Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot Delete Temp Files


  • Please log in to reply
12 replies to this topic

#1 dtcross

dtcross

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 26 December 2005 - 09:56 AM

I bought my daughter an iPod for Christmas and was trying to install it and the software (iTunes) for it. I ran into trouble installing iTunes, I was getting an error 1406 "Could not write value to Key\Software\classes\.cdda\OpenWithList\itunes.exe". So I went to the Apple forums looking for help. I found a string with steps to try to resolve the issue. It asked me to empty temp folder and restart. There were several items in my daughters temp folder and I was able to delete all of them except for 6 files. Some of these files were in the temps of other profiles on our computer and had no trouble deleting them out of them but for some reason I cannot remove them from my daughters temp folder. Here are the files:

Perflib_Perfdata_144
Perflib_Perfdata_cc
Perflib_Perfdata_648
Perflib_Perfdata_954
Perflib_Perfdata_ae4
Perflib_Perfdata_b2c

When I try to delete them I get a message "Cannot delete Perflib_Perdata_144: It is being used by another person or program"

So I ran AVG, Spybot, and Adaware to make sure they were up to date, and then let them check my computer again. I got an error running Spybot, during the check I got the message:

"There were problems in the include file: C:\Program Files\spybot_Search_Destroy\Includes\Hijackers.sbi"

I wasn't sure if this was related or not so I thought I would meantion it.

The scan result for AVG didn't turn up anything, neither did Adaware or Spybot other than the error with Spybot that I meantioned above.

Any help would greatly be appreciated.

BC AdBot (Login to Remove)

 


#2 dannyboy 950

dannyboy 950

  • Members
  • 148 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 26 December 2005 - 10:38 AM

You may have the Vx2.Look2me malware. Try running some malware scans. Check in task manager for anything perf running and shut down that processand try deleteing those files again.

I think symantec has a specific look2me removeal tool also

#3 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:08:44 AM

Posted 27 December 2005 - 11:03 AM

Try cleaning out your temp files in Safe Mode.
How to start Windows in Safe Mode
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#4 dtcross

dtcross
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 27 December 2005 - 07:10 PM

Ran Kill2me and L2MRemover, no infection was found. Booted in safe mode and was allowed to delet the Temp folder. Restarted in normal mode and immediently checked. 3 of the files were back. Any other utilities I might try?

Edited by dtcross, 27 December 2005 - 07:11 PM.


#5 Neverwill

Neverwill

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Location:USA
  • Local time:10:44 AM

Posted 27 December 2005 - 07:30 PM

you've probibly got some malware/virus/spyware infections..i'd run an online scan with pandasoftware or any other online scanners

EDIT: i researched one of the temp files on google...and it brought me to a page with information bout it telling me that it could be the TrojanDownloader.Win32.vb.bn infection

Edited by Neverwill, 27 December 2005 - 07:38 PM.


Posted Image


#6 Joshuacat

Joshuacat

    01001010 01000011


  • Members
  • 1,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ontario, Canada
  • Local time:10:44 AM

Posted 27 December 2005 - 08:15 PM

dtcross:
There was a lot of information in Google when I did a search for Perflib_Perfdata. Please read through the following post - Perflib_Perfdata

Your SpyBot issue... to me it sounds like you are using the old version of SpyBot - 1.3. Remove the old version from the ADD/REMOVE feature of your Control Panel. Install the new version. The latest version 1.4 can be found here

Personally, I don't think you are having any problems with spyware, or a virus. To me, it sounds like your problems are easy to explain from the link that I copied above.

Plus, you posted this -

The scan result for AVG didn't turn up anything, neither did Adaware or Spybot other than the error with Spybot that I meantioned above.



Although, it doesn't hurt to update your antivirus and spyware detection programs as part of your regular routine. Or, when an issue like this arises it is good to rule spyware/virus out as the cause of the problem.

Personally, I wouldn't use some the specialized tools mentioned in the above posts without the guidance from a member from our HiJackThis team.

Neverwill: Can you show us a link to verify the information that you found?

Thanks,

Edited by Joshuacat, 27 December 2005 - 08:17 PM.

JC

#7 dtcross

dtcross
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:44 AM

Posted 28 December 2005 - 07:13 PM

Thanks JC, you were right, I did still have ver. 1.3 of Spybot. As for the other it does look like that this is just some orphaned files. Every once in a while when rebooting I do notice something isn't shutting down right. This is probably the source of the orphaned files. Either way I feel much better about them. Guess I'll move on to trying to get iTunes installed so my daughter can use her christmas present. Thanks for the help.

