Guest barrowhill Posted July 21, 2008 Posted July 21, 2008 Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... Can anyone tell me what the file...........vtclrg41.tmp........is or belongs to ??? malware or not ??? It resides in c:\windows\temp folder and cannot be deleted. I've used various recommended utilities but it always comes back.
Guest R. McCarty Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? You can use a SysInternals application Filemon, to determine what process on the system is using/accessing the temporary file. You'll need to let the app run for a while ( 1-2 Minutes ) and then scroll though the history log looking for your .tmp workspace file. Lots of applications make use of temporary or workspace files and each setup has various ones depending on what applications are installed on the computer. As to whether the temp file is part of a Malware infection, I'd use an online scan of a different vendor from your permanent security app as a redundancy check: FileMon found here: http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx Eset Online Scan: http://www.eset.com/onlinescan/ Ewido Online Scan: http://www.ewido.net/en/onlinescan/ "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com... > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > Can anyone tell me what the file...........vtclrg41.tmp........is or > belongs > to ??? malware or not ??? > > It resides in c:\windows\temp folder and cannot be deleted. I've used > various recommended utilities but it always comes back. > >
Guest barrowhill Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? Thanks for feedback....... If run Panda On-line Active Scan and nothing found. Run adware/malware scanners and ditto. I'm suspecting something to do with Lenovo/IBM as this file only appears on net search relating to Thinkpad "R. McCarty" wrote: > You can use a SysInternals application Filemon, to determine what > process on the system is using/accessing the temporary file. You'll > need to let the app run for a while ( 1-2 Minutes ) and then scroll > though the history log looking for your .tmp workspace file. Lots of > applications make use of temporary or workspace files and each > setup has various ones depending on what applications are installed > on the computer. > > As to whether the temp file is part of a Malware infection, I'd use an > online scan of a different vendor from your permanent security app > as a redundancy check: > > FileMon found here: > http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx > > Eset Online Scan: > http://www.eset.com/onlinescan/ > Ewido Online Scan: > http://www.ewido.net/en/onlinescan/ > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com... > > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > Can anyone tell me what the file...........vtclrg41.tmp........is or > > belongs > > to ??? malware or not ??? > > > > It resides in c:\windows\temp folder and cannot be deleted. I've used > > various recommended utilities but it always comes back. > > > > > > >
Guest Rey Santos Posted July 21, 2008 Posted July 21, 2008 RE: What's this file?? This temp file might have something to do with an IBM thinkpad. Right click it and check its properties to see what it belongs to or what is creating it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's malware scan http://virusscan.jotti.org/ for tests. -- Rey "barrowhill" wrote: > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > Can anyone tell me what the file...........vtclrg41.tmp........is or belongs > to ??? malware or not ??? > > It resides in c:\windows\temp folder and cannot be deleted. I've used > various recommended utilities but it always comes back. > >
Guest barrowhill Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? Run FileMon. Filtered on C:\windows\temp and ran Ashampoo WinOptimizer 5 to generate activity on the file. Sample result..... .. .. 