we find two dll files in c\program files, should we ignore it, or if we want to investigate, what's the next step? thanks
What is the version of Windows you're looking at? Is it 32- or 64-bit?
What are the names and hashes of the DLL files? Have you looked the hashes up, or done any analysis of the DLL files, even just running 'strings' against them?
Do you know when the DLL files were created on the system? Did you create a timeline of system activity, and determine what happened 'near' the time the DLL files were created? "C\programfiles" doesn't seem to be a legit folder on Windows systems; what happened on the system around the time that the folder was created?
Do you know when the DLL files were created on the system? Did you create a timeline of system activity, and determine what
….and are they somewhere in the RAM? Do they have similar names as DLL in \system32\ have perhaps?
see PM please