Cannot delete files in Temp

[macbeth]

There are a few files that i cant delete in
C:\Documents and Settings\1st User\Local Settings\Temp
which are ~DF567B.tmp, ~DFB71E.tmp, ~ROMFN_000007A8 and Perflib_Perfdata_7a8.dat. And some times there are a few more.
What are these files and why cant they be deleted?

 

[Namslas90]

looks like youi might have some sort of spybot or virus or auto mailers in there. google each one and you can probably pick up a link to a "cleaner" application or progrqm. Be carefull and read carefully. You don't need to make the problem worse. There are members with more /better expierence than me with this stuff. You might wanna check back later.

 

[Alec§taar]

Try this...

Try this:

del \\?\c:\path_to_file\lpt1

OR

- Open a Command Window (Start Accessories - Command Prompt)
- Leave it open but close down all other running programs.
- Now via the Ctrl Alt Del or from the Task Manager (Start - Run Type TASKMGR.EXE) under the processes tab, end the Explorer.exe process.
- Now leaving the task Manager open, return to the Command Prompt window and type "cd path" to take you to the folder where the file is. eg. "cd c:My Documents" (Without brackets. Also note there is a space between cd and c: )
- Now type "DEL " (eg "DEL badfile.exe" again without the brackets.
- Once done go back to the Task Manager and under File - New Task type EXPLORER.EXE. This will kick start the windows GUI (interface)
- Close task manager.

& LASTLY:

Make SURE you did not name the Directory/Folder pathnames beyond 255 characters length of the string, or use "off the wall" HIGHER ASCII characters in the names or deletes via Explorer.exe OR DOS/cmd.exe won't work either (fixed the last one I had today 06/06/2005)...

=========
REASONS:
=========

* Usually, when you see this type of thing? The file is LOCKED, exclusively, by a single user... us killing them above? Stalls that, cold. A 'knock out punch to the jaw', for the system's OWN good, temporarily.

So, as the above steps say? Just stop ALL of the background processes you can, services also (leave RPC alone, both of them) using services.msc included IF you have to as well ontop of the above because, you HAVE to find the locking file/offending process by elimination of them in memory.

So, AGAIN: Leave the RPC SERVICES alone (you need them period, or you will lag like hell, & especially for this) & taskmgr.exe & disable trayicon stuff too.

The list of those files? Appear dead-up locked, a temp file in your %Temp%/%Tmp% it looks like & by a process, local or not. Which is why the NEXT part may have to be done:

Yes, even sometimes on the network, (hence, WHY the command above MAY look like a network UNC path), but it SHOULD work!

It works, basically on a network level, first by dropping said connection & then doing a std. "change the first character of the filename" delete.

If needed, ontop of that? Drop your internet connection, disable it, temporarily, & try again.

SHOULD ALL/ANY OF THIS FAIL?

I have a program, a secure deleter I wrote, that SHOULD do it, but that I have to send you... I wrote it myself, it works.

APK

P.S.=> On the perflib stuff? I can see the performance counters generation being enabled & LOCKING that file too because it appears to be THEIR data!

Plus, some apps use it like COOLMON too, which I helped correct a bug in w/ the authors while @ 3dfiles.com regarding perfcounters NOT being on crashing it!

The performance counter generation it is creating its log & data temp files... all read from the FAKE registry hive in RAM call HKEY_DYN_DATA & used by the OS & apps like COOLMON...

So, to DISABLE ALL performance counters generation & data? Just first reboot, & try again AFTER using this FREE reskit tool from MS:

exctrlst.exe

Extensible Performance Counters enable/disable using it & do what I stated above, IF needed upon reboot, because no more HKEY_DYN_DATA is being formed, or perf counters generated (except maybe WMI stuff), & that dat file should be deletable now... apk

 

[Demos_sav]

I have that same problem. But the file I want to delete contains viruses too. I tried everything you said but nothing works. Could you please send me the secure deleter you wrote?

 

[xman2007]

There are a few files that i cant delete in
C:\Documents and Settings\1st User\Local Settings\Temp
which are ~DF567B.tmp, ~DFB71E.tmp, ~ROMFN_000007A8 and Perflib_Perfdata_7a8.dat. And some times there are a few more.
What are these files and why cant they be deleted?

im quite sure none of them are spyware perflib perfdata is just a temp file created by windows (or maybe a program you have installed) ive had the same thing and after a while of googling found them to be harmless i think they will dissapear on there own or you can delete them when there no longer needed by the system, try a washer program and see if that gets rid of them, i used to use a trial version of window washer but havent used this in a while so dont know weather they still do a trial or wether it comes with any kind of spyware as its a trial. but a washing program usually cleans everything if its a good one.

also try booting into safemode as administrator and deleting the files.

 

[Jimmy 2004]

Maybe they can't be deleted because an application is still using them?

 

[Alec§taar]

Maybe they can't be deleted because an application is still using them?

Exactly Jim... which is why I had him knock-out all existing processes... OR try to.

The performance lib counters temp file though, it's usually controlleable via extctrlst.exe (reskit tool I mentioned above)!

That is so the majority of HKEY_DYN_DATA isn't being formed in memory (it's a "fake" registry hive basically & has no corresponding on-disk file)... that SHOULD take of that as well. The WMI counter is the ONLY one that you really may have trouble setting as "no longer generating", because it always restarts itself anyhow.

(There's ways to stall that too, WBEM folder stuff, but it creates more problems than its worth, because it affects other things, because once I removed its folders from the SYSTEM %PATH% & it stopped working alright, but a lot of other stuff did too!)



* It's not working on his end though yet & I just read that now on edit!

So, something is STILL generating those temp files & the correct process hasn't been stalled yet so they are no longer locked... so, onto the next step.

POST STARTER:

Can you provide us a list of your normally running processes via a screenprint of taskmgr.exe's PROCESSES tab?

APK

P.S.=> xman makes a GOOD solid point - they're files that apps use, temporarily, & sometimes do NOT clean them up properly... leaving remnants that SHOULD be non-locked by a reboot... technically.

This includes performance counter generations... they SHOULD go away @ reboot... but, if not, this is the type of thing to do to burn them... apk

 

[Jimmy 2004]

If you're worried about spyware it would also be useful to post a Hijck This log so we can have a quick browse for anything suspicious.

 

[Alec§taar]

If you're worried about spyware it would also be useful to post a Hijck This log so we can have a quick browse for anything suspicious.

Good point Jim: I was using taskmgr.exe to see the processes running, but a log like HiJackThis can help too... by showing startup areas & such outta the registry!

I don't use it, & instead do that stuff manually here, using taskmgr.exe &/or msconfig for startup areas (& other areas it cannot see or monitor, & there ARE those, per the sticky thread I did).

APK

 

[macbeth]

I restart in safe mode and is able to delete them and everything seem ok on my next normal reboot. But after awhile some of those files are being created anyway. So i think it should be ok. Scan with bitdefender10 no virus, spysweeper5 no spyware. So i guess the virus and spyware part should not be the case. Mostly those files were being created and still being used by some application.

 

[macbeth]

thanks guys

 

[Jimmy 2004]

thanks guys

No problem, if you want any more help remember to always post on tpu first if you want the best help!

 

[Alec§taar]

~DF567B.tmp, ~DFB71E.tmp

Those filenames, iirc, I have seen files of that naming nature made by applications created in Visual Basic in the past, & they did not tend to cleanup @ shutdown of the apps that made them.

A list of apps you run @ startup could help us help you understand which apps are creating them possibly, just so you know & then you might be able to find apps that do the same task but do not leave a mess around in your %TEMP%/%TMP% folders.

Also, providing us a list of taskmgr.exe apps via a screenshot of it isn't going to hurt either, just so you understand what may be causing that last filename (~ROMFN_000007A8 )

We're all fairly sure the performance monitoring the system does creates this one though -> Perflib_Perfdata_7a8.dat @ this point.

In any event, I would guess it's apps you run @ system startup, either from the registry RUN areas, &/or startup groups, for the first 3 filenames, mainly because your safemode booting allows you to delete the files & safemode typically doesn't run anything absolutely not necessary to system function (like registry RUN areas & startup group apps).

APK