#8 Joshuacat

Joshuacat

    01001010 01000011


  • Members
  • 1,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ontario, Canada
  • Local time:10:44 AM

Posted 28 December 2005 - 07:51 PM

Thanks for posting back. Please feel free to post again if another problem arises.

Take care.
JC

#9 Scarlett

Scarlett

    Bleeping Diva


  • Members
  • 7,479 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:As always I'm beside myself ;)
  • Local time:09:44 AM

Posted 28 December 2005 - 08:39 PM

Neverwill: Can you show us a link to verify the information that you found?

Thanks,


:thumbsup: http://72.14.203.104/search?q=cache:mIntoH...fdata_b2c&hl=en
Posted Image

#10 Joshuacat

Joshuacat

    01001010 01000011


  • Members
  • 1,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ontario, Canada
  • Local time:10:44 AM

Posted 28 December 2005 - 09:04 PM

Thanks for the link Scarlett. :thumbsup:

The links mentions TrojanDownloader.Win32.VB.bn. With reference to the files that we are concerned about in your original post, dtcross:

Perflib_Perfdata_144
Perflib_Perfdata_cc
Perflib_Perfdata_648
Perflib_Perfdata_954
Perflib_Perfdata_ae4
Perflib_Perfdata_b2c


There is nothing in that link that gives proof that the files are part of the trojan. In that link, the trojan is in another file -UCSearch.ocx.

# C:\Documents and Settings\Laura \Local Settings\Temporary Internet Files\Content.IE5\OTCVKVWB\UCSearch[1].CAB\UCSearch.ocx Infection: TrojanDownloader.Win32.VB.bn


The only mention of the Perflib file is that it cannot be opened.

Cannot open file C:\Documents and Settings\Laura\Local Settings\Temp\Perflib_Perfdata_b2c.dat


This is normal from what I have read about these type of files.

Nothing to worry about.

Take care,
JC

#11 Scarlett

Scarlett

    Bleeping Diva


  • Members
  • 7,479 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:As always I'm beside myself ;)
  • Local time:09:44 AM

Posted 28 December 2005 - 09:29 PM

A good lesson to be learned.

Just because a keyword is reference shows in a Google search finding, does not mean that it is directly
related to the other info in a specific search finding.

TrojanDownloader.Win32.VB.bn - what to do?
... and Settings\Laura\Local Settings\Temp\~DF1D3C.tmp; Cannot open file C:\Documents
and Settings\Laura\Local Settings\Temp\Perflib_Perfdata_b2c


One should look at the linked page and then go from there.

Edited by Scarlett, 28 December 2005 - 09:31 PM.

Posted Image

#12 xtraloud

xtraloud

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Location:South of Texas
  • Local time:08:44 AM

Posted 28 December 2005 - 10:06 PM

Not trying to butt in, as I do not consider this a problem for me, butt .............

http://groups.google.ca/group/microsoft.public.windowsxp.basics/browse_thread/thread/e92e134380653641/7557d5eab2b3a8c1%237557d5eab2b3a8c1?sa=X&oi=groupsr&start=2&num=3 :

quote from above link :


They're performance data logging files. Seems to me they shouldn't be
happening... The NT executive services might be using Performance
Monitoring, but I think usually you have to turn Perfmon on before these
files show up or invoke perfmon so that it can create the files to begin
with. And even then if I remember correctly they can usually be deleted


I am using an automatic performance defrag proggy that is supposed to maximize the system by monitoring the defragged files and folders and doing auto defrag when necessary. I am also allowing it to monitor my machine for maximum operation efficiency.

Could this be creating these ?

(Also I find that I can delete all but one or two files, I get the screen with the information that they are being used by another program, close program and try deletion again.)



Posted Image

xtra
Those who wander
are not always lost

#13 Joshuacat

Joshuacat

    01001010 01000011


  • Members
  • 1,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ontario, Canada
  • Local time:10:44 AM

Posted 28 December 2005 - 10:47 PM

The files that are not in use can easily be deleted. The files that are in use will give you problems if you try to delete them. Don't worry about them...they are harmless.

By the way, I have the same files in c:\windows\temp folder. :thumbsup:

xtraloud, you should probably create a new topic if you require further assitance.

Take care.
JC




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users