odd file keeps appearing...

[guydewdney]

i have a file that keeps appearing seemingly at random - on my desktop and c/docs & settings / admin (im logged in as admin)

win 2K
fully firewalled up
fully service packed up
two different spyware progs running (webroot spy sweeper and spybot search and destroy)
avg anti virus

the file is called ~ no .exe or anything, just ~
open with notepad and it appears to be my address book from outlook express

i just keep deleting it.. how do i find out what created it? right click it, and it has no info apart from when it was created and last accessed...


heres a bit of it from notepad:-


œËËuÒ‘X ÀOyV¤ ‹  È ¤ 
Є ¤J D 
Є ¨ 
Є ¤ ä!
 Є `J ´¦

Є 
„+  
ô
 ô
¤    À F €
3 2 8 5 4
€
3 2 8 5 5 €
3 2 8 5 6 €
3 2 8 5 7 €
3 2 8 1 2 €
3 2 8 1 3 €
3 2 8 1 4 €
3 2 8 0 2 €
3 2 9 8 4 2„Á…в ª <öv
€
3 2 7 6 9 €
3 2 7 7 0 €
3 2 7 7 1 €
3 2 7 7 2 €
3 2 7 7 3 €
3 2 7 7 4
€
3 2 7 7 5 €
3 2 7 7 6 €
3 2 7 7 7
€
3 2 7 7 8 à~*+«6Ñ›¬ Éœ‹
€ M s g r I D  T°  Æ  -Ç  uÈ  É  Ê Ì  TÍ œÎ
ØÏ  ,Ñ  FÓ  ~Ô  zÖ  \Ø  :Ú  VÜ  `Þ  ß  ªá  vã  Få  &ç  âè  Fê ! vë " ®ì # ®î $ ð % ¦ò & ô ( ¸õ ) àö * ø + Àù , öú - (ü . Zý 0 ²þ 2 òÿ 3 &
 4 f 7 ’ 8 À : ô < , = \ > ˆ  ? ¼
 B   C 
 E
 G  H < J ) L  M  N $ O ! P & Q % S Æ T Ë V Î Z  ] n e m k l m Õ  w Ð! y Ã" z Ò#  Å$ ‡ Î% • ù& ™ î' œ
) ~* ¥ y+ © x, ² Ÿ- µ –. ¸ ©/ ¼ j1 ¾ e2 ¿ Œ3 À £4 Á œ5  —6 Ä Æ7 Æ Ñ8 Ì Ü9 Î í: Ï â; Ð í< Ö ö= Ú ù> æ ú? í «A ò ¦B õ ™D ö jF ÷ ]G $
€H %
mI e
zJ €
qK „
ŽL ©
M ¬
®N ¯
›O °
šP ´
¯Q ¼
®R Ì
*S Î
¤T Õ
‡U Ø
®V Ý
kX ß
ZY é
‘Z ê
œ[ ë
i] í
l^ î
_ ï
t` ñ
ia ò
~b ó
…c ô
†d õ
ye ö
tf ÷
_g ø
bh ù
Yi ú
|j û
—k ü
¬l ý
£m þ
”n ÿ
½o  ²p
 ™q  ’r  ‰s  „t  ¹u  Æv  ¹w  ºx  Íy
 äz  |  è|
 ~  *  E€  0  _‚  Vƒ  Y„  €…  ƒ†  –‡  ˆ  €‰  ƒŠ  l‹  kŒ  n  qŽ  V  Q  \‘ ! U’ " T“ # S” $ t• % ‡– & p— ' q˜ ( „™ ) qš * h› + % , ž - Ÿ .   / ¡ 0 F¢ 1 C£ 2 H¤ 3 K¥ 4 0¦ 5 5§ 6 4¨ 7 3© 8 Fª 9 E« : P¬ ; W* < J® = E¯ > J° ? o± @ r² A ³ B ¶´ C «µ D ¦¶ E ¡· F ¨¸ G ¹ H ¬º I ©» J ¨¼ K «½ L ¾¾ M Ý¿ N þÀ O õÁ P ô Q ëà R Å S Æ T $Ç U =È V fÉ W MÊ X XË Y _Ì Z ¢Í [ ±Î \ ÀÏ ] Ñ ^ Ò _ /Ó ` RÔ a MÕ b tÖ c × d †Ø e ¥Ù f ÌÚ g ×Û h òÜ i Þ j ß k ?à l ,á m gâ n Šã o ¥ä p °å q £æ r ®ç s ½è t ¾é u Íê v ºë w *ì x ¬í y ßî z öï { õð | ò } ó ~
ô 
õ € ö  o÷ ‚ ¤ø ƒ «ù „ ˜ú … ›û † Žü ‡ ý ˆ þ ‰ —ÿ Š ˜  ‹ ™
 0 m dŠ ð™  Àè]  pR
  h? 4ò   9 8 s c l a s s @ M B W o r l d . o r g F o r u m s  M a - 1 j o n e s


