Hmmm, I seem to have a stowaway on my Windows partition. A drive was making odd sounds so I went to check the Event Viewer for any warnings (it turned out just to be the image preview application doing very inefficient I/O) and I noticed a start message for a device driver named ‘nenum13E’. Odd. It doesn’t have a meaningful service description associated with it, either. Strange. Google turns up nothing, so it’s not a well-known program, and could be a randomly-generated name. Suspicious. And it runs out of a temporary directory. *Very* suspicious.
A virus scan doesn’t note anything unusual, though. The other major possibility is spyware, but neither Ad-Aware nor Spybot pick anything up either. That’s unlikely anyway since I’ve always been up-to-date on security patches and don’t use that system very much for browsing.
It should be safe enough to delete it, since nothing system-critical should be running out of a temporary directory. :-P I’m still curious as to what it actually is, though…
You probably already looked, but…
I just checked a couple regular sources (like Symantec) for that string, and none of them have anything registered; so if it’s viral, it’s really new or really rare. Now ya got *me* really curious, too…
Aha, a clue: There was another driver running out of the same directory, called ‘nsysaudm.sys’, which is probably related to it. Googling on that turns up hits about a Sony CD copy protection system that uses a driver named ‘nsysaudm.vxd’ under Windows 98; this is likely the NT/XP version of it. It’s supposed to interfere with the process of ripping CDs to MP3s, to prevent piracy.
Aww. So much for my conspiracy theories about the being inside your PC. ;-)
I just had a nice new type of blue screen that stated basically windows had shut down to protect my system because of an error with nenum13e.sys…. so I say “ooook” and root around. It was a hidden file located in users/me/temp (u know) Whats interesting is that I had just taked a CD out of the drive, it had just closed and the drive was “checking” when I clicked on a proggy to free up ram..BOOM. I guess it is CD related…but…on restart XP took at least a ful minute to load Norton Personal Firewall >< Prob unrelated...
I know this is an old thread, but googling “nenum13e.sys” only comes up with this page. I just got the error with nenum13e.sys as well. It followed shortly after I attempted to copy a DVD with Nero that was copy protected. Not sure if that’s exactly what caused it, but it fits with heide’s description.
Could it have anything to do with Kazza? Until I read all your comments I was on a mission to rid of this ‘nsysaudm.sys’ file that is in my Windows 2000 temp folder.
I noticed that it didnt appear there after I had used the PC and had not used Kazza freeware version.
I had asumed before now it was the Advert linking spy.
If I clear out the folder and re-booted it wasnt there!
Anyway to conclude, I have a Sony CD writer! so perhaps it is by pure fluke that I had only noticed it when I had used Kazza.
Thanks for the advice that you all posted, it makes me more satisfied my PC is behaving and its only a Sony thing!
They wouldnt use spyware to get market share …….. would they?
I’ve since reinstalled Windows and it hasn’t come back yet, so I’m still not sure where it came from. I haven’t used Kazaa, but I think I tried the Nero trial version at some point, so it might have been related to that.
Oh well, it remains a mystery…