Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unwanted files on Desktop


  • Please log in to reply
15 replies to this topic

#1 geotan

geotan

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK
  • Local time:03:17 AM

Posted 05 January 2009 - 12:47 AM

Good day to you Gurus,
Yesterday I uninstalled a 30 day trial programme [Adobe After Effects CS4]. Since then, every time I start my computer I get 93 [yes ninety three] unknown files on my desktop. I tried putting them into a folder and moving the folder from the desktop but to no avail. I did a restore to no avail. I deleted all the files but next time I start my computer they are there again. Thinking that they may be something to do with the uninstalled programme I did a search of all my drives and deleted anything that was left.
I am running Windows XP/sp3.
below are a couple of the file names.
_21_8ab7888d4747615a73f603bde4dcc8f9 last modified 31/07/2008
_21_adb70dda121094970486fb71933d356e last modified 06/08/2008

Any help that you can give me will be appreciated as usual.
Thanks,
GEORGE.

BC AdBot (Login to Remove)

 


#2 Guest_Jay-P VIP_*

Guest_Jay-P VIP_*

  • Guests
  • OFFLINE
  •  

Posted 05 January 2009 - 06:30 AM

Your settings in the program itself need to be changed. You need to point the temporary files to a different directory.

Adobe After Effects is placing temp files on your desktop because it is not configured correctly.

#3 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK

Posted 05 January 2009 - 06:40 AM

Jay-P,
I have deleted the programme [it was a 30 day free trial], even manually deleted all traces. These files did not appear until AFTER I deleted the programme. As I put in my previous message, I tried putting all the files in a seperate folder but next time I atarted my computer they were back on the desktop. If I delete them they reappear on my desktop when I restart my computer.
GEORGE.

#4 Guest_Jay-P VIP_*

Guest_Jay-P VIP_*

  • Guests
  • OFFLINE
  •  

Posted 05 January 2009 - 06:53 AM

I just saw some information on this removal page. Go to this page http://kb.adobe.com/selfservice/viewConten...ternalId=332973
and attempt the solutions. Let me know if any of this works.

#5 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK
  • Local time:03:17 AM

Posted 05 January 2009 - 07:03 AM

That is an uninstall for AE7, whereas CS4 is AE9.
Two things. I am not experienced enough to mess around in the Registery.
These files that have appeared on my desktop are dated months before I installed AE CS4

#6 Guest_Jay-P VIP_*

Guest_Jay-P VIP_*

  • Guests
  • OFFLINE
  •  

Posted 05 January 2009 - 07:43 AM

Oh okay. I didn't expect you to edit the registry at all. This solution I have now is bound to work.

Download File Shredder and it will delete them all permanently.

Download page

This Tutorial page might help.

Let me know if this solves your problem or not!

EDIT: Added tutorial page

Edited by Jay-P VIP, 05 January 2009 - 07:45 AM.


#7 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK

Posted 05 January 2009 - 08:27 AM

Well, I installed the shredder. Used the 35 pass and shred all the files. Rebooted my computer and guess what. They were all back again. Tried a total of three times but they just keep coming back.

#8 Guest_Jay-P VIP_*

Guest_Jay-P VIP_*

  • Guests
  • OFFLINE
  •  

Posted 05 January 2009 - 08:34 AM

Ouch.

Have you tried scanning for Malware?

Please download Malwarebytes' Anti-Malware to your desktop.

* 2X-click mbam-setup.exe and install the program.

* At the end, checkmark:


o Update Malwarebytes' Anti-Malware

o Launch Malwarebytes' Anti-Malware



* Then click Finish.

* As soon as it loads, select quick scan, then click Scan.

* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad.

* Post the log in your next reply.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (i.e. Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.



#9 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK
  • Local time:03:17 AM

Posted 05 January 2009 - 08:42 AM

I have already run Malware bytes, cccleaner, avg and adaware.
I will run Malwarebytes again and post a log.

#10 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK

Posted 05 January 2009 - 10:15 AM

Ran Malwarebytes. Here is the log:-

Malwarebytes' Anti-Malware 1.32
Database version: 1617
Windows 5.1.2600 Service Pack 3

05/01/2009 14:55:04
mbam-log-2009-01-05 (14-55-04).txt

Scan type: Full Scan (C:\|F:\|G:\|)
Objects scanned: 181714
Time elapsed: 57 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{20d23232-aed6-490d-a3c2-f08ba539a1fe} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Rebooted computer. Ran Shredder again [35 pass]. Rebooted and all the files reappeared.

#11 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK
  • Local time:03:17 AM

Posted 05 January 2009 - 01:27 PM

Problem solved. As the 93 files on the desktop were not showing a name [numbers and letter] I assumed that it was the same files coming back again. When I opened the desktop folder I found that there were 1000's of these files - I lost count at 6000.
Anyway I shredded them all and all is now back to normal. What I cannot understand is that the computer in question is NOT connected to the Internet so where did these files materialise from?
Thank you for your help. Much appreciated.

#12 Guest_Jay-P VIP_*

Guest_Jay-P VIP_*

  • Guests
  • OFFLINE
  •  

Posted 05 January 2009 - 02:05 PM

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{20d23232-aed6-490d-a3c2-f08ba539a1fe} (Trojan.Vundo) -> Quarantined and deleted successfully.


Oh yeah, Trojan.Vundo.

It seems as if you got a little Trojan.Vundo infection recently that did not get fully removed. I highlighted part of a quote from your log of MBAM, and what had happened is that Trojan.Vundo had been placing temporary safe files on your desktop. This was the stat entry, which is the hardest tool to get rid of for VUNDO. The only thing it was, was an annoyance to you. If you noticed when Trojan.Vundo was quarantined and deleted successfully, it unlocked the bad files so you can shred them.

There is another tool for shredding files which can be found in the 'More tools' section of MalwareBytes' Anti-Malware. It is called FileASSASSIN, which can delete "undelete-able" files on your system. :thumbsup:

#13 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK

Posted 05 January 2009 - 06:25 PM

I have Unlocker which was recommended by one of the Gurus on this site.

#14 Guest_Jay-P VIP_*

Guest_Jay-P VIP_*

  • Guests
  • OFFLINE
  •  

Posted 05 January 2009 - 08:26 PM

Oh very good. I was going to suggest that, but decided not to. :thumbsup:

#15 geotan

geotan
  • Topic Starter

  • Members
  • 374 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bromsgrove, UK
  • Local time:03:17 AM

Posted 05 January 2009 - 09:42 PM

Thank you for your time and your help. Very much appreciated.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users