Mystery file being used by another program 1

[William000]

Hi - in my Temp files I have a bunch of files of the general format ~DF123C and they won't delete because they are being used by another person or program. I know that they are malware but my security software isn't finding the process. How can I find the running process and kill them suckers? Thanks.

 

[2ffat]

A lot of the ~ files are system files. If you really want to find out what is holding them open look at Process Explorer, Process Monitor, and Handle.


James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

 

[linney]

You should be able to delete most of them via the normal course of actions, the last few created ones will be the only ones that are "in use". Have you tried deleting them via "modified date" view and waiting for the in use ones to free up later. I doubt that they are malware more likely just system or security programs housekeeping.

 

[goombawaho]

If you really want to get tough with temp files - boot using a boot disk such as Bart PE (or whatever) and then you can whack 'em all.

But the suggestion of sorting by date and ignoring any from the same day will get 98% of the them.

 

[William000]

Good suggestions. Also, I did install the Process Explorer and it seems that whatever is running the temp files may be legit. Maybe. BUT! What is was looking to find was to trace back and find out what exactly is the specific program using the temp files. Because i am a skeptic. I don't need to know so much which processes are running (Task Manager tells me that) instead which specific program is using those temp files. See? I know there is something like that out there, just can't remember what it is.

 

[2ffat]

In Process Explorer, click the Find menu option at top. Then select the "find handle or DLL" option. A screen will pop up and you can put in the name of the file. It will show you what is holding that file open.

Handle will do the same thing but it can only be run from the command line.



James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

 

[William000]

Cool. Thanks

 

[William000]

Is it possible for a process to be running (like a worm or other malware)and not show up in Process Explorer? Maybe this should be another thread?

 

[2ffat]

Possible, maybe, but very unlikely. Those programs were written for just this purpose.


James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

 

[2ffat]

If you're really insistent on getting rid of that file, Spyware Terminator has a tool that may do the job. Just be aware that if the file is a critical file, your computer may come to a screeching halt.



James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

 

[William000]

Ok then. That should do it. Thanks for all your help-
-William

 

[linney]

~df****.tmp files in C:\Documents and Settings\Administrator\Local Settings\Temp

http://www.technologyquestions.com/...ttings-administrator-local-settings-temp.html

http://www.google.com.au/search?q=~...&ie=&oe=&redir_esc=&ei=TOPZS6GbKoHo7AOBsM2EAQ