# win32/pdfjsc.h \<--What is this?

**URL:** <https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343>\
**Category:** Factual Questions\
**Created:** [November 18, 2008, 8:24pm UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343 "2008-11-18T20:24:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\
**Post date:** [November 18, 2008, 8:24pm UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/1 "2008-11-18T20:24:44Z")

</div>

I went to the Encyclopedia Dramatica page for Albert Einstein today, and once the page had loaded, my antivirus software told me it had found

> [@](#):
>
> Exploit: Win32/Pdfjsc.H

in my system and would I like to clean it out? I told the software to do so, and it reported that all was now well.

Googling pdfjsc.H turns up nothing useful–just two uninformative hits where the file turns up in a list of files on someone’s system. I wonder if anyone here knows what it is. Did I come near disaster? Without antivirus software, would my laptop have started smoking or something?

-FrL-

---

<div class="post-metadata">

**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\
**Post date:** [November 18, 2008, 8:34pm UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/2 "2008-11-18T20:34:01Z")

</div>

Further information:

The log for my antivirus software says the file involved was called xcvb[1].pdf.

Again, google gives me nothing… 😕

-FrL-

---

<div class="post-metadata">

**Author:** ![Indistinguishable](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@Indistinguishable](https://boards.straightdope.com/u/Indistinguishable)\
**Post date:** [November 18, 2008, 9:41pm UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/3 "2008-11-18T21:41:19Z")

</div>

Googling the second name gives [this](http://www.packetninjas.net/?p=124), which suggests that it is a file trying to exploit the vulnerability in Adobe Acrobat mentioned [here](http://www.adobe.com/support/security/bulletins/apsb08-13.html) (which contains links to upgrades containing security updates).

---

<div class="post-metadata">

**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\
**Post date:** [November 18, 2008, 10:21pm UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/4 "2008-11-18T22:21:50Z")

</div>

What search term(s) did you use? I’m not getting anything like that through google.

-FrL-

---

<div class="post-metadata">

**Author:** ![Noelq](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/noelq/32/16438_2.png) [@Noelq](https://boards.straightdope.com/u/Noelq)\
**Post date:** [November 18, 2008, 10:24pm UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/5 "2008-11-18T22:24:03Z")

</div>

Viruses name themselves some random characters. You probably aren’t going to find anything with that name.

---

<div class="post-metadata">

**Author:** ![Indistinguishable](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@Indistinguishable](https://boards.straightdope.com/u/Indistinguishable)\
**Post date:** [November 19, 2008, 12:01am UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/6 "2008-11-19T00:01:10Z")

</div>

> [@Frylock](#):
>
> What search term(s) did you use? I’m not getting anything like that through google.

“xcvb.pdf”. The “[1]” usually just indicates that there was already a copy of that file there when some process tried to create another. Check the MD5 hash, though; that’s your best guide to whether it’s the same file or not. (Or, as a lazy man’s way out, just check the filesize, I suppose…)

---

<div class="post-metadata">

**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\
**Post date:** [November 19, 2008, 12:34am UTC](https://boards.straightdope.com/t/win32-pdfjsc-h-what-is-this/473343/7 "2008-11-19T00:34:27Z")

</div>

> [@Indistinguishable](#):
>
> “xcvb.pdf”. The “[1]” usually just indicates that there was already a copy of that file there when some process tried to create another. Check the MD5 hash, though; that’s your best guide to whether it’s the same file or not. (Or, as a lazy man’s way out, just check the filesize, I suppose…)

Hmm… That scares me a bit, since the antivius program only found xcvb[1].pdf. This makes me wonder if there’s still a copy of xcvb.pdf lurking. I’ll have to check tomorrow when I get back to that computer.

-FrL-