houseisland
April 7th, 2002, 11:23 AM
Some time in mid March I was given an external Iomega Zip100, parallel interface.
I installed it together with its drivers and Iomega Ware, not because I needed it but because it looked cool sitting ontop of my PC.
Last night I went to shut down my PC which had been running locked down for most of the day, and much to my surprise there was a message from Clean Sweep stating that it wanted to confirm the logging of an installation called "Active Disk." This was most interesting since I hadn't actually installed anything at all in quite some time. I told Clean Sweep to do its thing, and then I rebooted to find out just what-the-hell was going on.
Here is an edited version of the Clean Sweep log file:
Folder 'C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK' -- Added.
Folder 'C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK\E' -- Added.
Folder 'C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK\F' -- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\TEMP\MAJOR APPLICATION SETUP(0004).TXT'
-- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\COOKIES\INDEX.DAT' -- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\HISTORY\HISTORY.IE5\INDEX.DAT' -- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\HISTORY\HISTORY.IE5\MSHISTXZY\INDEX.DAT'
-- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\TEMPORARY INTERNET
FILES\CONTENT.IE5\INDEX.DAT' -- Added.
File 'C:\PROGRAM FILES\CREATIVE\SBPCI5122K\LAUNCHER\GROUP\AUDIOHQ\G ROUP.INI' -- Added.
File 'C:\PROGRAM FILES\CREATIVE\SBPCI5122K\PLAYCENTER\ALBUM\NEW TITLE (1).ABM' -- Added.
File 'C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.LOG' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL1.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL2.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\EUDORA.INI' -- Added.
File 'C:\PROGRAM FILES\EUDORA\EUDORA.LOG' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL3.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\LMOS.DAT' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL4.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL4.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\OUT.TOC' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL5.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL6.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL7.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL8.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL9.FOL\DESCMAP.PCE' -- Added.
File 'C:\RECYCLER\NPROTECT\123.LOG' -- Added.
Tons more log files.........
File 'C:\RECYCLER\NPROTECT\XYZ.PCE' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.TOC' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.DAT' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.LOK' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.E' -- Added.
Tons more *.PCE, *.TOC, *.DAT, *.LOK, *.E files ............
File 'C:\WINNT\CDPLAYER.INI' -- Added.
Now let's start at the top of this mess with:
C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK
Here subfolders are created which match the drive letters of your CDROM drives, E and F in my case -- see log file above. These subfolders can be deleted manually but the Active Disk folder cannot be deleted without uninstalling Iomega Active Disk or without stopping processes associated with it. What is really interesting here is that if you manually delete the subfolders while Active Disk is installed, they are recreated as soon as you put any CD into the CDROM drives. Do I feel just a little paranoid here?
Let's jack up the paranoia factor a little though by reading further down the log file. Why is it looking at application setup files, cookie files, Internet content and history files, Creative Playcenter files, and Windows CD Player files?
But now let's get really, really, really paranoid here. What-the-f*@% is it doing with my email program?
I had clean sweep remove the recorded installation of Active Disk, which seems not to have installed anything at all but rather laid claim to existing files -- now I must reconstruct my email program manually from backups because it doesn't work. I have also removed the Iomega Active Disk application.
Most bogus!
I installed it together with its drivers and Iomega Ware, not because I needed it but because it looked cool sitting ontop of my PC.
Last night I went to shut down my PC which had been running locked down for most of the day, and much to my surprise there was a message from Clean Sweep stating that it wanted to confirm the logging of an installation called "Active Disk." This was most interesting since I hadn't actually installed anything at all in quite some time. I told Clean Sweep to do its thing, and then I rebooted to find out just what-the-hell was going on.
Here is an edited version of the Clean Sweep log file:
Folder 'C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK' -- Added.
Folder 'C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK\E' -- Added.
Folder 'C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK\F' -- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\TEMP\MAJOR APPLICATION SETUP(0004).TXT'
-- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\COOKIES\INDEX.DAT' -- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\HISTORY\HISTORY.IE5\INDEX.DAT' -- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\HISTORY\HISTORY.IE5\MSHISTXZY\INDEX.DAT'
-- Added.
File 'C:\DOCUMENTS AND SETTINGS\USERNAME\LOCAL SETTINGS\TEMPORARY INTERNET
FILES\CONTENT.IE5\INDEX.DAT' -- Added.
File 'C:\PROGRAM FILES\CREATIVE\SBPCI5122K\LAUNCHER\GROUP\AUDIOHQ\G ROUP.INI' -- Added.
File 'C:\PROGRAM FILES\CREATIVE\SBPCI5122K\PLAYCENTER\ALBUM\NEW TITLE (1).ABM' -- Added.
File 'C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.LOG' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL1.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL2.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\EUDORA.INI' -- Added.
File 'C:\PROGRAM FILES\EUDORA\EUDORA.LOG' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL3.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\LMOS.DAT' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL4.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL4.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\OUT.TOC' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL5.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL6.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL7.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL8.FOL\DESCMAP.PCE' -- Added.
File 'C:\PROGRAM FILES\EUDORA\FOL9.FOL\DESCMAP.PCE' -- Added.
File 'C:\RECYCLER\NPROTECT\123.LOG' -- Added.
Tons more log files.........
File 'C:\RECYCLER\NPROTECT\XYZ.PCE' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.TOC' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.DAT' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.LOK' -- Added.
File 'C:\RECYCLER\NPROTECT\XYZ.E' -- Added.
Tons more *.PCE, *.TOC, *.DAT, *.LOK, *.E files ............
File 'C:\WINNT\CDPLAYER.INI' -- Added.
Now let's start at the top of this mess with:
C:\DOCUMENTS AND SETTINGS\USERNAME\APPLICATION DATA\ACTIVE DISK
Here subfolders are created which match the drive letters of your CDROM drives, E and F in my case -- see log file above. These subfolders can be deleted manually but the Active Disk folder cannot be deleted without uninstalling Iomega Active Disk or without stopping processes associated with it. What is really interesting here is that if you manually delete the subfolders while Active Disk is installed, they are recreated as soon as you put any CD into the CDROM drives. Do I feel just a little paranoid here?
Let's jack up the paranoia factor a little though by reading further down the log file. Why is it looking at application setup files, cookie files, Internet content and history files, Creative Playcenter files, and Windows CD Player files?
But now let's get really, really, really paranoid here. What-the-f*@% is it doing with my email program?
I had clean sweep remove the recorded installation of Active Disk, which seems not to have installed anything at all but rather laid claim to existing files -- now I must reconstruct my email program manually from backups because it doesn't work. I have also removed the Iomega Active Disk application.
Most bogus!