PDA

View Full Version : Something Changes Quser.ini



JonathanHK
2007-01-28, 20:32
A few weeks ago I submitted a problem and Phil was very helpful in looking at the HiJackThis logfile and recommending several file references to be removed and additional anti-spyware and anti-malware to be used. Since then I have stopped using IE and am now using Firefox, and I have also installed Zone Alarm in place of Windows Firewall. However, there is still a strange bit of behavior that is driving me nuts.

In Quicken, there is a file called quser.ini, which lists the most recent data files opened, the backup path, and the most recent backup file locations. When I looked at it, I realized that the file contained incorrect information. Here is the file as I originally viewed it:

[RecentFiles]
1=C:\DATA FILES\FINANCE\QUICKEN DATA FILES (DEN)\FAMILY
2=C:\DATA FILES\FINANCE\QUICKEN DATA FILES (DEN)\BUSINESS
3=C:\Program Files\Intuit\BUSINESS
4=C:\Program Files\Intuit\FAMILY
[Quicken]
=1
BackupPath=Z:\Current Quicken\2006 Premier Files (DEN)\
[RecentBackupFiles]
1=Z:\Current Quicken\2006 Premier Files (DEN)\FAMILY_20081106.QDF
2=Z:\Current Quicken\2006 Premier Files (DEN)\FAMILY_20051022.QDF
3=Z:\Current Quicken\2006 Premier Files (DEN)\BUSINESS_20051022.QDF
4=Z:\Current Quicken\2006 Premier Files\FAMILY_20051005.QDF

#2, 3 and 4 in the RecentFiles do not exist, the backup path should be 2007 Premier Files (DEN), and the RecentBackupFiles are all incorrect.

So for the last several days I have been deleting the quser.ini file completely in the morning and then using Quicken during the day. As I use the various files and create backups, the quser.ini file becomes populated with the correct information. But by the next morning, the file information above has replaced the quser file information that was correct when I went to bed the evening before!

The other event that seems to happen overnight is this:

I had a folder on my desktop called "Monthly Bills". It had two files in it:

One is an 8k .rtf file and the other is "desktop.ini" I was going to copy those and paste them here for you to see but the "paste" option is greyed out, for some reason.

If I delete the folder in the morning it stays gone all day, but the next morning it is back in exactly the same location on the desktop where it was when I deleted it. This has been going on since the end of December.

Please look this over and see if we can come up with what is causing the problem. I am willing to take whatever steps you ask; please reply and tell me what you would like me to do next.

Thanks very much,

Jon

tashi
2007-02-26, 01:00
Hello.

If you have not resolved the problem and believe it to be malware related, please post a hjt log.

"BEFORE you POST" -Preliminary Steps (http://forums.spybot.info/showthread.php?t=288) :)

tashi
2007-03-02, 07:51
This topic has been archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.