Huge NOD32 files

[time]

A customer is experiencing extremely strange behaviour on their Win2k PC. Specifically, enormous (up to 30-40GB) files are being created in their NOD32 updfiles folder. Both Eset and I are stumped.

The files are not being downloaded - sometimes the system adds nearly 1GB to the size every minute.

CPU utilization hits 100%.

The problem seems to only occur for maybe half an hour at a time (?) each day.

Process Explorer doesn't show anything obvious (but then, I haven't been able to run it or anything similar when the problem actually occurs).

NOD32 can't see anything.

Ad-Aware SE can't see anything.

Housecall can't see anything.

Security Task Manager threw up a decidedly suspicious file, but deleting it and some others didn't help.

Compressing one of the smaller files didn't seem to shrink it at all.

The files are way too big to be able to send away for analysis. Does anyone know of a utility that can slice small pieces out of a huge file?

The file names look like the normal NOD32 update files but are subtly different. For example, NOD32 has the files upd.ver and lastupd.ver. These files are usually called upd####.ver, where #### is hexadecimal.

The problem is also evident on an older Win98 PC, only the files aren't so big. It might have been networked to the Win2k box at some time in the past, or same games might be installed. Who knows?

It goes without saying that NOD32 was uninstalled and reinstalled. The only idea I have left is to try Kaspersky AV, although I have this sinking feeling that I already tried it some months ago when this problem first surfaced.

 

[Will Rickards]

Have you posted to the wilderssecurity forums with this?

 

[time]

Yes. Mod immediately flicked me to Eset support.

I was going to post a link to my post there, but the Wilders site appears to be down right now.

 

[mubs]

For file splitting:

Go here and search (in your browser) for GSplit or scroll down to approximately the middle.

 

[Buck]

Have you tried F-Secure for your Anti-Virus software? Also, have you run Giant's AntiSpyware software?

 

[time]

Thanks for that, Mubs. It looks a lot better than the others I dug up.

Buck, why F-Secure?

No, I haven't run Giant. I guess I'll give it a try, but I lack confidence in all spyware scanners when things get this hairy.

 

[Buck]

Thanks for that, Mubs. It looks a lot better than the others I dug up.

Buck, why F-Secure?

No, I haven't run Giant. I guess I'll give it a try, but I lack confidence in all spyware scanners when things get this hairy.

F-Secure because their recent (2003 & 2004) track record for Windows is excellent (I'm assuming this is a Windows system). Plus, it is something different, like Kaspersky.

Giant Antispyware because it works better than Adaware and Spybot. If you're not careful, Giant will castrate your system of everything. I lost network connectivity from a complete system scan from Giant (of course it was my fault, I ignored Giant's recommendation and told it to remove everything it found).

It would be nice to find a tool that gives you detailed file information, such as when it was last accessed and by what. Adaware has an extension like that, but it will only show that type of information for malicious files that it finds.

 

[time]

It would be nice to find a tool that gives you detailed file information, such as when it was last accessed and by what.

I'm thinking Filemon from Sysinternals might be worth a shot.

 

[The JoJo]

Have you tried F-Secure for your Anti-Virus software? Also, have you run Giant's AntiSpyware software?

My recommendation also, here we use F-secure quite a lot, and it deffinitely gives me much less (hmm, none?) problems than the others (all the usual suspects known on this forum....).

 

[time]

It would have been nice if someone had mentioned that F-Secure proceeds to download more than 50MB as part of its initialization. It took so long, I had to leave it still downloading. :-?

Giant found one piece of spyware - PowerReg Scheduler V3, which the PC had had previously. I thought it was just a dead link when Security Task Manager detected it but correctly reported it as inactive. It appears that the program does not start every time it is launched. Tricky.

Unfortunately, I very much doubt this is the cause of the problem. I left Filemon autostarting in the hope that it will capture the perpetrator in action.

Thanks for the help so far.