4

In literally thousands of folders and subfolders, I have files called "test.txt", which are always exactly 48 bytes, looking like this:

2
NUL
8
T
2
DLE
0
B
2
NUL
8
H
2
NUL 
0
P

Or in hex:

320D0A200D0A380D0A540D0A320D0A10
0D0A300D0A420D0A320D0A200D0A380D
0A480D0A320D0A200D0A300D0A500D0A

Sometimes the files in folders I am working in change, typically once a day. Only the numbers ever change, the letters (T, B, H, P) and the NULL and DLE characters always stay the same.

I've been having this for a while on multiple computers, but my colleagues don't. The files exclusively seem to appear in folders that are part of some software project, but not restricted to any particular programming language (Python, Java, C#), IDE (Eclipse, Unity) or versioning control system (Git, SVN).

Finally, I find this issue impossible to Google on, because every other coding example uses 'test.txt' and adding 'in every folder', 'appear' or other search terms don't seem to help one bit :) I'm very sure that I myself have never created any services that constantly monitor my file system and leave mysterious pieces of text all over the place.

So I'm pretty clueless about what could be creating these files, and mildly worried that it might be a sign of some piece of malware. Does anyone have a clue what is making these files on my computer? Is Windows, a virus scanner or any legit piece of software known to do this? Any suggestions to find out what process is modifying the files?

Improve this question
2
  • 2
    run ProcMon and look if you can capture which process created the files: technet.microsoft.com/en-us/sysinternals/bb896645
    – magicandre1981
    Mar 3, 2015 at 5:38
  • Thanks for that suggestion @magicandre, I set up a filter to show any event related to a path ending in test.txt. Now I just wait to see what happens, I guess :)
    – Junuxx
    Mar 3, 2015 at 5:52

1 Answer 1

Reset to default
7

The structure looks exactly like the ones for real time interfacing / embedded systems that use the 9512 (and other) microcontrollers.

There are several applications that may use such code, including java-based...so if you have a big programming rig with lots of programming tools installed it will be hard to determine what generates it.

To get a clue, delete the file and when it appears again look at the creation date/time. It will give you a clue towards what's making it.

Auditing functionality in Windows can also help with this kind of situation, but it generates such large volumes of nearly useless data that it's, practically speaking, not worth the dig-in.

You can also get Process Monitor (free) and monitor the processes at the time it spawns. It will make it easier for you to identify what creates it.

Improve this answer
1
  • 5
    Yay, that helped! Managed to reproduce a write to the files. Apparently a 3rd party DLL I'm using to control a piece of hardware is the culprit. Process Monitor looks like a really nifty tool, but even with it running and knowing the time it happened, I didn't find the actual event. Oh well. Glad to know what causes it, thanks!
    – Junuxx
    Mar 3, 2015 at 7:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .