filename is my password -- anyone know about this

(Right forum for this?)

I just happened to notice a file in my root (C:\) -- a 0 byte file whose name is my administrator password, created yesterday at 8:38 local (CST), yes, I was logged in at the time. There's nothing unusal about the permissions or attributes. There's no alternate data stream in it.


Putting aside the myriad possible ways I could have brain-farted this and created it in my sleep -- anyone have any idea how or what *could* have done this? Have you seen this before?


I'm thinking a failed harvest attempt by something...


System is a pretty well locked down Win XP (locked down = server service off, messenger service off, most current Zone Alarm, non-essential services off, etc.). I run ClamWin every week. I just ran SpyBot, Adaware, and Hijackthis a couple of days ago -- cleaned the system of simple cookie tracking baddies. It has the most current security patches and cruft (NOT including SP2). I use Firefox (v.s. Exploder). -- Yes, you could say I'm careful...

Ideas? (Cranial Rectal Inverssion?)

Wild guess: any chance you might have buched a "runas" with a output redirection at the command line and somehow typed the admin password has filename or something like that?

Ammo

Disregarding the possibility that your password is autoexec.bat or boot.ini.... ;)

Where you doing any maintenance at the time? Using a cmd prompt at the time?

I'm thinking that becaise if you mistyped some things that would use an admin password you could inadvertently pipe your password as the filename for a file that ends up with no contents similar to me typing

echo > mypassword.txt

That creates a file with "Echo is on" in it but something else may create the file and place nothing in it.

I can't think of anything besides either the two prior posts or something along the lines of malicious ware that did that with your password.

Create a new password and see what happens.

- MilitantEidolon

Again, referring to a possible cranial rectal inverssion, no, I don't recall entering my password at a command prompt and piping it into a file...



I don't have any scripts that connect drives, if I did, I'd use an astericks and not the password. There's no AT scripts scheduled, nothing in Scheduler service (it's disabled too).


Some additional information, it gets wierd-er:

At 8:38 (the time the file was created) the messenger service was started (according to Event Viewer). Upon checking the messenger service in services, I find that it is indead DISABLED, but in fact STARTED. Go figure!

Sorry to hand out such a tough one so late in the day...

Run Trend Micro's Housecall Scanner (http://housecall.trendmicro.com/) see if you find anything new.

On top of that I would run a security scan on your ports at http://scan.sygate.com/.

I would also reboot in safe-mode and run my adware scanners again.

These are the things I would do is something like that happened to me.

Worst that can come of this is you find a hole that needs to be fixed or no holes.

- MilitantEidolon

You may find the thread here interesting and informative.

Hope this helps

Thanks all.

Will try the safe mode and the link.

I scan the system often (we do pen testing...) and never saw anything strange -- am very paranoid here, knowing what's possible out there, that's why this one wierded me out.

Thanks for letting me share. I'll post more if I find something. (I just KNOW I had to fat finger something, but for the life of me, I can't think of what or how!)


Cheers!

You might want to try to find out if any other files were created at (or around) that time using something like

dir /T:C /S c: |find "2004-08-11 8:38"

or written to

dir /T:W /S c: |find "2004-08-11 8:38"

or accessed

dir /T:A /S c: |find "2004-08-11 8:38"


Ammo

Last week i installed clamwin(testing purposes, i generally use kaspersky) and i noticed last night that my vsmon service is taking up all my processor (i have zonealarm 5). I looked thru my HDD i saw some weird files. I then installed kaspersky it caught more than dozens of worms and trojens (that came into the system when clamwin was running). Therefore i will suggest u to install any other AV than clamwin. May be it solve ur mystery.