blank.EXE

XP-PRO with all the updates.

In my startup config there is an entry for <blank>.exe. That is, the file is called .exe with no leading filename. The corresponding Registry entry in... HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ... looks like this... Name = (Default), Type = REG_SZ, Data = .exe
In... C:\Documents and Settings\Administrator ...there is a file called .exe with a size of zero bytes. On deleting either the startup entry or the actual file both recreate themselves. I have scanned with ADAWARE, SPYBOT and AVAST all report no problems. A Google of this condition produces conflicting opinions, some saying it's a trojan others that it's a normal condition in some instances. I'm not having any problems due to this.
The start of this condition seemed to correspond to the installation of True Image 10. Is this a creation of TI10 ?

 

Upload it to virus total.

 

Why not un-install TrueImage. check the run statement and see if it disappears.
Re-install.

Or, un-install True Image.
run xp-system restore and put your registry back prior to True Image and check your listings.

 

Hmm this thread might get pounced on, but, before deleting these entries, make sure you have switched off the XP restore feature, delete the entries, then reboot into safe mode and run your virus/worm checker from there.

Once all is well, boot back into normal mode and restart System Restore if you want.

There are nasties out there, that hide in the system restore folders and respawn themselves.

Colin

 

Through a process of elimination I have largely discounted TI10 as the source of this. The .exe file is zero bytes, I have checked this by renaming it and opening in Notepad, this negates any point in submitting it for virus checking. How do you virus check a file of zero bytes ? The startup entry only has .exe, which is not a valid data path and so nothing will get started. I have no running processes that are abnormal. I have cleared System Restore and have scanned with several online virus checkers. If it's a virus/trojan then it's a very complex and new variety. This is not causing a problem other than I am intrigued as to why it is there.