Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

User.dat

  • 05-12-2004 3:39am
    #1
    The_B_Man
    Registered Users, Registered Users 2 Posts: 7,893 ✭✭✭


    what is this file?
    Google tells me it is a keylogger, but i always thought it was the registry! :confused:
    i ask coz i was doing a search for files containing a certain site and user.dat was among the results.
    i searched the file and it had sites like boards and apple.com aswell as names of shortcuts and textfiles on my desktop etc. in among all the gibberish.

    snippet:
    coms.ieurl19http://www.boards.ies.ieurl10C:\WINDOWS\TEMP\Drivers.ieurl11http://www.


Comments

  • #2
    jessy
    Registered Users, Registered Users 2 Posts: 950 ✭✭✭jessy


    wheres the file stored?


  • #3
    SantaHoe
    Closed Accounts Posts: 7,488 ✭✭✭SantaHoe


    In win9x the registry is kept in user.dat and system.dat
    In XP it's called ntuser.dat, so I'd question the existance of a user.dat if you've only had XP on the machine and it's definitely not a leftover from a previous '98 install.
    It's not unusual for the registry to keep track of recent urls, for things like IE's auto-complete feature for example.

    What prompted you to look at this file with suspicion in the first place? (just out of interest)
    I did a google for user.dat aswell and see what you mean, user.dat is used by Eblaster apparently... here's a link to symantecs info on this spyware:
    http://securityresponse.symantec.com/avcenter/venc/data/spyware.eblaster.html
    You can see from that link what other files Eblaster uses and check if they're present on your system.
    Also I'd reccomend you get a decent virus scanner :)
    If you're in a jam and don't have one, check out AVG's free one and perhaps a few of the more popular anti-spyware apps.
    There's also a free online virus scan on that symantec website.


  • #4
    The_B_Man
    Registered Users, Registered Users 2 Posts: 7,893 ✭✭✭The_B_Man


    i found it coz i did a search for files containg text in the windows search thing. it popped up so i figured i'd have a look.
    well im using win98 with mcafee antivirus and zonealarm so i think im pretty safe, however, i have auto complete and anything that saves passwords or forms turned off. i have history set to store for zero days and i clear the cache daily. zonealarm also has a cache cleaner set to clear the cache every 2 days and i use ad-aware.
    its coz of this that i got suspicious. otherwise i would have just assumed it was the registry. i cant remeber where the file was. im startin to get more suspicious as i type this. come to think of it, zonelarm has been giving me loads of them alert advisor things bout ICMP packets and UDP packets trying to connect, but i figured these were the NTL DHCP stuff.
    Arghhghh, must stop going to them exotic websites!! ;)


Advertisement