Possible security intrusion or profiling? 1

[vop]

Very recently, every time I boot I have been consistently getting an incremental suspicious looking pair of 0 K files in the C:\windows directory (WIN98). If I can immediately delete these files without consequence, then why would there be a legitimate explanation for these file pairs other than spyware potential.

I found them in my regular cleanup check for *.tmp files (using file>find).

They are of the pattern fffe*.tmp, consistently contain the substring '-11D8-96A2-00E0299E2939}' and each new pair of entries appear to be initialized only at startup. They do not appear to be recreated if deleted.

Might anyone have some idea as to what these files are or of their potential source? They look like registry type references. Couldn't find any hint of them in a Hijackthis log.


Potential phone home content holders?

Directory of C:\WINDOWS

FFFE10~1 TMP 0 03-06-04 11:08p fffe101f_{3403CDC0-6FC3-11D8-96A2-00E0299E2939}.tmp
FFFE10~2 TMP 0 03-06-04 11:08p fffe101f_{3403CDC1-6FC3-11D8-96A2-00E0299E2939}.tmp
FFFE2C~1 TMP 0 03-06-04 11:37p fffe2ce3_{4A2148E0-6FC7-11D8-96A2-00E0299E2939}.tmp
FFFE2C~2 TMP 0 03-06-04 11:37p fffe2ce3_{4A2148E1-6FC7-11D8-96A2-00E0299E2939}.tmp
FFFED6~1 TMP 0 03-07-04 12:06a fffed6c1_{3C7E8B40-6FCB-11D8-96A2-00E0299E2939}.tmp
FFFED6~2 TMP 0 03-07-04 12:06a fffed6c1_{3C7E8B41-6FCB-11D8-96A2-00E0299E2939}.tmp


I religiously update and run:
Norton Anti-Virus
SpyBlocker, SpyBot, Ad-aware, and PestPatrol
The Cleaner - trojan scanner

 

[smah]

Any help here?

http://computing.net/windowsme/wwwboard/forum/24630.html

 

[smah]

Here's another reference that includes a MSKB article:

http://www.annoyances.org/exec/forum/winxp/t1028226058

 

[vop]

Thank you so much. It is releaving to be able to get some understanding or to identify the issues involved where suspect security issues could be at risk.

I still don't understand why MSOFFICE would initialize such files at start-up. Oh well, at least have a starting point to go on. Thanks again.

 

[vop]

OK - things are now understandable.

I had recently started using (and fully activated) the Microsoft Script Editor environment (MSE.exe) for use in creating VBscripts.

THere we have it - cause and effect. At least annoying is a better and more acceptible explanation than possible vulnerabilty.