Can't seem to get rid of this file

jak3y · Jun 26, 2005

Ran everything including hijackthis (which im comfortable at this point).
On my Aunts computer, she keeps having this Perflib_Perfdata_8c4.dat.
Which no matter what number ending it ends in (in this case "8c4") it says that it is always being used by some program.
This "Perflib"Perfdata" keeps reinventing itself and It always ends up in her TEMP file folder.
C:\DOCUME~1\judi\LOCALS~1\Temp\Perflib_Perfdata_8c4.dat
ad-aware, hijack, cwshredder, hsremove
can't get rid of it.
any clues as to what it is?
help would be appreciated, thanks guys

foot loose · Jun 27, 2005

Please observe our tried and trued method of removing malware via Chaslang, BJGarrick, Philliephan or myself before posting in this specific forum... Thanks

jak3y · Jun 26, 2005

in safe mode, the file doesn't show.
hmmm

bjgarrick · Jun 26, 2005

Sounds like this could be related to Virtumundo!

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

After doing ALL of the above if you still have a problem:

http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

jak3y · Jun 27, 2005

well big G (and anyone else)...i did the HJT and it found nothing
so here's the attachment...good luck, cuz i tried all possible/viable ways of hunting this thing down.
thanks.

DavidGP · Jun 27, 2005

albiet for w2k it will apply to XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q285798

The %SystemRoot%\System32\Perflib_Perfdataxxx.dat files are created by the System Monitor. When you shutdown normally, the file should be deleted.

If you have an abormal shutdown, these files can become orphaned, and accumulate on your computer.

Under some yet to be determined circumstances, these files can become orphaned during normal operation.

The best way to remove these files is to add a command in a logon script:

del /q %SystemRoot%\System32\Perflib_Perfdata*.dat
Click to expand...

http://www.jsifaq.com/subG/TIP3300/rh3343.htm

maybe not an easy task to locate whats creating that file at shutdown tho.... maybe run Process Explorer and see if anythings locking that file.

as a last resort its quite likely that this can be disabled in GPEDIT or the Registry... depending on OS version.

------------------
2nd Edit: just noticed your running 2 antivirus apps... remove one of them it could be the problem!

jak3y · Jun 27, 2005

Halo, now all i gotta do is learn how to add a command logon script...lol
wanna help me out here? lol

jak3y · Jun 29, 2005

anyone...anyone...? ferris... lol

jak3y · Jun 29, 2005

trying this one again...im assuming by non-response...it's a toughy

jak3y · Jun 29, 2005

here's the HJT today...all done in safe mode, with ad-aware, spybot, cwshredder, about:buster, etc...etc...

DavidGP · Jun 29, 2005

Sorry jakey ..... completly forgot about I'd posted in this thread.. thought I was in software.... plus with all the new posts the Spyware forum wizzes by so quick...... also been way busy in work!

dont think you have a spyware issue BUT Chas and BJ will soon correct me if I'm wrong,

Do you still have 2 antivirus apps installed?

Have you booted into Safe Mode and seen if it happens then?

In a word yes its a toughy as tracing what software or hardware could be causing the perfdata file to be created is not easy as I not come across that often or at all, I have tho read and do know that you maybe able to edit the registry to stop the perfdat file from being created ( would need to read more about what it could affect tho ) but this depends on how happy you are to edit the registry?

If I foregt do please PM me to basically remind me

ps...... WHO THE HELL IS FERRIS??

chaslang · Jun 30, 2005

You need to post a log from normal boot mode. The one you posted was from safe mode. However before doing that, uninstall one of the antivirus applications you have installed. You have both Avast and AVG. You should only use one antivirus application.

jak3y · Jun 30, 2005

well...here it is...seems fine...but that preflip file is still showing up (whenever i right click an executable file on my usb key)

chaslang · Jul 1, 2005

jak3y said:

well...here it is...seems fine...but that preflip file is still showing up (whenever i right click an executable file on my usb key)
Click to expand...

Your problems are not malware related. Perflib_Perfdata are valid files that windows creates.

You may want to discuss this in the Software Forum. In fact, I will move this thread there with a redirect from the Spyware Forum (so you will still find it).

jak3y · Jul 1, 2005

perfect thanks Chas'...

Franklin · Jul 1, 2005

Try Security task manager.May be of help.This link-
http://www.neuber.com/taskmanager/

And a stubborn file deletion tool-
http://ccollomb.free.fr/unlocker/

jak3y · Jul 1, 2005

thanks Franklin will give the 2nd one a try first lol...looks more promising lol

DavidGP · Jul 1, 2005

jak3y said:

thanks Franklin will give the 2nd one a try first lol...looks more promising lol
Click to expand...