6822 3:16:35 PM WO5.exe:5476 QUERY INFORMATION C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Attributes: A 6823 3:16:35 PM WO5.exe:5476 OPEN C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Options: Open Access: 00030080 6824 3:16:35 PM WO5.exe:5476 OPEN C:\WINDOWS\TEMP\ SUCCESS Options: Open Directory Access: 00100000 6825 3:16:35 PM WO5.exe:5476 QUERY INFORMATION C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS FileAttributeTagInformation 6826 3:16:35 PM WO5.exe:5476 DELETE C:\WINDOWS\TEMP\vtclrg41.tmp CANNOT DELETE 6827 3:16:35 PM WO5.exe:5476 CLOSE C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS .. .. All it tells me is that it cannot delete the file.!?! "R. McCarty" wrote: > You can use a SysInternals application Filemon, to determine what > process on the system is using/accessing the temporary file. You'll > need to let the app run for a while ( 1-2 Minutes ) and then scroll > though the history log looking for your .tmp workspace file. Lots of > applications make use of temporary or workspace files and each > setup has various ones depending on what applications are installed > on the computer. > > As to whether the temp file is part of a Malware infection, I'd use an > online scan of a different vendor from your permanent security app > as a redundancy check: > > FileMon found here: > http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx > > Eset Online Scan: > http://www.eset.com/onlinescan/ > Ewido Online Scan: > http://www.ewido.net/en/onlinescan/ > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com... > > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > Can anyone tell me what the file...........vtclrg41.tmp........is or > > belongs > > to ??? malware or not ??? > > > > It resides in c:\windows\temp folder and cannot be deleted. I've used > > various recommended utilities but it always comes back. > > > > > > >
Guest R. McCarty Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? You need to check the "Process" column for any vtclrg41.tmp entries. It's the process field that will identify what is accessing the file. "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message news:C886E5DE-4528-4AFC-BDA8-42996B2122B1@microsoft.com... > Run FileMon. Filtered on C:\windows\temp and ran Ashampoo WinOptimizer 5 > to > generate activity on the file. Sample result..... > . > . > 6822 3:16:35 PM WO5.exe:5476 QUERY INFORMATION > C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Attributes: A > 6823 3:16:35 PM WO5.exe:5476 OPEN > C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS Options: Open Access: 00030080 > 6824 3:16:35 PM WO5.exe:5476 OPEN > C:\WINDOWS\TEMP\ SUCCESS Options: Open Directory Access: 00100000 > 6825 3:16:35 PM WO5.exe:5476 QUERY INFORMATION > C:\WINDOWS\TEMP\vtclrg41.tmp > SUCCESS FileAttributeTagInformation > 6826 3:16:35 PM WO5.exe:5476 DELETE > C:\WINDOWS\TEMP\vtclrg41.tmp CANNOT DELETE > 6827 3:16:35 PM WO5.exe:5476 CLOSE > C:\WINDOWS\TEMP\vtclrg41.tmp SUCCESS > . > . > All it tells me is that it cannot delete the file.!?! > > "R. McCarty" wrote: > >> You can use a SysInternals application Filemon, to determine what >> process on the system is using/accessing the temporary file. You'll >> need to let the app run for a while ( 1-2 Minutes ) and then scroll >> though the history log looking for your .tmp workspace file. Lots of >> applications make use of temporary or workspace files and each >> setup has various ones depending on what applications are installed >> on the computer. >> >> As to whether the temp file is part of a Malware infection, I'd use an >> online scan of a different vendor from your permanent security app >> as a redundancy check: >> >> FileMon found here: >> http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx >> >> Eset Online Scan: >> http://www.eset.com/onlinescan/ >> Ewido Online Scan: >> http://www.ewido.net/en/onlinescan/ >> >> "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message >> news:208BB87E-922D-478B-889F-D4BF169ACAF9@microsoft.com... >> > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... >> > >> > Can anyone tell me what the file...........vtclrg41.tmp........is or >> > belongs >> > to ??? malware or not ??? >> > >> > It resides in c:\windows\temp folder and cannot be deleted. I've used >> > various recommended utilities but it always comes back. >> > >> > >> >> >>
