What's this file??

[Guest barrowhill]

Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

 

Can anyone tell me what the file...........vtclrg41.tmp........is or belongs

to ??? malware or not ???

 

It resides in c:\windows\temp folder and cannot be deleted. I've used

various recommended utilities but it always comes back.

[Guest R. McCarty]

Re: What's this file??

 

You can use a SysInternals application Filemon, to determine what

process on the system is using/accessing the temporary file. You'll

need to let the app run for a while ( 1-2 Minutes ) and then scroll

though the history log looking for your .tmp workspace file. Lots of

applications make use of temporary or workspace files and each

setup has various ones depending on what applications are installed

on the computer.

 

As to whether the temp file is part of a Malware infection, I'd use an

online scan of a different vendor from your permanent security app

as a redundancy check:

 

FileMon found here:

http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

 

Eset Online Scan:

http://www.eset.com/onlinescan/

Ewido Online Scan:

http://www.ewido.net/en/onlinescan/

 

"barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com...

> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

>

> Can anyone tell me what the file...........vtclrg41.tmp........is or

> belongs

> to ??? malware or not ???

>

> It resides in c:\windows\temp folder and cannot be deleted. I've used

> various recommended utilities but it always comes back.

>

>

[Guest barrowhill]

Re: What's this file??

 

Thanks for feedback.......

 

If run Panda On-line Active Scan and nothing found. Run adware/malware

scanners and ditto. I'm suspecting something to do with Lenovo/IBM as this

file only appears on net search relating to Thinkpad

 

"R. McCarty" wrote:

> You can use a SysInternals application Filemon, to determine what

> process on the system is using/accessing the temporary file. You'll

> need to let the app run for a while ( 1-2 Minutes ) and then scroll

> though the history log looking for your .tmp workspace file. Lots of

> applications make use of temporary or workspace files and each

> setup has various ones depending on what applications are installed

> on the computer.

>

> As to whether the temp file is part of a Malware infection, I'd use an

> online scan of a different vendor from your permanent security app

> as a redundancy check:

>

> FileMon found here:

> http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

>

> Eset Online Scan:

> http://www.eset.com/onlinescan/

> Ewido Online Scan:

> http://www.ewido.net/en/onlinescan/

>

> "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com...

> > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> >

> > Can anyone tell me what the file...........vtclrg41.tmp........is or

> > belongs

> > to ??? malware or not ???

> >

> > It resides in c:\windows\temp folder and cannot be deleted. I've used

> > various recommended utilities but it always comes back.

> >

> >

>

>

>

[Guest Rey Santos]

RE: What's this file??

 

 

This temp file might have something to do with an IBM thinkpad. Right click

it and check its properties to see what it belongs to or what is creating

it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's

malware scan http://virusscan.jotti.org/ for tests.

--

Rey

 

 

"barrowhill" wrote:

> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

>

> Can anyone tell me what the file...........vtclrg41.tmp........is or belongs

> to ??? malware or not ???

>

> It resides in c:\windows\temp folder and cannot be deleted. I've used

> various recommended utilities but it always comes back.

>

>

[Guest barrowhill]

Re: What's this file??

 

Run FileMon. Filtered on C:\windows\temp and ran Ashampoo WinOptimizer 5 to

generate activity on the file. Sample result.....

..

..

6822 3:16:35 PM WO5.exe:5476 QUERY INFORMATION

C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Attributes: A

6823 3:16:35 PM WO5.exe:5476 OPEN

C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Options: Open Access: 00030080

6824 3:16:35 PM WO5.exe:5476 OPEN

C:\WINDOWS\TEMP\ SUCCESS Options: Open Directory Access: 00100000

6825 3:16:35 PM WO5.exe:5476 QUERY INFORMATION C:\WINDOWS\TEMP\vtclrg41.tmp

SUCCESS FileAttributeTagInformation

6826 3:16:35 PM WO5.exe:5476 DELETE

C:\WINDOWS\TEMP\vtclrg41.tmp CANNOT DELETE

6827 3:16:35 PM WO5.exe:5476 CLOSE

C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS

..

..

All it tells me is that it cannot delete the file.!?!

