Jump to content

What is this?


Andavari

Recommended Posts

  • Moderators

I'm trying to figure out how out of nowhere a file without an extension named "TempFile" appeared in the Windows XP SP2 C:\Windows directory. It gets recreated everytime I delete it with Unlocker and with HijackThis. A malware and virus scan in Safe Mode turned up nothing, the system was deemed clean.

 

Some info on the file:

Location: C:\Windows\TempFile

Size: 8.01 MB (8,405,015 bytes)

Status: Locked/In-use by the system

 

Info I was able to grab from the file:

* RajuRam

* xV4 RamDisk FAT32

* MS-HORDRIVE

 

A "RamDisk for FAT32" makes no sense to me since my file system is NTFS. Also the file first appeared on Oct 1st, and on that date I didn't install or remove anything whatsoever.

 

Any insight would be greatly appreciated!

 

Edit:

Disabling programs that startup with the system didn't solve the issue, therefore I'm leaning towards Windows itself as creating the file and not some installed application, however I could be completely off base with that assumption.

Link to comment
Share on other sites

  • 4 weeks later...

I know this isn't the answer u need. (In fact it's not even an answer at all:-)

 

It has actually reminded me of a problem I have with a folder that I cannot delete.

It is in the root drive (C:\USERDATA). I have convinced myself it has something to do with a restore I did a few days after I bought the m/c (as you do, always try to break 'em!)

 

Since tehn (or as far as I remember) this folder is un-deleteable (is that a word?) - there are no files/folders in it, but it is so damn annoying.

 

I've tried safe mode / dos mode etc to no avail. Help. I'm frickin' annoyed.

 

Ta,

B.

Link to comment
Share on other sites

  • 2 weeks later...

Managed to get rid of the (my) UserData problem, and this may work for any other files that seem to be permanently locked.

 

The problem with my userdata is that it appeared to be part of my system restore (not MS) disk image. Anyway, looking at the security tab of the file (in Properties) gave me an error that I could not see anything (but it told my I could take ownership as I was admin) - the Advanced button was avail., and took ownership of the file. OKayed completed, and re-entered the Properties/Security tab.

It now showed me the creator of the file - looking very like my registry id (e.g. {S-1-5-21-3840293125-1684184627-323364529-1007), but no other user has permissions on this file/directory. (Under Owner, it said Unknown User)

Now add yourself to this list (Add / Object Names (the name you use is not always obvious - try what is under Documents & Settings/xxxx), and give full permissions, and again OK everything

 

The reason, I believe in this case, is that during the creation of the sys. restore disk the comp. crashed - which it did - and it left behind a 'mutant' copy of my system belonging to 'as yet' non-existant user-id. And after I re-booted, no other user now had permissions to this directory, it was 'un-delete'able until now.

 

This probably hasn't helped, but I'd thought I'd get it off my chest anyhow :P

 

ta, MrB

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.