• The Forums are now open to new registrations, adverts are also being de-tuned.

odd file keeps appearing...

guydewdney

guydewdney

MB Enthusiast
Joined
Feb 14, 2004
Messages
2,911
Location
Porlock, Zomerzet
Car
906 Sprinter 313cdi
i have a file that keeps appearing seemingly at random - on my desktop and c/docs & settings / admin (im logged in as admin)

win 2K
fully firewalled up
fully service packed up
two different spyware progs running (webroot spy sweeper and spybot search and destroy)
avg anti virus

the file is called ~ no .exe or anything, just ~
open with notepad and it appears to be my address book from outlook express

i just keep deleting it.. how do i find out what created it? right click it, and it has no info apart from when it was created and last accessed...


heres a bit of it from notepad:-


œËËuÒ‘X ÀOyV¤ ‹  È ¤  Є ¤J D  Є ¨ 
Є ¤ ä!  Є `J ´¦  Є  „+   ô  ô ¤    À F €  3 2 8 5 4 €  3 2 8 5 5 €  3 2 8 5 6 €  3 2 8 5 7 €  3 2 8 1 2 €  3 2 8 1 3 €  3 2 8 1 4 €  3 2 8 0 2 €  3 2 9 8 4 2„Á…в ª <öv
€  3 2 7 6 9 €  3 2 7 7 0 €  3 2 7 7 1 €  3 2 7 7 2 €  3 2 7 7 3 €  3 2 7 7 4
€  3 2 7 7 5 €  3 2 7 7 6 €  3 2 7 7 7
€  3 2 7 7 8 à~*+«6Ñ›¬ Éœ‹ € M s g r I D  T°  Æ  -Ç  uÈ  É  Ê Ì TÍ œÎ
ØÏ  ,Ñ  FÓ  ~Ô  zÖ  \Ø  :Ú  VÜ  `Þ  ß  ªá  vã  Få  &ç  âè  Fê ! vë " ®ì # ®î $ ð % ¦ò & ô ( ¸õ ) àö * ø + Àù , öú - (ü . Zý 0 ²þ 2 òÿ 3 & 4 f 7 ’ 8 À : ô < , = \ > ˆ  ? ¼
 B   C 
 E
 G  H < J ) L  M  N $ O ! P & Q % S Æ T Ë V Î Z  ] n e m k l m Õ  w Ð! y Ã" z Ò#  Å$ ‡ Î% • ù& ™ î' œ ) ~* ¥ y+ © x, ² Ÿ- µ –. ¸ ©/ ¼ j1 ¾ e2 ¿ Œ3 À £4 Á œ5  —6 Ä Æ7 Æ Ñ8 Ì Ü9 Î í: Ï â; Ð í< Ö ö= Ú ù> æ ú? í «A ò ¦B õ ™D ö jF ÷ ]G $ €H % mI e zJ € qK „ ŽL © M ¬ ®N ¯ ›O ° šP ´ ¯Q ¼ ®R Ì *S Î ¤T Õ ‡U Ø ®V Ý kX ß ZY é ‘Z ê œ[ ë i] í l^ î _ ï t` ñ ia ò ~b ó …c ô †d õ ye ö tf ÷ _g ø bh ù Yi ú |j û —k ü ¬l ý £m þ ”n ÿ ½o  ²p  ™q  ’r  ‰s  „t  ¹u  Æv  ¹w  ºx  Íy
 äz  |  è|
 ~  *  E€  0  _‚  Vƒ  Y„  €…  ƒ†  –‡  ˆ  €‰  ƒŠ  l‹  kŒ  n  qŽ  V  Q  \‘ ! U’ " T“ # S” $ t• % ‡– & p— ' q˜ ( „™ ) qš * h› + % , ž - Ÿ .   / ¡ 0 F¢ 1 C£ 2 H¤ 3 K¥ 4 0¦ 5 5§ 6 4¨ 7 3© 8 Fª 9 E« : P¬ ; W* < J® = E¯ > J° ? o± @ r² A ³ B ¶´ C «µ D ¦¶ E ¡· F ¨¸ G ¹ H ¬º I ©» J ¨¼ K «½ L ¾¾ M Ý¿ N þÀ O õÁ P ô Q ëà R Å S Æ T $Ç U =È V fÉ W MÊ X XË Y _Ì Z ¢Í [ ±Î \ ÀÏ ] Ñ ^ Ò _ /Ó ` RÔ a MÕ b tÖ c × d †Ø e ¥Ù f ÌÚ g ×Û h òÜ i Þ j ß k ?à l ,á m gâ n Šã o ¥ä p °å q £æ r ®ç s ½è t ¾é u Íê v ºë w *ì x ¬í y ßî z öï { õð | ò } ó ~
ô 
õ € ö  o÷ ‚ ¤ø ƒ «ù „ ˜ú … ›û † Žü ‡ ý ˆ þ ‰ —ÿ Š ˜  ‹ ™ 0 m dŠ ð™  Àè]  pR    h? 4ò   9 8 s c l a s s @ M B W o r l d . o r g F o r u m s  M a - 1 j o n e s