Even when that app would delete perflib on reboot or shutdown it will be created again.. perflib is not a stubborn to remove file its a OS file that stubbornly creates itself because of somesuch error or issue, worth a try tho as stranger things have happened.

now as you have just mentioned it happens when you use your USB key.. is that the only time it happens.. what if you remove the USB key software/driver does it still create its self?

Have you checked for updated drivers for the USB key?

How happy are you to edit the registry? ( we can try to add a registry key to block it from starting ) .. i'm still looking for a none registry answer.

jak3y · Jul 4, 2005

Halo said:

Even when that app would delete perflib on reboot or shutdown it will be created again.. perflib is not a stubborn to remove file its a OS file that stubbornly creates itself because of somesuch error or issue, worth a try tho as stranger things have happened.

now as you have just mentioned it happens when you use your USB key.. is that the only time it happens.. what if you remove the USB key software/driver does it still create its self?
Click to expand...

well I DIDN'T really install software for the key, i actually just pop it in the usb and run it...(sometimes forget to remove it properly-using the lower right toolbar icon to "safely remove hardware" but...otherwise, i just use the drivers that winxp installs for it. it doesn't come with any software to begin with

Have you checked for updated drivers for the USB key?
Click to expand...

no i haven't...it only happens on my aunts computer, my computer and everyone elses it runs fine.

How happy are you to edit the registry? ( we can try to add a registry key to block it from starting ) .. i'm still looking for a none registry answer.
Click to expand...

im fine with it, but if it's not posing a threat or the file isn't as you said, maybe i should just leave it as is? lol?
thanks halo

DavidGP · Jul 4, 2005

jak3y said:

well I DIDN'T really install software for the key, i actually just pop it in the usb and run it...(sometimes forget to remove it properly-using the lower right toolbar icon to "safely remove hardware" but...otherwise, i just use the drivers that winxp installs for it. it doesn't come with any software to begin with

no i haven't...it only happens on my aunts computer, my computer and everyone elses it runs fine.

im fine with it, but if it's not posing a threat or the file isn't as you said, maybe i should just leave it as is? lol?
thanks halo
Click to expand...

Ah ok, just curious if the USB key was a contibution to the file, dunno if this is part of XP Home or not as I dont have any machines at my disposal with XPH on, but I was told that if you goto > Control Panel > Add/Remove choose Add/Remove Windows Components and untick Managment and Monitoring Tools > Next it should uninstall the app that produces that perflib file on reboot.

File wont pose a threat, more of any annoyance.

jak3y · Jul 4, 2005

we're running on xppro and that very component was already unchecked...so...what now... lol
this is a trivial issue, but now im just stubborn and the challenge is getting the better of me.lol

bchivers · Jul 4, 2005

Have you tried gipo move on boot?Link
Go to the bottom of the page where it says "Old Version (Freeware) "

doug_hile · Apr 6, 2010

:cryAUUUUGH~!~!~! too compicated for my apes brain to understand the secrets of the Krell......
Isn't there simply a specific program that will get rid of/correct/remove/remedy this "thing"????
Sounds like it is a basic flaw of Windows ---
All the Windows updates, etc,,,, plus AVG, which I love, cannot fix this "thing"...
I would do a complete system recovery,,, but it takes weeks to reconstruct everything and reload all the updates.
Maybe I should just tote this Infernal Machine up to Best Buy and let the Geek Squad have at it?

AUUUUUUUUUGHHHHHHHHH~~!~!~!~!~!~!~!

;-(

hrlow2 · Apr 6, 2010

Welcome to Major Geeks, but what the ?????.

doug_hile · Apr 6, 2010

thanks,,, but,, I was just looking for a downloadable fix that seems to be the forte' of this site. I am not far enough along to even understand what I am reading here, but just about intelligent enough to click the appropriate boxes, as long as there aren't too many of 'em... ya know?
Sorry to be such a novice, but, sometimes I just need a hint ...

hrlow2 · Apr 6, 2010

You might want to start a new thread stating your problem, rather than resurect one from 5 years ago.

foot loose · Apr 7, 2010

Wow man i have not been in this forum for a looonnnggggg time.. I got a email from major geeks saying to respond to this tread......i forgot all about this place... I'M am Back..

hrlow2 · Apr 7, 2010

Welcome back.

Log in or Sign up

Can't seem to get rid of this file

jak3y Guest

foot loose Private E-2

jak3y Guest

bjgarrick MajorGeeks Admin - Malware Expert

jak3y Guest

Attached Files:

hijackthis.log

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

jak3y Guest

jak3y Guest

jak3y Guest

jak3y Guest

Attached Files:

hijackthis.log

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jak3y Guest

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jak3y Guest

Franklin Corporal

jak3y Guest

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

jak3y Guest

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

jak3y Guest

bchivers Private First Class

doug_hile Private E-2

hrlow2 MajorGeek

doug_hile Private E-2

hrlow2 MajorGeek

foot loose Private E-2

hrlow2 MajorGeek