 

"R. McCarty" wrote:

> You can use a SysInternals application Filemon, to determine what

> process on the system is using/accessing the temporary file. You'll

> need to let the app run for a while ( 1-2 Minutes ) and then scroll

> though the history log looking for your .tmp workspace file. Lots of

> applications make use of temporary or workspace files and each

> setup has various ones depending on what applications are installed

> on the computer.

>

> As to whether the temp file is part of a Malware infection, I'd use an

> online scan of a different vendor from your permanent security app

> as a redundancy check:

>

> FileMon found here:

> http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

>

> Eset Online Scan:

> http://www.eset.com/onlinescan/

> Ewido Online Scan:

> http://www.ewido.net/en/onlinescan/

>

> "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com...

> > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> >

> > Can anyone tell me what the file...........vtclrg41.tmp........is or

> > belongs

> > to ??? malware or not ???

> >

> > It resides in c:\windows\temp folder and cannot be deleted. I've used

> > various recommended utilities but it always comes back.

> >

> >

>

>

>

[Guest R. McCarty]

Re: What's this file??

 

You need to check the "Process" column for any vtclrg41.tmp entries.

It's the process field that will identify what is accessing the file.

 

"barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

news:C886E5DE-4528-4AFC-BDA8-42996B2122B1@microsoft.com...

> Run FileMon. Filtered on C:\windows\temp and ran Ashampoo WinOptimizer 5

> to

> generate activity on the file. Sample result.....

> .

> .

> 6822 3:16:35 PM WO5.exe:5476 QUERY INFORMATION

> C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Attributes: A

> 6823 3:16:35 PM WO5.exe:5476 OPEN

> C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Options: Open Access: 00030080

> 6824 3:16:35 PM WO5.exe:5476 OPEN

> C:\WINDOWS\TEMP\ SUCCESS Options: Open Directory Access: 00100000

> 6825 3:16:35 PM WO5.exe:5476 QUERY INFORMATION

> C:\WINDOWS\TEMP\vtclrg41.tmp

> SUCCESS FileAttributeTagInformation

> 6826 3:16:35 PM WO5.exe:5476 DELETE

> C:\WINDOWS\TEMP\vtclrg41.tmp CANNOT DELETE

> 6827 3:16:35 PM WO5.exe:5476 CLOSE

> C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS

> .

> .

> All it tells me is that it cannot delete the file.!?!

>

> "R. McCarty" wrote:

>

>> You can use a SysInternals application Filemon, to determine what

>> process on the system is using/accessing the temporary file. You'll

>> need to let the app run for a while ( 1-2 Minutes ) and then scroll

>> though the history log looking for your .tmp workspace file. Lots of

>> applications make use of temporary or workspace files and each

>> setup has various ones depending on what applications are installed

>> on the computer.

>>

>> As to whether the temp file is part of a Malware infection, I'd use an

>> online scan of a different vendor from your permanent security app

>> as a redundancy check:

>>

>> FileMon found here:

>> http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

>>

>> Eset Online Scan:

>> http://www.eset.com/onlinescan/

>> Ewido Online Scan:

>> http://www.ewido.net/en/onlinescan/

>>

>> "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

>> news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com...

>> > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

>> >

>> > Can anyone tell me what the file...........vtclrg41.tmp........is or

>> > belongs

>> > to ??? malware or not ???

>> >

>> > It resides in c:\windows\temp folder and cannot be deleted. I've used

>> > various recommended utilities but it always comes back.

>> >

>> >

>>

>>

>>

[Guest barrowhill]

RE: What's this file??

 

Checked file properties but says nothing other than where it is -

c:\windows\temp . Summary tab gives no info.

 

Uploaded file to bothe Jotti and VirusTotal and clean response from both.

 

Only conclusion I can come to is that the file is related to the IBM ThinPad

or their ThinkAdvantgae range. If it is, then putting the file into the

c:\windows\temp folder wasn't the best choice seeing as it appears undeletable

 

If anyone knows what the file is/does I'd be interested in knowing.

 

Thanks for everyone's help

 

"Rey Santos" wrote:

>

> This temp file might have something to do with an IBM thinkpad. Right click

> it and check its properties to see what it belongs to or what is creating

> it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's

> malware scan http://virusscan.jotti.org/ for tests.

