weird 0 byte file

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

mat - 22 Dec 2004 04:14 GMT

for a few months now i've had these 0 byte files that keep showing in the
root drive..they are non virus/spyware related as i've checked and scanned
etc.
the files have strange names but most commonly is one with this name
ATEDIALOGINDIRECT?

i'd like to know what's generating them and how to stop it

here's a list of programs that run in my startup:

systemtray systray.exe
loadpowerprofile rundll32.exe
powrprof.dll.loadcurrentpwrscheme
tweakui rundll32.exe tweakui.cpl.tweakmeup
smcservice c:\progra~1\sygate\spf\smc.exe -startgui (firewall)
scanregistry C:\WINDOWS\scanregw.exe /autorun
maclaunch H:\applications\Start-apps\L02\Enchanted Toolbar.exe
(quicklaunchtoolbar)
quicktimetask "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
voicecommand G:\Program Files\FreeVoice\freevoice.exe
(speech recognition program)

any help appreciated,thanks

Reply to this Message

Andrew H. Carter - 22 Dec 2004 05:00 GMT

>for a few months now i've had these 0 byte files that keep showing in the
>root drive..they are non virus/spyware related as i've checked and scanned
[quoted text clipped - 19 lines]
>
>any help appreciated,thanks

I'd say:

quicktimetask "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
maclaunch H:\applications\Start-apps\L02\Enchanted Toolbar.exe

smcservice c:\progra~1\sygate\spf\smc.exe -startgui (firewall)

You may have SPF to automatically check for updates, those other three
above probably check as well.

I'd uncheck each one reboot, then check one of them and see if that might
then attempt to dial out. But first I go to each proggies settings and try
to effect repairs.

Signature

Sincerely, | NOTE: Best viewed in a fixed pitch font
| (©) (©)
Andrew H. Carter | ------ooo--(_)--ooo------
d(-_-)b | /// \\\

Reply to this Message

mat - 22 Dec 2004 05:51 GMT

i have all programs set to not upgrade or update etc,and i had those
programs for years before that problem

> >for a few months now i've had these 0 byte files that keep showing in the
> >root drive..they are non virus/spyware related as i've checked and scanned
[quoted text clipped - 40 lines]
> Andrew H. Carter | ------ooo--(_)--ooo------
> d(-_-)b | /// \\\

Reply to this Message

Andrew H. Carter - 22 Dec 2004 15:10 GMT

>i have all programs set to not upgrade or update etc,and i had those
>programs for years before that problem

Then it would be my guess thet you recently installed some software which
is calling home to the mothership, or have a virus/trojan/worm which is
calling home to get further instructions.

Signature

Sincerely, | NOTE: Best viewed in a fixed pitch font
| (©) (©)
Andrew H. Carter | ------ooo--(_)--ooo------
d(-_-)b | /// \\\

Reply to this Message

mat - 22 Dec 2004 16:34 GMT

i don't have any spyware/virus running,i'm pretty sure,i have scanned with
spybot.ad-aware trend micro antivirus,completely nothing...i have nothing
running in the background or at startup,i've checked with a task manager
program etc,nothing but the legitimate programs all that i know of..i have
nothing that calls for a dial conenction or tries to access the network,the
firewall would have notified me..

when i gaveup trying to find any 'hidden' executable with that name or
similar ,i tried a 'search-inside' program

using the hex/search inside program ,i found the exact string existing
inside the user.exe file
the file is not actually a 'dialler' or relating to dial..it is 'dialog'
in user.exe the string is :
CREATEDIALOGINDIRECT?

i don't know why user.exe is 'writing out' this line in a 0 byte file..
i also found the other strange names generated in those 0 files inside
user.exe,for instance SIPREV? and network^An ..those are all strings inside
user.exe..

initially i thought my user.exe got corrupted so,i extracted the original
one from the cd..has same values inside..replaced it in dos..and still same
thing,it keeps 'writing' them out

i also found this link(only one) discussing the same problem
http://www.textads.it/message_9280.asp

it's in italian but it's very obvious it's about user.exe acting wild..
what's going on?

> >i have all programs set to not upgrade or update etc,and i had those
> >programs for years before that problem
[quoted text clipped - 9 lines]
> Andrew H. Carter | ------ooo--(_)--ooo------
> d(-_-)b | /// \\\

Reply to this Message

Andrew H. Carter - 22 Dec 2004 20:21 GMT

>i don't have any spyware/virus running,i'm pretty sure,i have scanned with
>spybot.ad-aware trend micro antivirus,completely nothing...i have nothing
>running in the background or at startup,i've checked with a task manager
>program etc,nothing but the legitimate programs all that i know of..i have
>nothing that calls for a dial conenction or tries to access the network,the
>firewall would have notified me..

Not always, some can bypass firewalls.

>when i gaveup trying to find any 'hidden' executable with that name or
>similar ,i tried a 'search-inside' program
[quoted text clipped - 19 lines]
>it's in italian but it's very obvious it's about user.exe acting wild..
>what's going on?

Have you tried to check any entries in the Registry, they don't all show
up in MSCONFIG.

As for Spybot and all those other third party proggies, I really don't put
much faith in them, especially once you get to know your way around.
Sometimes a nice registry restore can correct problems like that.

Your mission Jim, should you decide to accept it:

Is to rack your brain as to when this first started happening, or when you
first noticed it.

Then try to recall if there was something you did to cause such a thing.
It might be something as simple as check for email when first starting up
your comp.

If you have the Google toolbar or some such thing it may need to be
tweaked.

Signature

Sincerely, | NOTE: Best viewed in a fixed pitch font
| (©) (©)
Andrew H. Carter | ------ooo--(_)--ooo------
d(-_-)b | /// \\\

Reply to this Message