from here on in it seems to be a list of my contacts...

scared.
 
guydewdney said:
the file is called ~ no .exe or anything, just ~
.
Click to expand...

That certainly looks like a Virus Programme to me mate. :crazy:

Have you updated your Anti-Virus protection lately??? :confused:

If so then you need to run the Virus scan programme to hopefully identify and Quarantine it. If no luck contact the Anti-Virus supplier for info on that one.

Good luck anyway, lets hope someone here can assist more.
 
guydewdney said:
yup - up to date...

any online av programs you use to double check?
Click to expand...

Sorry I use Norton Anti-Virus and Firewall.

Cannot find the file listed on the Virus list that I have.

Any more details other than ~ no.exe. ?????

exe is certainly a programme file.
 
Guy,

Have you also checked what files your OS runs at startup? If you go to your toolbar off the start button is the run button, type in msconfig and that should allow you to look at what progs are loaded at startup. I think it should work with Win2000, I'm on XP. You could also call up the task manager (ctrl+alt+del single press)and see what the OS is currently running. The following site is good for differentiating what are goodies from what are baddies.

Windows Process Library:
http://www.liutilities.com/products/wintaskspro/processlibrary/allprocesses/

Hope that may be of help.

S.
 
Ola ppl

I would suspect one of 3 things myself,
1) kazza
2) emule
3) Xdcc catcher

Have any of those installed ?


Gilly
 
Sure sounds like W32.Denisbee to me!

Have you got the below in the registry?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\no.exe
If so, then have a look here http://securityresponse.symantec.com/avcenter/venc/data/w32.denisbee.html

If you are running all the service packs including the ones released this weekend for IE and OE, then and assuming you are running broadband, i'd allso recommend that you get over to www.antivirus.com and run the free online scan for home users.... This often finds stuff other virus programs cant.

If anything shows up, then I would kill your system restore and then run it again.

Hope you find it.
 
Last edited:
guydewdney said:
sorry - it has no . anything - its just

~

no other info whatsoever.... no creator, no author, all those fields are blank on the properties page

ah - just done a seach - found this:-
http://www.windowsbbs.com/showthread.php?s=&threadid=16820

so its just ms being crap...
Click to expand...

Good, looks as if you have resolved the devious little devil.

On a previous version of Windows, I use XP now, I tried to delete the basic copy of my Address book as I had imported a new one. The file kept reappearing and I was unable to delete it. So you could be right if that is the back-up of it. Pity you cannot refile it properly.
 
I had the ~ on my desktop a while agao back it didn't come back. Wierd.
 
You must log in or register to reply here.

Users who are viewing this thread

Total: 1 (members: 0, guests: 1)
Back
Top Bottom