I've been having this really strange problem, and it's been happening over the last several months. You see, every now and then, I'd look in the root folder of my 'C' drive, and there'd be this file called "trace.txt" that was filled with 0 (zeros). Usually, I would just delete the file and move on. But then I'd come back days later, and the bugger would be back, and it would have all these zeros in it again.
So I started to get a bit annoyed. I mean, it wasn't a huge problem (it would add maybe half a dozen zeros a day, so it's not like it was filling up my hard drive or anything), but it was still a problem. Also, I didn't know what was creating the file in the first place!
So, I whipped out my trusty FileMon, set it to only display "trace.txt" and let it run...
Well, it only took a couple of hours before the first entries showed up – for explorer.exe! Obviously, explorer.exe in it's default installed wouldn't do something so obnoxious, so it must've been one of the myriad of shell extensions I have installed doing it.
So now, I whip out my trusty Process Explorer, open up the modules view for explorer.exe and have a look at all the yellow-highlighted rows (which indicate images that have been rebased: I figured any programmer lousy enough to write to a file in the root directory without my knowledge would have to be lousy enough to also not rebase their shell extension DLL). Simply right-clicked on each, selected "Properties..." went to the Strings tab and did a "Find..." for "trace.txt"
Ah HA! I found it, the string "C:\trace.txt"
I found it in a shell extension provided by the demo edition of "HHD Hex Editor," which I must've downloaded ages ago to look at a binary file or something. I can't even remember why I downloaded it now... but it looks like it had a hard-coded reference to the file "C:\trace.txt". I don't know why, but I wonder what would have happened if I'd set trace.txt's security properties to deny write access to my account? Or if I didn't have a C: drive at all?
Anyway, suffice to say, I've removed the offending software, and I don't think I'll bother to try any of the newer versions.