4

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is lowercase. For example, the eventlog service is showing as C:\windows\Sytstem32\svchost.exe. No other machines I've ever inspected shows a lowercase 'w'. I know that Windows 7 has a case sensitive flag that can be set in the registry. I checked that and it is not set to case sensitive.

The concern is that if the machine has been hacked and "root-kitted" it would not be returning the true settings, and the display of the lower case 'w' was just a mistake. I don't have the authority to pull the drives and look at them say on a linux box, so I really can't tell what is up.

Has anybody seen the lowercase 'w' as a normal thing? And if so, exactly why is it occuring?

4
  • Can you not take a different computer, stick the same image on, and check that out on another box?
    – cpast
    May 11, 2015 at 19:47
  • There were at least 7 machines made from the same image all with this issue.
    – templets
    May 11, 2015 at 20:11
  • But since you can't pull the drives on those, why not make put the image on a machine you can pull the drive on?
    – cpast
    May 11, 2015 at 20:11
  • ah, the folks who control the machines are... disinclined to do anything at this point without strong cause. But I'm working in it.
    – templets
    May 11, 2015 at 20:41

1 Answer 1

2

Windows is not case sensitive by default. If the only symptom you have is a lowercase w and nothing else, it's not an issue to be worried about.

You don't need to remove the drive to inspect on a Linux machine. Download any modern Linux iso, create a bootable USB drive on another machine, and boot on the suspect machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .