EnglishDeutschFrançaisItaliano
Search & Destroy
Our team of malware analysts monitors the Internet 24 hours a day seven days a week...

What is blindman.exe for?

June 21st, 2012

Some of you may have noticed a new file blindman.exe inside the Spybot-S&D folder, and have asked yourself what it is for. In short words: it does nothing.

I guess an explanation is needed why a file that does exactly nothing comes with Spybot-S&D. Spybot-S&D offers a tool to control the System startup in its Tools section. This includes the ability to disable or enable startup entries from the Autostart group (found in your Start menu under Programs). This group contains links to the actual files. Windows stores those links as files with the extension .lnk. When Windows encounters a *.lnk file in that folder upon startup, it will start the linked application. Now the easiest way to disable those entries is to change the extension. The System startup tool of Spybot-S&D does simply change the extension .lnk to .disabled. This easily prevents the linked application from being started. But as Windows does not know this extension, this could slow the startup down. So Spybot-S&D does link that extension to blindman.exe. Windows now tries to run the .disabled file with blindman.exe – and as blindman.exe does exactly nothing, there is no slow-down in booting.

Some people have suspected it could even be spyware itself. For those I will print the Delphi source code (blindman.dpr) here (the included resource file is blindman.res and contains just the icon):

program blindman;
{$R *.res}
begin
end.
Anyone knowing a very small bit of programming should see that this program is totally harmless (actually, the version shipped since Spybot-S&D 1.5 is a bit larger than the above, because one of Microsofts certification requirements is that every executable file need to call GetVersionEx at least once, and needs to crash on inserted code injections, even if just a 1 millisecond empty dummy).

FAQ Category: 1.6 only, General Questions

Awards
Awards