Guest barrowhill Posted July 21, 2008 Posted July 21, 2008 RE: What's this file?? Checked file properties but says nothing other than where it is - c:\windows\temp . Summary tab gives no info. Uploaded file to bothe Jotti and VirusTotal and clean response from both. Only conclusion I can come to is that the file is related to the IBM ThinPad or their ThinkAdvantgae range. If it is, then putting the file into the c:\windows\temp folder wasn't the best choice seeing as it appears undeletable If anyone knows what the file is/does I'd be interested in knowing. Thanks for everyone's help "Rey Santos" wrote: > > This temp file might have something to do with an IBM thinkpad. Right click > it and check its properties to see what it belongs to or what is creating > it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's > malware scan http://virusscan.jotti.org/ for tests. > -- > Rey > > > "barrowhill" wrote: > > > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > Can anyone tell me what the file...........vtclrg41.tmp........is or belongs > > to ??? malware or not ??? > > > > It resides in c:\windows\temp folder and cannot be deleted. I've used > > various recommended utilities but it always comes back. > > > >
Guest Alias Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? barrowhill wrote: > Checked file properties but says nothing other than where it is - > c:\windows\temp . Summary tab gives no info. > > Uploaded file to bothe Jotti and VirusTotal and clean response from both. > > Only conclusion I can come to is that the file is related to the IBM ThinPad > or their ThinkAdvantgae range. If it is, then putting the file into the > c:\windows\temp folder wasn't the best choice seeing as it appears undeletable > > If anyone knows what the file is/does I'd be interested in knowing. > > Thanks for everyone's help Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up first and, if that doesn't work, use the Issues feature but only tick the file in question if it appears. Leave anything else it finds unticked. Alias > > "Rey Santos" wrote: > >> This temp file might have something to do with an IBM thinkpad. Right click >> it and check its properties to see what it belongs to or what is creating >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's >> malware scan http://virusscan.jotti.org/ for tests. >> -- >> Rey >> >> >> "barrowhill" wrote: >> >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... >>> >>> Can anyone tell me what the file...........vtclrg41.tmp........is or belongs >>> to ??? malware or not ??? >>> >>> It resides in c:\windows\temp folder and cannot be deleted. I've used >>> various recommended utilities but it always comes back. >>> >>>
Guest Daave Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? barrowhill wrote: > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > Can anyone tell me what the file...........vtclrg41.tmp........is or > belongs to ??? malware or not ??? > > It resides in c:\windows\temp folder and cannot be deleted. I've used > various recommended utilities but it always comes back. Why not delete it in Safe Mode?
Guest barrowhill Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? That was first option tried. The file won't delete. Renamed file using MoveOnBoot. Can delete renamed file but original file gets restored. Haven't found a way to delete that's why I'm thinking it's key file for IBM ThinkPad "Daave" wrote: > barrowhill wrote: > > Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > Can anyone tell me what the file...........vtclrg41.tmp........is or > > belongs to ??? malware or not ??? > > > > It resides in c:\windows\temp folder and cannot be deleted. I've used > > various recommended utilities but it always comes back. > > Why not delete it in Safe Mode? > > >
Guest Daave Posted July 21, 2008 Posted July 21, 2008 Re: What's this file?? barrowhill wrote: > "Daave" wrote: > >> barrowhill wrote: >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... >>> >>> Can anyone tell me what the file...........vtclrg41.tmp........is or >>> belongs to ??? malware or not ??? >>> >>> It resides in c:\windows\temp folder and cannot be deleted. I've >>> used various recommended utilities but it always comes back. >> >> Why not delete it in Safe Mode? > That was first option tried. The file won't delete. Renamed file > using MoveOnBoot. Can delete renamed file but original file gets > restored. Haven't found a way to delete that's why I'm thinking it's > key file for IBM ThinkPad If you're determined, you can try the method discussed here: http://articles.techrepublic.com.com/5100-22_11-5288922.html But I'll bet you'll get a replacement! Another page you might find helpful: http://www.pchell.com/support/undeletablefiles.shtml Have you tried using Ccleaner?
