0 bytes files with no extension on all drives
August 4th, 2016
I delete them, but when I turn PC next day, they appear again on all my drives.
What are these?
How can I find what is creating them?
Scan ur pc with a good anti virus.
Post a hijackthis log
Will this help at all??
http://www.aade.com/XPhint/zero%20byte.htm
and there is the useful unlocker program which can delete files that are stubborn.
http://www.filehippo.com/download_unlocker/download/9f6c22a28503dc56448a00cad91e3a38/
I ran Avira AntiVir but found nothing. Then Malwarebytes’ Anti-Malware, but also found nothing.
Here’s the log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:19:40, on 13/01/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
H:\HiJackThis\Tutorial\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
--
End of file - 4688 bytes
Thanks for the links. These o bytes files (________) are deletable, but they appear again next day.
Looks clear…ill do a google on the filez brb
found nothing, have you got hackint0sh running on the same HDD, it likes to make files that you cant see on OSX but you can in Windows.
Have you got thumbnail cache on in folder setting in control panel. It likes to make 2 files in ever folder, turn that off – doesn’t server much use to us anymore with faster PC’s nowadays.
try cleaning your temp files & registry after deleting those files.
then restart and see if they come back on again
these files are created in root of all drives… i googled it but couldn’t find why they are created…
don’t have hackint0sh… don’t know what it is?
this wasn’t happening before, maybe started two weeks ago…can’t remember installing any softwares in the meantime
cleaned registry and temp directory with CCleaner
these files are created in root of all drives... i googled it but couldn't find why they are created...
don't have hackint0sh... don't know what it is?
this wasn't happening before, maybe started two weeks ago...can't remember installing any softwares in the meantime
cleaned registry and temp directory with CCleaner
dw about hackint0sh then, make sure that thumbnail caching is off in your folder options in control panel. Otherwise im stumped as to what it is.
i’m on other comp now… i’ll try that later… thanks
possible a nasty file in your hjt log: “O2 – BHO: WormRadar.com IESiteBlocker.NavFilter – {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} – (no file)”
Remove or fix it
hey!! those zero byte files are appear like folders… am I right… if it so, just a right click [remember, don’t double click] on it & see the file type.. if it is application… exactly it’s virus mostly infected by USB pendrives….
Option “Do not cache thumbnails” is off already.
possible a nasty file in your hjt log: "O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)" Remove or fix it
Yes, I noticed that WormRadar file…
CCleaner can’t find it in registry. How can i get rid of it (or fix it). CCleaner can’t do it?
hey!! those zero byte files are appear like folders... am I right... if it so, just a right click [remember, don't double click] on it & see the file type.. if it is application... exactly it's virus mostly infected by USB pendrives....
they have icon like an unknown file type, no extension.
Right click on the file / Properties / Type of file: “file”
You know, it could have something to do with USB pendrives, because I have: C, D, E, F, G drives reserved and when I plug a pendrive, it gets drive “I”, and skips drive “H”!!! Any ideas?
[quote=””]Option “Do not cache thumbnails” is off already.
possible a nasty file in your hjt log: "O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)" Remove or fix it
Yes, I noticed that WormRadar file…
CCleaner can’t find it in registry. How can i get rid of it (or fix it). CCleaner can’t do it?
You can remove it with the hijackthis program, check it and choose fix it.
Or remove it manually with regedit, use find text and search for the entry and delete it.