Userlist.exe

[FrogEh]

I have been having strange problems with my laptop for a while - the available HD space keeps shrinking. I have increased my C partition from 5 GB to 9 GB and within a week, I have less than 1 GB free space - this weekend, it shrank from 880 MB to 630 MB while the pc was idle.

There are no unusual files and I do not think the swap file is the reason for the problem (especially since I redirected it to the D Drive).

I do notice that the CPU is running at 100% even while sitting idle. There is one process titled "userlist.exe" which is running at near 80% constantly (unless there is another program running, at which point it drops down CPU utilization temporarily but then heads back to over 80%a usage).

I have tried ending this process and it is not allowed. I have tried searching for any file named "userlist" and find nothing with that name.

I am running win 2000 pro.

There are no unusually large files appearing on the C drive that I can spot and virtually nothing new recently which might look like the HD space culprit.

Any ideas ?

 

[wolluf]

virus

http://www.symantec.com/avcenter/venc/dyn/8722.html

http://www.symantec.com/avcenter/venc/dyn/4922.html

 

[FrogEh]

I also thought this could be a virus - only problem is that this pc has NAV 2003 on it, autodetect is set and the system has a scheduled scan on it weekly. This problem has been getting worse since mid-May and therefore the system has been live updated at least 10 times since then and also scanned at least 10 times since then. How could this be a virus if NAV is not detecting it ?

 

[FrogEh]

followup next problem

I am having lots of problems with my laptop - HD space evaporating daily even with no usage. For example, I increased the partition size of my system partition to 9 GB from 5 GB and within a week have only got 400MB of space left unused.

I have tried several different remedies but cannot even find a significantly large file to account for this problem nor is there a virus on the pc either.

Today, I started copying all files to another pc in anticipation of just reformatting the entire drive and starting over. I am trying to copy "9 GB" (if you believe the space allocation) to another drive with 35 GB of free space. However, midway through the process, I get an alert telling me that a file "mybot.log" is too big to transfer and there is not enough space to complete the process. This mybot.log file is supposedly in the WinNT folder.

I have searced the drive on several occassions looking for this mybot.log file but cannot find it. To the best of my knowledge, all file folders are set up to show hidden files, so that is not the problem either.

 

[jrbarnett]

Hi,

I have had a look for mybot.log on the web and it seems to be a logfile for eggdrop (

http://www.baschny.de/eggdrop/)

but they use the filename
mybot.log.date (eg mybot.log.2003-08-04 for today)

so i would do a search for mybot.log.* on all hard drives and see what comes up.

John

 

[FrogEh]

thanks

I already tried this and came up empty. This is a truly strange situation and I can't help thinking my partition has been compromised or is somehow faulty.

I determined that I wanted to copy over all files and simply reformat the HD and reinstall all software. When copying over the files to another PC, the process was halted mid stream during the copying of the Winnt folder. Midway through copying that folder, I received a message stating it could not copy file "mybot.log" as it was too large. This is odd since the originating pc has a 9 GB partition and the recipient pc has a 36 GB partition available.

I searched everywhere for mybot and found nothing - not using search, not through individual examination of all folders, etc. It does not appear in my registry either. I finally copied over every folder in Winnt individually with no problems. So, somehow my pc is seeing this file when it is doing a mass copy of all folders but not when copying over individual folders. On top of that, the mybot file cannot be found through a search process.

Any ideas ?

 

[jpm121]

You can deny it all you want to, but your system is compromised by a virus or trojan.

Look at the name of the file: My Bot. Bots are trojan components used by script kiddies for various types of attacks or keystroke loggers. This file probably contains every thing you've typed into your keyboard for months, including passwords and whatever else.

Copying the entire hard drive to a new machine will do precisely one thing -- compromise your new machine, and give the logger more time to grow.

Download Spybot and Anti-Trojan from

http://www.download.com

and fix it once and for all.

Anti-virus programs are great, but they don't cure everything.

 

[jpm121]

Oh, and the file is generally located inside \WINNT\SYSTEM32\SECURITY

Make sure you're able to see hidden and system files -- that's probably why it didn't show up during your search.

 

[jrbarnett]

I would add unticking the "hide protected operating system files" to Jpm121's suggestion as well.

John