Guest barrowhill Posted July 22, 2008 Posted July 22, 2008 Re: What's this file?? Thanks for links. Performed operations as detailed but"Access denied" message when trying to delete via command window. Tried CCleaner but not impressed. Looking at results of detected files it doesn't (or didn't) even look at c:\windows\temp folder. If it did, it didn't find anything to delete though I'd checked to see there were files (including vtclrg41.tmp) to delete. There were. "Daave" wrote: > barrowhill wrote: > > > "Daave" wrote: > > > >> barrowhill wrote: > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > >>> > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or > >>> belongs to ??? malware or not ??? > >>> > >>> It resides in c:\windows\temp folder and cannot be deleted. I've > >>> used various recommended utilities but it always comes back. > >> > >> Why not delete it in Safe Mode? > > > That was first option tried. The file won't delete. Renamed file > > using MoveOnBoot. Can delete renamed file but original file gets > > restored. Haven't found a way to delete that's why I'm thinking it's > > key file for IBM ThinkPad > > If you're determined, you can try the method discussed here: > > http://articles.techrepublic.com.com/5100-22_11-5288922.html > > But I'll bet you'll get a replacement! > > Another page you might find helpful: > > http://www.pchell.com/support/undeletablefiles.shtml > > Have you tried using Ccleaner? > > >
Guest barrowhill Posted July 22, 2008 Posted July 22, 2008 Re: What's this file?? Thanks for feedback. See response to Daave "Alias" wrote: > barrowhill wrote: > > Checked file properties but says nothing other than where it is - > > c:\windows\temp . Summary tab gives no info. > > > > Uploaded file to bothe Jotti and VirusTotal and clean response from both. > > > > Only conclusion I can come to is that the file is related to the IBM ThinPad > > or their ThinkAdvantgae range. If it is, then putting the file into the > > c:\windows\temp folder wasn't the best choice seeing as it appears undeletable > > > > If anyone knows what the file is/does I'd be interested in knowing. > > > > Thanks for everyone's help > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up > first and, if that doesn't work, use the Issues feature but only tick > the file in question if it appears. Leave anything else it finds unticked. > > Alias > > > > "Rey Santos" wrote: > > > >> This temp file might have something to do with an IBM thinkpad. Right click > >> it and check its properties to see what it belongs to or what is creating > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's > >> malware scan http://virusscan.jotti.org/ for tests. > >> -- > >> Rey > >> > >> > >> "barrowhill" wrote: > >> > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > >>> > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or belongs > >>> to ??? malware or not ??? > >>> > >>> It resides in c:\windows\temp folder and cannot be deleted. I've used > >>> various recommended utilities but it always comes back. > >>> > >>> >
Guest Daave Posted July 22, 2008 Posted July 22, 2008 Re: What's this file?? barrowhill wrote: > Thanks for links. Performed operations as detailed but"Access denied" > message when trying to delete via command window. Have a look at "How to take ownership of a file or folder in Windows XP": http://support.microsoft.com/kb/308421 > Tried CCleaner but not impressed. Looking at results of detected > files it doesn't (or didn't) even look at c:\windows\temp folder. If > it did, it didn't find anything to delete though I'd checked to see > there were files (including vtclrg41.tmp) to delete. There were. CCleaner *does* look at the C:\Windows\Temp folder. But note that there is an advanced option to "only delete files in Windows temp folders older than 48 hours."
Guest 3c273 Posted July 22, 2008 Posted July 22, 2008 Re: What's this file?? Have you tried Process Explorer. It will tell you which process is locking the file. It is probably nothing more than some utility that came with your laptop. http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx Louis "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com... > Thanks for feedback. See response to Daave > > "Alias" wrote: > > > barrowhill wrote: > > > Checked file properties but says nothing other than where it is - > > > c:\windows\temp . Summary tab gives no info. > > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response from both. > > > > > > Only conclusion I can come to is that the file is related to the IBM ThinPad > > > or their ThinkAdvantgae range. If it is, then putting the file into the > > > c:\windows\temp folder wasn't the best choice seeing as it appears undeletable > > > > > > If anyone knows what the file is/does I'd be interested in knowing. > > > > > > Thanks for everyone's help > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up > > first and, if that doesn't work, use the Issues feature but only tick > > the file in question if it appears. Leave anything else it finds unticked. > > > > Alias > > > > > > "Rey Santos" wrote: > > > > > >> This temp file might have something to do with an IBM thinkpad. Right click > > >> it and check its properties to see what it belongs to or what is creating > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and Jotti's > > >> malware scan http://virusscan.jotti.org/ for tests. > > >> -- > > >> Rey > > >> > > >> > > >> "barrowhill" wrote: > > >> > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > >>> > > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or belongs > > >>> to ??? malware or not ??? > > >>> > > >>> It resides in c:\windows\temp folder and cannot be deleted. I've used > > >>> various recommended utilities but it always comes back. > > >>> > > >>> > >
