I am very happy to have discovered the postings here about the 0 byte ".event" files named after the containing directory because the suspicions I had about the possible culprit are confirmed!
Some weeks back I started looking for a video editor in order to edit films created by my new Panasonic Lumix DMC-ZX3 digital camera that can produce AVCHD Lite video films in HD quality (720p). I tested several open source and shareware products. Because I am very careful about not infecting my laptop I only download .EXE files from the original developer sites or from reputed download sites. My Firefox browser uses the WOT add-on to help me visit only reputed sites, not sites that want to infect my computer.
One of the video editors I downloaded was Corel Video Studio Express 2010 that I downloaded from here: LINK REMOVED on July 27 2010. Some days later, I installed the program. When I started it and before I got any usable GUI on the screen I got confronted with a very unusual request of the type "do you want Corel Video Studio to scan your hard drive for video films?". Never saw another video editing program asking that. I replied "NO" but instead of getting the application GUI right away to allow me to work with the program I got nothing and saw the hard disk light burning continuously as it happens when some program is scanning your hard disk. After some time, perhaps 30 seconds or so I decided that I don't want this kind of program and I killed the program using TaskManager, because the GUI had not yet appeared. After that I uninstalled the program using Windows 7 "Programs and Features".
Several days later I noticed for the first time that lots of directories and sub-directories had been filled with the 0-byte ".event" files, with the HIDDEN attribute ON and named after the name of the parent directory where the ".event" file was located. Whole directory trees had been processed this way. Another very annoying thing was that the directory time stamps had been changed from the original creation date and time to the date and time July 30, 1:43 PM or 1:44 PM. In any case there was a match between the time stamp of the directory and the created empty ".event" file. Not all the directory trees had been infected by the "worm" that did this. Thus I assume that the culprit had been interrupted in its work otherwise it could had infected more directories.
After I discovered this I scanned the laptop with MalwareBytes and SuperAntySpyware, not to find any thing other than the less dangerous marketing spy cookies.
Because I remember that Corel Video Studio Express wanted to scan my laptop for films, even before I got the GUI on the screen, what I consider abusive behavior, I had strongly suspected that it could be the culprit. Thus today I googled for the name Corel and the empty event files and I found this thread.
As I see that other victims also have installed Corel software, given the express desire of the program to scan one's computer before the program can be used, I assume it is the culprit. This can be tested by trying the program on a test computer... Perhaps somebody has the time to do that.
I had several hundreds of .event files in several directory trees. To remove them manually would be a time consuming task. But I use Total Commander as file manager (in my opinion the most powerful tool one can have in a PC) and I could delete the hundreds of "event" files from each directory tree by searching for "*.event" files, generating a list of all the found files and deleting all the files in the list. I would not know how to do that using Windows Explorer!
NOTE:
I see that the link to the location where I had downloaded the program from has been deleted by the moderator of this forum. As I am new to this forum (I only joined today in order to make this posting) I don't know the rules of the site about mentioning links to other pages. In any case, I want to mention that the LINK I have mentioned is referring to the corel dot com site (the producer of the product) and the page is the download page for the 30 days evaluation version of the product. What I want to say is that I did not download it form same shabby site but from the reputed site from the Corel company. I would appreciate if someone has the time to download and test this program and check if it does what I suspect it does.
The download is 781,43 Mb, an enormous size if compared to many other shareware video editors that do about the same and are only 20 or 30 Mb in size. This is thus a typical example of bloatware.