> --

> Rey

>

>

> "barrowhill" wrote:

>

> > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> >

> > Can anyone tell me what the file...........vtclrg41.tmp........is or belongs

> > to ??? malware or not ???

> >

> > It resides in c:\windows\temp folder and cannot be deleted. I've used

> > various recommended utilities but it always comes back.

> >

> >

[Guest Alias]

Re: What's this file??

 

barrowhill wrote:

> Checked file properties but says nothing other than where it is -

> c:\windows\temp . Summary tab gives no info.

>

> Uploaded file to bothe Jotti and VirusTotal and clean response from both.

>

> Only conclusion I can come to is that the file is related to the IBM ThinPad

> or their ThinkAdvantgae range. If it is, then putting the file into the

> c:\windows\temp folder wasn't the best choice seeing as it appears undeletable

>

> If anyone knows what the file is/does I'd be interested in knowing.

>

> Thanks for everyone's help

 

Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up

first and, if that doesn't work, use the Issues feature but only tick

the file in question if it appears. Leave anything else it finds unticked.

 

Alias

>

> "Rey Santos" wrote:

>

>> This temp file might have something to do with an IBM thinkpad. Right click

>> it and check its properties to see what it belongs to or what is creating

>> it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's

>> malware scan http://virusscan.jotti.org/ for tests.

>> --

>> Rey

>>

>>

>> "barrowhill" wrote:

>>

>>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

>>>

>>> Can anyone tell me what the file...........vtclrg41.tmp........is or belongs

>>> to ??? malware or not ???

>>>

>>> It resides in c:\windows\temp folder and cannot be deleted. I've used

>>> various recommended utilities but it always comes back.

>>>

>>>

[Guest Daave]

Re: What's this file??

 

barrowhill wrote:

> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

>

> Can anyone tell me what the file...........vtclrg41.tmp........is or

> belongs to ??? malware or not ???

>

> It resides in c:\windows\temp folder and cannot be deleted. I've used

> various recommended utilities but it always comes back.

 

Why not delete it in Safe Mode?

[Guest barrowhill]

Re: What's this file??

 

That was first option tried. The file won't delete. Renamed file using

MoveOnBoot. Can delete renamed file but original file gets restored.

Haven't found a way to delete that's why I'm thinking it's key file for IBM

ThinkPad

 

"Daave" wrote:

> barrowhill wrote:

> > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> >

> > Can anyone tell me what the file...........vtclrg41.tmp........is or

> > belongs to ??? malware or not ???

> >

> > It resides in c:\windows\temp folder and cannot be deleted. I've used

> > various recommended utilities but it always comes back.

>

> Why not delete it in Safe Mode?

>

>

>

[Guest Daave]

Re: What's this file??

 

barrowhill wrote:

> "Daave" wrote:

>

>> barrowhill wrote:

>>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

>>>

>>> Can anyone tell me what the file...........vtclrg41.tmp........is or

>>> belongs to ??? malware or not ???

>>>

>>> It resides in c:\windows\temp folder and cannot be deleted. I've

>>> used various recommended utilities but it always comes back.

>>

>> Why not delete it in Safe Mode?

> That was first option tried. The file won't delete. Renamed file

> using MoveOnBoot. Can delete renamed file but original file gets

> restored. Haven't found a way to delete that's why I'm thinking it's

> key file for IBM ThinkPad

 

If you're determined, you can try the method discussed here:

 

http://articles.techrepublic.com.com/5100-22_11-5288922.html

 

But I'll bet you'll get a replacement!

 

Another page you might find helpful:

 

http://www.pchell.com/support/undeletablefiles.shtml

 

Have you tried using Ccleaner?

[Guest barrowhill]

Re: What's this file??

 

Thanks for links. Performed operations as detailed but"Access denied"

message when trying to delete via command window.

 

Tried CCleaner but not impressed. Looking at results of detected files it

doesn't (or didn't) even look at c:\windows\temp folder. If it did, it

didn't find anything to delete though I'd checked to see there were files

(including vtclrg41.tmp) to delete. There were.