Guest barrowhill Posted July 23, 2008 Posted July 23, 2008 Re: What's this file?? Thanks for info. Details specified in link followed but unable to delete. I should of looked at CC options. The file is over 48 hours old. but I unchecked anyway. After running, report shows all files deleted in c:\windows\temp folder (I must of missed it on last execution!). I didn't show vtclrg41.tmp as having been deleted.. Check actual location and sure enough, only file in the folder. "Daave" wrote: > barrowhill wrote: > > Thanks for links. Performed operations as detailed but"Access denied" > > message when trying to delete via command window. > > Have a look at "How to take ownership of a file or folder in Windows > XP": > > http://support.microsoft.com/kb/308421 > > > Tried CCleaner but not impressed. Looking at results of detected > > files it doesn't (or didn't) even look at c:\windows\temp folder. If > > it did, it didn't find anything to delete though I'd checked to see > > there were files (including vtclrg41.tmp) to delete. There were. > > CCleaner *does* look at the C:\Windows\Temp folder. But note that there > is an advanced option to "only delete files in Windows temp folders > older than 48 hours." > > >
Guest barrowhill Posted July 23, 2008 Posted July 23, 2008 Re: What's this file?? Thanks for input. I've downloaded and ran but to be honest can;t see anything remotely related to the file vtclrg41.tmp. II've tried to view ProcessExplorer activity as I try and delete fie to see which, if any, process "fires up". Nothing apparent "3c273" wrote: > Have you tried Process Explorer. It will tell you which process is locking > the file. It is probably nothing more than some utility that came with your > laptop. > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx > Louis > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com... > > Thanks for feedback. See response to Daave > > > > "Alias" wrote: > > > > > barrowhill wrote: > > > > Checked file properties but says nothing other than where it is - > > > > c:\windows\temp . Summary tab gives no info. > > > > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response from > both. > > > > > > > > Only conclusion I can come to is that the file is related to the IBM > ThinPad > > > > or their ThinkAdvantgae range. If it is, then putting the file into > the > > > > c:\windows\temp folder wasn't the best choice seeing as it appears > undeletable > > > > > > > > If anyone knows what the file is/does I'd be interested in knowing. > > > > > > > > Thanks for everyone's help > > > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up > > > first and, if that doesn't work, use the Issues feature but only tick > > > the file in question if it appears. Leave anything else it finds > unticked. > > > > > > Alias > > > > > > > > "Rey Santos" wrote: > > > > > > > >> This temp file might have something to do with an IBM thinkpad. Right > click > > > >> it and check its properties to see what it belongs to or what is > creating > > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and > Jotti's > > > >> malware scan http://virusscan.jotti.org/ for tests. > > > >> -- > > > >> Rey > > > >> > > > >> > > > >> "barrowhill" wrote: > > > >> > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > >>> > > > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or > belongs > > > >>> to ??? malware or not ??? > > > >>> > > > >>> It resides in c:\windows\temp folder and cannot be deleted. I've > used > > > >>> various recommended utilities but it always comes back. > > > >>> > > > >>> > > > > > >
