it in task manager, but i'm now suspicious of what is in it. It is in: C:\Users\ . It isn't my folder but it's just named Alex (My real name is Alex, and my name in this computer is Alex *my surname*). I'm sure that the file that I disabled is this one, as when I opened it, I saw how do you want to open this file. Then I see a bit of code:




Usage : fsutil behavior query <option>



<option>



allowExtChar

bugcheckOnCorrupt

disable8dot3 [<Volume Path>]

disableCompression

disableCompressionLimit

disableDeleteNotify [NTFS|ReFS]

disableEncryption

disableFileMetadataOptimization

disableLastAccess

disableSpotCorruptionHandling

encryptPagingFile

memoryUsage

mftZone

quotaNotify

symlinkEvaluation

disableWriteAutoTiering [<Volume Path>]

disableTxf [<Volume Path>]

enableReallocateAllDataWrites [<Volume Path>]



Please use "fsutil 8dot3name query /?" for more information.



For DisableDeleteNotify if neither "NTFS" nor "ReFS" is specified, both values are shown.


So I ran that "fsutil 8dot3name query /?" and it returned "Usage : fsutil 8dot3name query [<Volume Path>]



When no volume is specified the global 8dot3name state is displayed.

When volume is specified the volumes 8dot3name state is displayed.



Sample command:

"fsutil 8dot3name query"

"fsutil 8dot3name query C:" "


I am pretty suspicious of that file, as I didn't add it.


Could anyone try and identify that?


Many thanks,


Alex

Continue reading...