 

"Daave" wrote:

> barrowhill wrote:

>

> > "Daave" wrote:

> >

> >> barrowhill wrote:

> >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> >>>

> >>> Can anyone tell me what the file...........vtclrg41.tmp........is or

> >>> belongs to ??? malware or not ???

> >>>

> >>> It resides in c:\windows\temp folder and cannot be deleted. I've

> >>> used various recommended utilities but it always comes back.

> >>

> >> Why not delete it in Safe Mode?

>

> > That was first option tried. The file won't delete. Renamed file

> > using MoveOnBoot. Can delete renamed file but original file gets

> > restored. Haven't found a way to delete that's why I'm thinking it's

> > key file for IBM ThinkPad

>

> If you're determined, you can try the method discussed here:

>

> http://articles.techrepublic.com.com/5100-22_11-5288922.html

>

> But I'll bet you'll get a replacement!

>

> Another page you might find helpful:

>

> http://www.pchell.com/support/undeletablefiles.shtml

>

> Have you tried using Ccleaner?

>

>

>

[Guest barrowhill]

Re: What's this file??

 

Thanks for feedback. See response to Daave

 

"Alias" wrote:

> barrowhill wrote:

> > Checked file properties but says nothing other than where it is -

> > c:\windows\temp . Summary tab gives no info.

> >

> > Uploaded file to bothe Jotti and VirusTotal and clean response from both.

> >

> > Only conclusion I can come to is that the file is related to the IBM ThinPad

> > or their ThinkAdvantgae range. If it is, then putting the file into the

> > c:\windows\temp folder wasn't the best choice seeing as it appears undeletable

> >

> > If anyone knows what the file is/does I'd be interested in knowing.

> >

> > Thanks for everyone's help

>

> Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up

> first and, if that doesn't work, use the Issues feature but only tick

> the file in question if it appears. Leave anything else it finds unticked.

>

> Alias

> >

> > "Rey Santos" wrote:

> >

> >> This temp file might have something to do with an IBM thinkpad. Right click

> >> it and check its properties to see what it belongs to or what is creating

> >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's

> >> malware scan http://virusscan.jotti.org/ for tests.

> >> --

> >> Rey

> >>

> >>

> >> "barrowhill" wrote:

> >>

> >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> >>>

> >>> Can anyone tell me what the file...........vtclrg41.tmp........is or belongs

> >>> to ??? malware or not ???

> >>>

> >>> It resides in c:\windows\temp folder and cannot be deleted. I've used

> >>> various recommended utilities but it always comes back.

> >>>

> >>>

>

[Guest Daave]

Re: What's this file??

 

barrowhill wrote:

> Thanks for links. Performed operations as detailed but"Access denied"

> message when trying to delete via command window.

 

Have a look at "How to take ownership of a file or folder in Windows

XP":

 

http://support.microsoft.com/kb/308421

> Tried CCleaner but not impressed. Looking at results of detected

> files it doesn't (or didn't) even look at c:\windows\temp folder. If

> it did, it didn't find anything to delete though I'd checked to see

> there were files (including vtclrg41.tmp) to delete. There were.

 

CCleaner *does* look at the C:\Windows\Temp folder. But note that there

is an advanced option to "only delete files in Windows temp folders

older than 48 hours."

[Guest 3c273]

Re: What's this file??

 

Have you tried Process Explorer. It will tell you which process is locking

the file. It is probably nothing more than some utility that came with your

laptop.

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Louis

 

"barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com...

> Thanks for feedback. See response to Daave

>

> "Alias" wrote:

>

> > barrowhill wrote:

> > > Checked file properties but says nothing other than where it is -

> > > c:\windows\temp . Summary tab gives no info.

> > >

> > > Uploaded file to bothe Jotti and VirusTotal and clean response from

both.

> > >

> > > Only conclusion I can come to is that the file is related to the IBM

ThinPad

> > > or their ThinkAdvantgae range. If it is, then putting the file into

the

> > > c:\windows\temp folder wasn't the best choice seeing as it appears

undeletable

> > >

> > > If anyone knows what the file is/does I'd be interested in knowing.

> > >

> > > Thanks for everyone's help

> >

> > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up

> > first and, if that doesn't work, use the Issues feature but only tick

> > the file in question if it appears. Leave anything else it finds

unticked.

> >

> > Alias

> > >

> > > "Rey Santos" wrote:

> > >

> > >> This temp file might have something to do with an IBM thinkpad. Right

click

> > >> it and check its properties to see what it belongs to or what is

creating

> > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and

Jotti's

> > >> malware scan http://virusscan.jotti.org/ for tests.

> > >> --

> > >> Rey

> > >>

> > >>

> > >> "barrowhill" wrote:

> > >>

> > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> > >>>

> > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or

belongs

> > >>> to ??? malware or not ???

> > >>>

> > >>> It resides in c:\windows\temp folder and cannot be deleted. I've

used

> > >>> various recommended utilities but it always comes back.

> > >>>

> > >>>

> >

[Guest barrowhill]

Re: What's this file??

 

Thanks for info. Details specified in link followed but unable to delete.

 

I should of looked at CC options. The file is over 48 hours old. but I

unchecked anyway. After running, report shows all files deleted in

c:\windows\temp folder (I must of missed it on last execution!). I didn't

show vtclrg41.tmp as having been deleted.. Check actual location and sure

enough, only file in the folder.

 

"Daave" wrote:

> barrowhill wrote:

> > Thanks for links. Performed operations as detailed but"Access denied"

> > message when trying to delete via command window.

>

> Have a look at "How to take ownership of a file or folder in Windows

> XP":

>

> http://support.microsoft.com/kb/308421

>

> > Tried CCleaner but not impressed. Looking at results of detected

> > files it doesn't (or didn't) even look at c:\windows\temp folder. If

> > it did, it didn't find anything to delete though I'd checked to see

> > there were files (including vtclrg41.tmp) to delete. There were.

>

> CCleaner *does* look at the C:\Windows\Temp folder. But note that there

> is an advanced option to "only delete files in Windows temp folders

> older than 48 hours."

>

>

>

[Guest barrowhill]

Re: What's this file??

 

Thanks for input. I've downloaded and ran but to be honest can;t see

anything remotely related to the file vtclrg41.tmp. II've tried to view

ProcessExplorer activity as I try and delete fie to see which, if any,

process "fires up". Nothing apparent

 

"3c273" wrote:

> Have you tried Process Explorer. It will tell you which process is locking

> the file. It is probably nothing more than some utility that came with your

> laptop.

> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

> Louis

>

> "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com...

> > Thanks for feedback. See response to Daave

> >

> > "Alias" wrote:

> >

> > > barrowhill wrote:

> > > > Checked file properties but says nothing other than where it is -

> > > > c:\windows\temp . Summary tab gives no info.

> > > >

> > > > Uploaded file to bothe Jotti and VirusTotal and clean response from

> both.

> > > >

> > > > Only conclusion I can come to is that the file is related to the IBM

> ThinPad

> > > > or their ThinkAdvantgae range. If it is, then putting the file into

> the

> > > > c:\windows\temp folder wasn't the best choice seeing as it appears

> undeletable

> > > >

> > > > If anyone knows what the file is/does I'd be interested in knowing.

> > > >

> > > > Thanks for everyone's help

> > >

> > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up

> > > first and, if that doesn't work, use the Issues feature but only tick

> > > the file in question if it appears. Leave anything else it finds

> unticked.

> > >

> > > Alias

> > > >

> > > > "Rey Santos" wrote:

> > > >

> > > >> This temp file might have something to do with an IBM thinkpad. Right

> click

> > > >> it and check its properties to see what it belongs to or what is

> creating

> > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and

> Jotti's

> > > >> malware scan http://virusscan.jotti.org/ for tests.

> > > >> --

> > > >> Rey

> > > >>

> > > >>

> > > >> "barrowhill" wrote:

> > > >>

> > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> > > >>>

> > > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or

> belongs

> > > >>> to ??? malware or not ???

> > > >>>

> > > >>> It resides in c:\windows\temp folder and cannot be deleted. I've

> used

> > > >>> various recommended utilities but it always comes back.

> > > >>>

> > > >>>

> > >

>

>

>

[Guest 3c273]

Re: What's this file??

