temp file

Discussion in 'Malware Help (A Specialist Will Reply)' started by razz, Jul 24, 2005.

  1. razz

    razz Private E-2

    have 2 files in local settings/temp that will not let me delete until i shut down, then they come back under another name, they start with DF and 4 letters and numbers, does anyone know what they are associated with?
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please follow the steps below:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
  3. razz

    razz Private E-2

    done all the read me first, could not run online scans in safe mode, done them on normal. Bitdefender found vbs.trojan downloader and deleted it. Rav found 2 suspious mail files, I deleted them. Adware found this file and deleted it
    ======================================================

    WINDOWS
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    obj[0]=RegData : software\microsoft\windows nt\currentversion\winlogon "Shell"

    The rest of the programs found nothing.
     

    Attached Files:

  4. razz

    razz Private E-2

    forgot to tell you the DFXXXX files are in the temp file again
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your HJT log is clean. The temp files you are referring to are more than likely just files Windows is creating when it boots up. It does need to create file like this. You normally will be able to delete all but the most recent files which are for the current date/time you booted.

    Did you want your default page to be blank?

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds