Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Windows Event Log causing "win403700" to autostart at boot

28 Aug 2011   #1
rennervision

Windows 7 Home Premium x64
 
 
Windows Event Log causing "win403700" to autostart at boot

Hello.

I'm having a peculiar problem that just started yesterday out of the blue. Suddenly when I boot up in Windows 7 (64-bit), there's always an open dat file titled "win403700" that greets me on my desktop. It's of no use to me, since it's filled with lines and lines of code that are completely encrypted in notepad.

After running CCleaner to clean out my registry and hard drive, followed by over two hours of sytematically uninstalling programs, disabling startup items, and then finally moving on to msconfig items under the services tab, I was able to determine that "Windows Event Log" is what causes this to pop open with each new startup. (I assume everyone has it enabled under msconfig > services.)

Would anyone know why it is doing this? If I can just disable it and forget about it I will, but based on what I'm reading here, it appears to be an essential process for updating Windows:

Windows Event Log - Process and Service wiki

Plus I would like to know if this is an indicator of a more serious problem. (A Malwarebytes scan did come back clean by the way.)

Thanks.


My System SpecsSystem Spec
.
21 Sep 2011   #2
Roland123

Windows 7 Pro x64
 
 

I am having the exact same problem, also on Win 7 x64 except that the file that's popping up in notepad for me is "win403750.dat."

Most of the file is binary gibberish but there is a string near the beginning that reads "This program cannot be run in DOS mode," which makes me think that this .dat file is an executable. I've tried renaming it to an .exe extension and running it, but Windows says that the file isn't compatible with the version of Windows I'm running. An ESET scan of the file comes out clean.

I also distinctly remember that this started happening after the latest Windows update(s) I ran 1~2 weeks ago.

@rennervision: Have you solved or discovered more about this issue?
My System SpecsSystem Spec
21 Sep 2011   #3
rennervision

Windows 7 Home Premium x64
 
 

Hello Roland123 -

Yes, I did figure it out - it's actually some kind of trojan. There was a file with the exact same name hidden in C:\users\[name]\appdata\local\temp. As soon as I saw it and double clicked on it, my Norton quarrantined it. Now everything's clean, but I'm not sure how it got there in the first place.
My System SpecsSystem Spec
.

23 Sep 2011   #4
Roland123

Windows 7 Pro x64
 
 

Deleting the file in the location you've specified seems to have solved the issue, so that's awesome. I'm a little worried that ESET didn't pick it up as a trojan, though. Do you remember what kind of trojan Norton flagged it as? Could it have been a false positive of some kind?

Anyways, many thanks for the info, rennervision.
My System SpecsSystem Spec
23 Sep 2011   #5
rennervision

Windows 7 Home Premium x64
 
 

Norton flagged it as a Trojan.Gen. I also thought it was odd it got in there undetected.

Someone on the Malwarebytes forum also recently had it as well:

TDSS/Alureon - Malwarebytes Forum

Since it was driving me CRAZY, as far as I'm concerned it met the definition of a virus. I'm glad I was able to help.
My System SpecsSystem Spec
Reply

 Windows Event Log causing "win403700" to autostart at boot




Thread Tools




Similar help and support threads
Thread Forum
Windows 7 x64 "Event Viewer has stopped working"
Whenever I launch Event Viewer, I get this message. Ditto when I try launching Computer Management. I sometimes get a message about Adding a snap-in to console. But it never works. I ran SFC SCANNOW and it fix some stuff requiring a restart and is running clean now. No improvement. I tried...
General Discussion
"Select Proper Boot Device" now "NTLDR is missing"
Computer Specs: CPU: I5-2400 MB: Asus Pz868 Ram: Corsair 8GB Vengeance LP Using on board VIdeo For now Maxtor HD Sata WD Raptor Sata HP Lightscribe DVD-r Drive Sata Problem I was having once I completed my new build with old system parts was as listed in title. It started out as select...
BSOD Help and Support
Both "System reserved" and "C" partition cloned to external HDD: boot?
With EaseUS Backup Tool, I've cloned these two partitions ("System Reserved" and "C") to same-sized partitions on a external HDD ("X" and "Y"). Picture tells it concisely: How to make drives "X" and "Y" boot-able? In "Disk Management", I've noticed these partition labels missing: "X" (or...
Installation & Setup
Windows freeze on boot at "Starting Windows" and "LOADED ...\disk.sys"
I have Windows 7 Ultimate x64 The other day I was afk while listening to loud music from my computer. Suddenly the speakers began screaming in a high pitch and when I got to my computer it had frozen. I tried to reboot it, but it simply froze at the Windows loading screen with the floating...
General Discussion
Windows failed to conect to " system event notification service"
My computer recently started having issues........ here is what is going on: * boot computer * Windows boot screen displayed ~ 1 minute * screen goes black. Can move mouse. Drive light constantly on, not blinking. ~ 5 minutes * log in screen comes up / log in * Desktop loads ~ 1 minute >...
BSOD Help and Support
"Windows Live Mail has stopped working" - Files describe event; Fix?
Three times in the last 24 hours this warning has opened on my Desktop, after I have just closed Windows Live Mail . After the warning disappears from the Desktop, WLM opens yet again. Naturally I've allowed the issue to be reported to MS and sent the information, but I note that there is...
Browsers & Mail


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 09:29.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App