 

You need to click on the find button (binoculars) and enter the file name

into the search box. It will then show which processes are using the file.

Click on the file name in the results window and it will highlight the

process that is using it.

Louis

 

"barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

news:E88D1DD0-2ED1-41ED-A394-146158F2DD14@microsoft.com...

> Thanks for input. I've downloaded and ran but to be honest can;t see

> anything remotely related to the file vtclrg41.tmp. II've tried to view

> ProcessExplorer activity as I try and delete fie to see which, if any,

> process "fires up". Nothing apparent

>

> "3c273" wrote:

>

> > Have you tried Process Explorer. It will tell you which process is

locking

> > the file. It is probably nothing more than some utility that came with

your

> > laptop.

> > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

> > Louis

> >

> > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com...

> > > Thanks for feedback. See response to Daave

> > >

> > > "Alias" wrote:

> > >

> > > > barrowhill wrote:

> > > > > Checked file properties but says nothing other than where it is -

> > > > > c:\windows\temp . Summary tab gives no info.

> > > > >

> > > > > Uploaded file to bothe Jotti and VirusTotal and clean response

from

> > both.

> > > > >

> > > > > Only conclusion I can come to is that the file is related to the

IBM

> > ThinPad

> > > > > or their ThinkAdvantgae range. If it is, then putting the file

into

> > the

> > > > > c:\windows\temp folder wasn't the best choice seeing as it appears

> > undeletable

> > > > >

> > > > > If anyone knows what the file is/does I'd be interested in

knowing.

> > > > >

> > > > > Thanks for everyone's help

> > > >

> > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the

clean up

> > > > first and, if that doesn't work, use the Issues feature but only

tick

> > > > the file in question if it appears. Leave anything else it finds

> > unticked.

> > > >

> > > > Alias

> > > > >

> > > > > "Rey Santos" wrote:

> > > > >

> > > > >> This temp file might have something to do with an IBM thinkpad.

Right

> > click

> > > > >> it and check its properties to see what it belongs to or what is

> > creating

> > > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/

and

> > Jotti's

> > > > >> malware scan http://virusscan.jotti.org/ for tests.

> > > > >> --

> > > > >> Rey

> > > > >>

> > > > >>

> > > > >> "barrowhill" wrote:

> > > > >>

> > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> > > > >>>

> > > > >>> Can anyone tell me what the

file...........vtclrg41.tmp........is or

> > belongs

> > > > >>> to ??? malware or not ???

> > > > >>>

> > > > >>> It resides in c:\windows\temp folder and cannot be deleted.

I've

> > used

> > > > >>> various recommended utilities but it always comes back.

> > > > >>>

> > > > >>>

> > > >

> >

> >

> >

[Guest Daave]

Re: What's this file??

 

barrowhill wrote:

> That was first option tried. The file won't delete. Renamed file

> using MoveOnBoot. Can delete renamed file but original file gets

> restored. Haven't found a way to delete that's why I'm thinking it's

> key file for IBM ThinkPad

 

I just re-read this post. :-)

 

Apparently, you *can* delete the file, although it involves the

workaround using MoveOnBoot.

 

And anytime the file gets deleted, a new one gets created; this is by

design.

 

If you still want to play around with it, perhaps you can use the

"Delete protected file" function of Malwarebytes' Anti-Malware:

 

http://www.malwarebytes.org/mbam.php

 

Or you could just leave it alone. :-)

[Guest barrowhill]

Re: What's this file??

 

Thanks very much for additional feedback - just the ticket!

 

Followed your instructions and the file in question (vtclrg41.tmp) is used

by two processess - winlogon.exe and vtserver.exe.

 

Winlogon not the issue as we know what that does, the relevant one is

vtserver.exe. The is a Passport Server Module from UPEK inc belobging to IBM

fingerprint authentication software. The laptop has fingerprint recognition.

 

It's just a pity that IBM chose to use C:\windows\temp to store the file.

Running Ashampoo Winoptimzer scans this folder and assumes, as a "temp"

folder, that all is for removal which in the case of this file, it's not.

 

At least my orginal question has been answered. Thanks to all those who

responded and to you for putting the final nail in the coffin. Most grateful.

