Mysterious textfile!

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Ander

Thread Starter
Joined
Feb 13, 2003
Messages
80
Hi everybody,

This is something I've never seen before...

Today I found a file in my hard drive's root that was called simply "L" (no extension). When I opened it in a text editor, I found it was a listing of my hard drive's entire contents---in the standard DOS "dir /w" format, but with all my folders and all they files they contained.

I can't imagine why any program I use would create such a file. Could this be virus-related? I use a firewall and an up-to-date AV program, and a SpyBot scan showed nothing. Thanks for your suggestions.
 
Joined
Jul 29, 2004
Messages
6,650
Hi Ander,

The file may have created by a DOS command, example :

tree C: /a /f > L

This command will create a file L with the name of all the directories and files stored on the C: drive. ;)
 

Ander

Thread Starter
Joined
Feb 13, 2003
Messages
80
I figured that such a file could be produced from a command line---but I didn't do it, and I don't know why any program I use would have. (We're talking over 50,000 lines of text here...)

Has anyone seen any malware that does this, or has it been known to indicate an intrusion? Thanks.
 
Joined
Jul 29, 2004
Messages
6,650
I don't remember a malware which creates such file. I think about a backup procedure in a software which create a temporary file but I am not sure.
 
Joined
Aug 1, 2003
Messages
51,988
Do you have any directory printing programs installed? It's possible that one of them was mistakenly activated and that the default path was C:.

(I know you probably considered all this, but the possibility of spyware seems remote to me).
 
Joined
Aug 1, 2003
Messages
51,988
You could monitor the L file for a while to see what accesses it with FileMon from Sysinternals.

http://www.sysinternals.com/Utilities/Filemon.html

In the Filter section, add the path to the file to the Include box (C:\L). Any program that accesses that file will leave an entry in the log. Try it with Notepad to be sure the process is working.

Quite possibly, nothing will access it since it has already been completed, presumably. But you could remove the file and leave FileMon running to see if a new one with the same name gets produced.
 

Ander

Thread Starter
Joined
Feb 13, 2003
Messages
80
Elvandil said:
You could monitor the L file for a while to see what accesses it with FileMon from Sysinternals...
Thanks, that's a great idea. (If anything sensational happens, I'll post about it here.)
 

Ander

Thread Starter
Joined
Feb 13, 2003
Messages
80
I've tried Filemon, but I can't figure out how to filter its output to a file named with a single letter... Have any idea?
 
Joined
Jul 29, 2004
Messages
6,650
Hi Ander,

Try this :
run Filemon, then hit Ctrl + L to trigger the filter dialog box and type C:\L in the 'Include' input box.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top