from here on in it seems to be a list of my contacts...

scared.

 

[Brian WH]

the file is called ~ no .exe or anything, just ~
.

That certainly looks like a Virus Programme to me mate.

Have you updated your Anti-Virus protection lately???

If so then you need to run the Virus scan programme to hopefully identify and Quarantine it. If no luck contact the Anti-Virus supplier for info on that one.

Good luck anyway, lets hope someone here can assist more.

 

[guydewdney]

yup - up to date...

any online av programs you use to double check?

 

[Brian WH]

yup - up to date...

any online av programs you use to double check?

Sorry I use Norton Anti-Virus and Firewall.

Cannot find the file listed on the Virus list that I have.

Any more details other than ~ no.exe. ?????

exe is certainly a programme file.

 

[Simon]

Have you downloaded Stinger Its a useful tool & free

 

[Steve_Perry]

Guy,

Have you also checked what files your OS runs at startup? If you go to your toolbar off the start button is the run button, type in msconfig and that should allow you to look at what progs are loaded at startup. I think it should work with Win2000, I'm on XP. You could also call up the task manager (ctrl+alt+del single press)and see what the OS is currently running. The following site is good for differentiating what are goodies from what are baddies.

Windows Process Library:
http://www.liutilities.com/products/wintaskspro/processlibrary/allprocesses/

Hope that may be of help.

S.

 

[guydewdney]

sorry - it has no . anything - its just




~




no other info whatsoever.... no creator, no author, all those fields are blank on the properties page



ah - just done a seach - found this:-
http://www.windowsbbs.com/showthread.php?s=&threadid=16820

so its just ms being crap...

 

[Gilly]

Ola ppl

I would suspect one of 3 things myself,
1) kazza
2) emule
3) Xdcc catcher

Have any of those installed ?


Gilly

 

[Sp!ke]

Sure sounds like W32.Denisbee to me!

Have you got the below in the registry?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\no.exe
If so, then have a look here http://securityresponse.symantec.com/avcenter/venc/data/w32.denisbee.html

If you are running all the service packs including the ones released this weekend for IE and OE, then and assuming you are running broadband, i'd allso recommend that you get over to www.antivirus.com and run the free online scan for home users.... This often finds stuff other virus programs cant.

If anything shows up, then I would kill your system restore and then run it again.

Hope you find it.

 

[Brian WH]

sorry - it has no . anything - its just

~

no other info whatsoever.... no creator, no author, all those fields are blank on the properties page

ah - just done a seach - found this:-
http://www.windowsbbs.com/showthread.php?s=&threadid=16820

so its just ms being crap...

Good, looks as if you have resolved the devious little devil.

On a previous version of Windows, I use XP now, I tried to delete the basic copy of my Address book as I had imported a new one. The file kept reappearing and I was unable to delete it. So you could be right if that is the back-up of it. Pity you cannot refile it properly.

 

[SEM]

another one to watch is DSB.EXE


http://sarc.com/avcenter/venc/data/pf/adware.energyplugin.html

 

[GrahamC230K]

I had the ~ on my desktop a while agao back it didn't come back. Wierd.