"3c273" wrote:

> You need to click on the find button (binoculars) and enter the file name

> into the search box. It will then show which processes are using the file.

> Click on the file name in the results window and it will highlight the

> process that is using it.

> Louis

>

> "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> news:E88D1DD0-2ED1-41ED-A394-146158F2DD14@microsoft.com...

> > Thanks for input. I've downloaded and ran but to be honest can;t see

> > anything remotely related to the file vtclrg41.tmp. II've tried to view

> > ProcessExplorer activity as I try and delete fie to see which, if any,

> > process "fires up". Nothing apparent

> >

> > "3c273" wrote:

> >

> > > Have you tried Process Explorer. It will tell you which process is

> locking

> > > the file. It is probably nothing more than some utility that came with

> your

> > > laptop.

> > > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

> > > Louis

> > >

> > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> > > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com...

> > > > Thanks for feedback. See response to Daave

> > > >

> > > > "Alias" wrote:

> > > >

> > > > > barrowhill wrote:

> > > > > > Checked file properties but says nothing other than where it is -

> > > > > > c:\windows\temp . Summary tab gives no info.

> > > > > >

> > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response

> from

> > > both.

> > > > > >

> > > > > > Only conclusion I can come to is that the file is related to the

> IBM

> > > ThinPad

> > > > > > or their ThinkAdvantgae range. If it is, then putting the file

> into

> > > the

> > > > > > c:\windows\temp folder wasn't the best choice seeing as it appears

> > > undeletable

> > > > > >

> > > > > > If anyone knows what the file is/does I'd be interested in

> knowing.

> > > > > >

> > > > > > Thanks for everyone's help

> > > > >

> > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the

> clean up

> > > > > first and, if that doesn't work, use the Issues feature but only

> tick

> > > > > the file in question if it appears. Leave anything else it finds

> > > unticked.

> > > > >

> > > > > Alias

> > > > > >

> > > > > > "Rey Santos" wrote:

> > > > > >

> > > > > >> This temp file might have something to do with an IBM thinkpad.

> Right

> > > click

> > > > > >> it and check its properties to see what it belongs to or what is

> > > creating

> > > > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/

> and

> > > Jotti's

> > > > > >> malware scan http://virusscan.jotti.org/ for tests.

> > > > > >> --

> > > > > >> Rey

> > > > > >>

> > > > > >>

> > > > > >> "barrowhill" wrote:

> > > > > >>

> > > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed.......

> > > > > >>>

> > > > > >>> Can anyone tell me what the

> file...........vtclrg41.tmp........is or

> > > belongs

> > > > > >>> to ??? malware or not ???

> > > > > >>>

> > > > > >>> It resides in c:\windows\temp folder and cannot be deleted.

> I've

> > > used

> > > > > >>> various recommended utilities but it always comes back.

> > > > > >>>

> > > > > >>>

> > > > >

> > >

> > >

> > >

>

>

>

[Guest barrowhill]

Re: What's this file??

 

Thanks for feedback and suggestion. I don't think prudent to delete. Please

see my final reply to 3c273. The file is part of IBM fingerprint recognition.

 

"Daave" wrote:

> barrowhill wrote:

> > That was first option tried. The file won't delete. Renamed file

> > using MoveOnBoot. Can delete renamed file but original file gets

> > restored. Haven't found a way to delete that's why I'm thinking it's

> > key file for IBM ThinkPad

>

> I just re-read this post. :-)

>

> Apparently, you *can* delete the file, although it involves the

> workaround using MoveOnBoot.

>

> And anytime the file gets deleted, a new one gets created; this is by

> design.

>

> If you still want to play around with it, perhaps you can use the

> "Delete protected file" function of Malwarebytes' Anti-Malware:

>

> http://www.malwarebytes.org/mbam.php

>

> Or you could just leave it alone. :-)

>

>

>

[Guest 3c273]

Re: What's this file??

 

Glad you got it sorted. It actually seems quite common to use the temp

folder. The first 2 servers I checked both have "in-use" temp files as do

both of my workstations. Dell Open Manage, APC Power Chute, and the Dell

Wireless Utility also make use of that folder.

