up vote 1 down vote favorite
share [g+] share [fb]

Anybody has an idea what is this file? ctapi_out_gr.txt

I found this on my C:\ and it has 0b size. Not sure what it is, as it was been created last 6.1.2011

Is this spyware?

link|improve this question
76% accept rate
feedback

4 Answers

up vote 1 down vote accepted

First of all it's just a text file, and it wouldn't be dangerous by it self. And we can't say how this file is created by just knowing it's name. I suggest you to do the following for sure:

  • Check Alternate Data Streams(ADS):

    In Microsoft's NTFS file system forks are known as Alternate Data Streams. Microsoft started using alternate data streams in NTFS to store things such as author or title file attributes and image thumbnails and with Service Pack 2 for Windows XP, Microsoft introduced the Attachment Execution Service that stores details on the origin of downloaded files in alternate data streams attached to files, in an effort to protect users from downloaded files that may present a risk. It has also been seen that viruses and other types of malware are being placed there as well. The crux of the matter is that these streams will not be revealed using normal viewing methods, whether via a command prompt or using the Windows Explorer.

    So there might be some malware placed in this file even though the file size is 0kb. You can use this application to view ADSs. Fortunately most antivirus softwares check ADSs and detect known malware hidden beneath the files.

  • Check handles:

    It's a good idea to check handles to that file to know which program has opened this file. ProcessExplorer shows you information about which handles and DLLs processes have opened or loaded.

  • Check file system activities related to this file:

    Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

  • Fully Check your system with an anti-malware application.

  • Leave this file alone:

    Perhaps this file is just a data file for other applications or even a junk file. After the checks above you may be sure what is this file.

And the last tip: I my self would just delete this file and continue working with my PC until the file is recreated or I feel a strange behavior on my system.

Hope this helps.

link|improve this answer
Thanks so much for this advice. I will try to do this and let you know how it goes. Thanks :-) – tintincutes Feb 9 '11 at 15:56
Hi just quick question, what is ADS for? – tintincutes Feb 13 '11 at 21:37
For example Alternate Data Streams can be used to store thumbnails for some file types by Windows in NTFS file systems. – fardjad Feb 14 '11 at 9:36
feedback
up vote 2 down vote

Do you have a smart card reader, SIM card reader or similar installed? If you do, the file is probably related to a driver for this.

CTAPI is a standard for smart cards.

link|improve this answer
Not that I know of. I guess I don't have – tintincutes Feb 9 '11 at 20:33
feedback
up vote 1 down vote

I get this when updating Ad-Aware. I have erased it to no effect.

Not sure if it is a Lavasoft or merely Ad-Aware issue.

Here is someone else with the same file. LINK

link|improve this answer
what is ad-aware? – tintincutes Jan 17 '11 at 1:20
Anti-Spyware software from Lavasoft. – Stanley Williams Jan 17 '11 at 1:22
hmm i am not sure if i have lavasoft. i think i don't have. what does this software do? – tintincutes Jan 17 '11 at 3:01
@tintincute Ad-Aware is name of the program, Lavasoft is the company. The program looks for spyware/arware on the computer and deletes it. If you don't have it, it could be that some spyware is trying to pass itself as Ad-Aware. – AndrejaKo Jan 17 '11 at 3:38
@AndrejaKo: Does that means someone install something on my laptop? is this some kind of keylogger? – tintincutes Jan 25 '11 at 9:04
show 1 more comment
feedback
up vote 1 down vote

According to this Italian thread file ctapi_out_gr.txt 0 bytes in C:, the translated text says :

I confirm, it is the Thesaurus of Office.

I tried to look up a word in the thesaurus in Word 2007 and the file has come back right at that moment.

link|improve this answer
so what does that mean? So this is an association of Word 2007? So this is not a virus or keylogger or whatever? – tintincutes Jan 25 '11 at 10:13
4  
Better test this answer by deleting the file, using Word's Thesaurus, and seeing if it comes back. If that's the case, then this is not a virus or any danger : Just Word creating an unused temporary file and forgetting to delete it. – harrymc Jan 25 '11 at 10:17
Something it's very good at :) – Tobias Plutat Jan 28 '11 at 8:42
I deleted the file then it didn't go back. Does that mean it was a virus? I also did some check in my system, virus scan kaspersky and so far no record of dangers. – tintincutes Feb 22 '11 at 9:04
I don't believe this is a virus. Did you go into Word and try to use the Thesaurus ? Because this is what is supposed to cause this file. – harrymc Feb 22 '11 at 9:12
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.