RE: EXTRA BOGUS Temporary Internet Files, Cookies, & History folders

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance



"Grant Robertson" wrote:

> First, let me be clear. I am not asking how to empty out the standard TIF
> (Temporary Internet Files), History, and Cookies folders. I know how to
> do that using Internet Properties.
>
> The problem I have here is an EXTRA set of BOGUS folders with the same
> names that get created in my Temp folder every time I boot up in normal
> mode. They cannot be deleted in normal mode either. If I boot to Safe
> Mode I can delete them and if I then reboot to Safe Mode again they do
> not get created.
>
> I have done some experiments and if I use MSConfig to disable all of my
> Startup items the folders still get recreated when I boot to Normal Mode.
> However, if I choose Diagnostic Startup in MSConfig then the files do not
> get recreated when I boot to Normal Mode. This tells me that the issue is
> most likely caused by some service but I can't figure out which. I am
> certainly not in the mood to reboot my computer dozens more times today
> just to figure out which service is causing this problem. I am guessing
> it has something to do with the system for replacing protected files.
>
> I have done some research in the newsgroups and the exact same issue has
> been reported several times over the last few years. Usually there is no
> response at all. In one thread some people suggested booting to the DOS
> prompt and using the DELTREE command to remove the offending files and
> they wouldn't come back after that. Unfortunately, I have tried booting
> to Safe Mode with Command Prompt as well as booting off of a floppy to
> delete the files. They just come right back when I boot to Normal Mode.
>
> Along with the a fore mentioned folders a series of .tmp files get
> created with file names such as "~DF8F55.tmp" and "~DFA943.tmp". These
> two were created within a minute of booting up. Over time I often get
> dozens more. None of these files can be deleted in Normal Mode. I get a
> dialog saying the file is being used by another program.
>
> This problem has been ongoing for months. I have no idea how long it had
> been happening before I even noticed it.
>
> I am now concerned that I may have some virus or spyware that is causing
> this. Here's the deal. I am a professional computer consultant. Most of
> what I do these days is clean up spyware off of PC's for people. I have
> scanned the hell out of my machine and never find anything other than a
> few tracking cookies. This has me completely stumped.
>
> Does anyone have any idea what could be causing this issue?
>
Grant ,
I had a Trojan worm that i spent 3 day tracking, but you wont have to spend
that long. my Virus was the W32.Beagle.gen, I finally went to my registry and
used find. when i found it. i deleted it. the hard drive is much quieter
now too. because evidently the virus was scanning my hard drive. writing the
same files as you discribe, and most likely emailing everybody it could out
of my machine without my knowledge. I had registry mechanic, norton anti
virus (installed a little too late) and adware stopper, ect.
>From my observation, (and i could be wrong) it seems that most virus/adware
protection will not mess with your registry. This is sacred ground that most
respectable companies will not tread. if you have a list of trojan virus.
go to your registry and do a find of them, then delete them, this should fix
it and then you can delete the temp files also, (if you cant, because they
are in use by another program, you sill have another virus in your registry).
The registry is the place that most (Trojan)virus hide.
Terry
P.S. Also I had problem getting live updates online because my system
config had a Startup Application that tried to shut down and disable my anti
virus.
open msconfig and eye scan for anything that is hidering your antivirus.
here is a good place to search for list of bad and good programs in the
startup.
(not total perfect, but very excellent)
http://www.sysinfo.org/startuplist.php
Good luck :)
.

Relevant Pages

  • Re: XP working not quite right.
    ... >Most programs boot and operate normally, ... >I'm concerned that the registry was corrupted somehow. ... >How do I proceed to diagnose and fix these things? ... virus scan of the hard drive. ...
    (microsoft.public.windowsxp.general)
  • Re: Acebot virus
    ... Next boot it ... I've found a few mentions of this virus from different websites, ... This will bring up the initial menu of choices and should be executed in Normal Mode. ... You can choose to go to each menu item and just download the needed files or you can ...
    (microsoft.public.windowsxp.security_admin)
  • Behavior of Randex variant.
    ... Subject: Virus Found NAV ... When "regedlt.exe" keys are present in the registry, ... I can shut down and boot up in Safe Mode at this point, ...
    (microsoft.public.security.virus)
  • Virus on my pc
    ... Despite numerus attempts to remove a virus from my pc the ... machine still refuses to boot up in normal mode, ... will but the screen turns off before i get to the user ...
    (microsoft.public.windowsxp.security_admin)
  • Virus on my pc
    ... Despite numerus attempts to remove a virus from my pc the ... machine still refuses to boot up in normal mode, ... will but the screen turns off before i get to the user ...
    (microsoft.public.windowsxp.security_admin)