Louis

 

"barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

news:0D76BA02-DD1E-46DC-8DC3-617FA12BD8EF@microsoft.com...

> Thanks very much for additional feedback - just the ticket!

>

> Followed your instructions and the file in question (vtclrg41.tmp) is used

> by two processess - winlogon.exe and vtserver.exe.

>

> Winlogon not the issue as we know what that does, the relevant one is

> vtserver.exe. The is a Passport Server Module from UPEK inc belobging to

IBM

> fingerprint authentication software. The laptop has fingerprint

recognition.

>

> It's just a pity that IBM chose to use C:\windows\temp to store the file.

> Running Ashampoo Winoptimzer scans this folder and assumes, as a "temp"

> folder, that all is for removal which in the case of this file, it's not.

>

> At least my orginal question has been answered. Thanks to all those who

> responded and to you for putting the final nail in the coffin. Most

grateful.

> "3c273" wrote:

>

> > You need to click on the find button (binoculars) and enter the file

name

> > into the search box. It will then show which processes are using the

file.

> > Click on the file name in the results window and it will highlight the

> > process that is using it.

> > Louis

> >

> > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> > news:E88D1DD0-2ED1-41ED-A394-146158F2DD14@microsoft.com...

> > > Thanks for input. I've downloaded and ran but to be honest can;t see

> > > anything remotely related to the file vtclrg41.tmp. II've tried to

view

> > > ProcessExplorer activity as I try and delete fie to see which, if any,

> > > process "fires up". Nothing apparent

> > >

> > > "3c273" wrote:

> > >

> > > > Have you tried Process Explorer. It will tell you which process is

> > locking

> > > > the file. It is probably nothing more than some utility that came

with

> > your

> > > > laptop.

> > > > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

> > > > Louis

> > > >

> > > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message

> > > > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com...

> > > > > Thanks for feedback. See response to Daave

> > > > >

> > > > > "Alias" wrote:

> > > > >

> > > > > > barrowhill wrote:

> > > > > > > Checked file properties but says nothing other than where it

is -

> > > > > > > c:\windows\temp . Summary tab gives no info.

> > > > > > >

> > > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response

> > from

> > > > both.

> > > > > > >

> > > > > > > Only conclusion I can come to is that the file is related to

the

> > IBM

> > > > ThinPad

> > > > > > > or their ThinkAdvantgae range. If it is, then putting the

file

> > into

> > > > the

> > > > > > > c:\windows\temp folder wasn't the best choice seeing as it

appears

> > > > undeletable

> > > > > > >

> > > > > > > If anyone knows what the file is/does I'd be interested in

> > knowing.

> > > > > > >

> > > > > > > Thanks for everyone's help

> > > > > >

> > > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the

> > clean up

> > > > > > first and, if that doesn't work, use the Issues feature but only

> > tick

> > > > > > the file in question if it appears. Leave anything else it finds

> > > > unticked.

> > > > > >

> > > > > > Alias

> > > > > > >

> > > > > > > "Rey Santos" wrote:

> > > > > > >

> > > > > > >> This temp file might have something to do with an IBM

thinkpad.

> > Right

> > > > click

> > > > > > >> it and check its properties to see what it belongs to or what

is

> > > > creating

> > > > > > >> it?. Or upload the file to Virus Total

http://www.virustotal.com/

> > and

> > > > Jotti's

> > > > > > >> malware scan http://virusscan.jotti.org/ for tests.

> > > > > > >> --

> > > > > > >> Rey

> > > > > > >>

> > > > > > >>

> > > > > > >> "barrowhill" wrote:

> > > > > > >>

> > > > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro

installed.......

> > > > > > >>>

> > > > > > >>> Can anyone tell me what the

> > file...........vtclrg41.tmp........is or

> > > > belongs

> > > > > > >>> to ??? malware or not ???

> > > > > > >>>

> > > > > > >>> It resides in c:\windows\temp folder and cannot be deleted.

> > I've

> > > > used

> > > > > > >>> various recommended utilities but it always comes back.

> > > > > > >>>

> > > > > > >>>

> > > > > >

> > > >

> > > >

> > > >

> >

> >

> >