Guest 3c273 Posted July 23, 2008 Posted July 23, 2008 Re: What's this file?? You need to click on the find button (binoculars) and enter the file name into the search box. It will then show which processes are using the file. Click on the file name in the results window and it will highlight the process that is using it. Louis "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message news:E88D1DD0-2ED1-41ED-A394-146158F2DD14@microsoft.com... > Thanks for input. I've downloaded and ran but to be honest can;t see > anything remotely related to the file vtclrg41.tmp. II've tried to view > ProcessExplorer activity as I try and delete fie to see which, if any, > process "fires up". Nothing apparent > > "3c273" wrote: > > > Have you tried Process Explorer. It will tell you which process is locking > > the file. It is probably nothing more than some utility that came with your > > laptop. > > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx > > Louis > > > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com... > > > Thanks for feedback. See response to Daave > > > > > > "Alias" wrote: > > > > > > > barrowhill wrote: > > > > > Checked file properties but says nothing other than where it is - > > > > > c:\windows\temp . Summary tab gives no info. > > > > > > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response from > > both. > > > > > > > > > > Only conclusion I can come to is that the file is related to the IBM > > ThinPad > > > > > or their ThinkAdvantgae range. If it is, then putting the file into > > the > > > > > c:\windows\temp folder wasn't the best choice seeing as it appears > > undeletable > > > > > > > > > > If anyone knows what the file is/does I'd be interested in knowing. > > > > > > > > > > Thanks for everyone's help > > > > > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the clean up > > > > first and, if that doesn't work, use the Issues feature but only tick > > > > the file in question if it appears. Leave anything else it finds > > unticked. > > > > > > > > Alias > > > > > > > > > > "Rey Santos" wrote: > > > > > > > > > >> This temp file might have something to do with an IBM thinkpad. Right > > click > > > > >> it and check its properties to see what it belongs to or what is > > creating > > > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ and > > Jotti's > > > > >> malware scan http://virusscan.jotti.org/ for tests. > > > > >> -- > > > > >> Rey > > > > >> > > > > >> > > > > >> "barrowhill" wrote: > > > > >> > > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > >>> > > > > >>> Can anyone tell me what the file...........vtclrg41.tmp........is or > > belongs > > > > >>> to ??? malware or not ??? > > > > >>> > > > > >>> It resides in c:\windows\temp folder and cannot be deleted. I've > > used > > > > >>> various recommended utilities but it always comes back. > > > > >>> > > > > >>> > > > > > > > > > >
Guest Daave Posted July 24, 2008 Posted July 24, 2008 Re: What's this file?? barrowhill wrote: > That was first option tried. The file won't delete. Renamed file > using MoveOnBoot. Can delete renamed file but original file gets > restored. Haven't found a way to delete that's why I'm thinking it's > key file for IBM ThinkPad I just re-read this post. :-) Apparently, you *can* delete the file, although it involves the workaround using MoveOnBoot. And anytime the file gets deleted, a new one gets created; this is by design. If you still want to play around with it, perhaps you can use the "Delete protected file" function of Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php Or you could just leave it alone. :-)
Guest barrowhill Posted July 24, 2008 Posted July 24, 2008 Re: What's this file?? Thanks very much for additional feedback - just the ticket! Followed your instructions and the file in question (vtclrg41.tmp) is used by two processess - winlogon.exe and vtserver.exe. Winlogon not the issue as we know what that does, the relevant one is vtserver.exe. The is a Passport Server Module from UPEK inc belobging to IBM fingerprint authentication software. The laptop has fingerprint recognition. It's just a pity that IBM chose to use C:\windows\temp to store the file. Running Ashampoo Winoptimzer scans this folder and assumes, as a "temp" folder, that all is for removal which in the case of this file, it's not. At least my orginal question has been answered. Thanks to all those who responded and to you for putting the final nail in the coffin. Most grateful. "3c273" wrote: > You need to click on the find button (binoculars) and enter the file name > into the search box. It will then show which processes are using the file. > Click on the file name in the results window and it will highlight the > process that is using it. > Louis > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > news:E88D1DD0-2ED1-41ED-A394-146158F2DD14@microsoft.com... > > Thanks for input. I've downloaded and ran but to be honest can;t see > > anything remotely related to the file vtclrg41.tmp. II've tried to view > > ProcessExplorer activity as I try and delete fie to see which, if any, > > process "fires up". Nothing apparent > > > > "3c273" wrote: > > > > > Have you tried Process Explorer. It will tell you which process is > locking > > > the file. It is probably nothing more than some utility that came with > your > > > laptop. > > > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx > > > Louis > > > > > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > > > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com... > > > > Thanks for feedback. See response to Daave > > > > > > > > "Alias" wrote: > > > > > > > > > barrowhill wrote: > > > > > > Checked file properties but says nothing other than where it is - > > > > > > c:\windows\temp . Summary tab gives no info. > > > > > > > > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response > from > > > both. > > > > > > > > > > > > Only conclusion I can come to is that the file is related to the > IBM > > > ThinPad > > > > > > or their ThinkAdvantgae range. If it is, then putting the file > into > > > the > > > > > > c:\windows\temp folder wasn't the best choice seeing as it appears > > > undeletable > > > > > > > > > > > > If anyone knows what the file is/does I'd be interested in > knowing. > > > > > > > > > > > > Thanks for everyone's help > > > > > > > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the > clean up > > > > > first and, if that doesn't work, use the Issues feature but only > tick > > > > > the file in question if it appears. Leave anything else it finds > > > unticked. > > > > > > > > > > Alias > > > > > > > > > > > > "Rey Santos" wrote: > > > > > > > > > > > >> This temp file might have something to do with an IBM thinkpad. > Right > > > click > > > > > >> it and check its properties to see what it belongs to or what is > > > creating > > > > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ > and > > > Jotti's > > > > > >> malware scan http://virusscan.jotti.org/ for tests. > > > > > >> -- > > > > > >> Rey > > > > > >> > > > > > >> > > > > > >> "barrowhill" wrote: > > > > > >> > > > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > > >>> > > > > > >>> Can anyone tell me what the > file...........vtclrg41.tmp........is or > > > belongs > > > > > >>> to ??? malware or not ??? > > > > > >>> > > > > > >>> It resides in c:\windows\temp folder and cannot be deleted. > I've > > > used > > > > > >>> various recommended utilities but it always comes back. > > > > > >>> > > > > > >>> > > > > > > > > > > > > > > > > >
Guest barrowhill Posted July 24, 2008 Posted July 24, 2008 Re: What's this file?? Thanks for feedback and suggestion. I don't think prudent to delete. Please see my final reply to 3c273. The file is part of IBM fingerprint recognition. "Daave" wrote: > barrowhill wrote: > > That was first option tried. The file won't delete. Renamed file > > using MoveOnBoot. Can delete renamed file but original file gets > > restored. Haven't found a way to delete that's why I'm thinking it's > > key file for IBM ThinkPad > > I just re-read this post. :-) > > Apparently, you *can* delete the file, although it involves the > workaround using MoveOnBoot. > > And anytime the file gets deleted, a new one gets created; this is by > design. > > If you still want to play around with it, perhaps you can use the > "Delete protected file" function of Malwarebytes' Anti-Malware: > > http://www.malwarebytes.org/mbam.php > > Or you could just leave it alone. :-) > > >
Guest 3c273 Posted July 24, 2008 Posted July 24, 2008 Re: What's this file?? Glad you got it sorted. It actually seems quite common to use the temp folder. The first 2 servers I checked both have "in-use" temp files as do both of my workstations. Dell Open Manage, APC Power Chute, and the Dell Wireless Utility also make use of that folder. Louis "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message news:0D76BA02-DD1E-46DC-8DC3-617FA12BD8EF@microsoft.com... > Thanks very much for additional feedback - just the ticket! > > Followed your instructions and the file in question (vtclrg41.tmp) is used > by two processess - winlogon.exe and vtserver.exe. > > Winlogon not the issue as we know what that does, the relevant one is > vtserver.exe. The is a Passport Server Module from UPEK inc belobging to IBM > fingerprint authentication software. The laptop has fingerprint recognition. > > It's just a pity that IBM chose to use C:\windows\temp to store the file. > Running Ashampoo Winoptimzer scans this folder and assumes, as a "temp" > folder, that all is for removal which in the case of this file, it's not. > > At least my orginal question has been answered. Thanks to all those who > responded and to you for putting the final nail in the coffin. Most grateful. > "3c273" wrote: > > > You need to click on the find button (binoculars) and enter the file name > > into the search box. It will then show which processes are using the file. > > Click on the file name in the results window and it will highlight the > > process that is using it. > > Louis > > > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > > news:E88D1DD0-2ED1-41ED-A394-146158F2DD14@microsoft.com... > > > Thanks for input. I've downloaded and ran but to be honest can;t see > > > anything remotely related to the file vtclrg41.tmp. II've tried to view > > > ProcessExplorer activity as I try and delete fie to see which, if any, > > > process "fires up". Nothing apparent > > > > > > "3c273" wrote: > > > > > > > Have you tried Process Explorer. It will tell you which process is > > locking > > > > the file. It is probably nothing more than some utility that came with > > your > > > > laptop. > > > > http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx > > > > Louis > > > > > > > > "barrowhill" <barrowhill@discussions.microsoft.com> wrote in message > > > > news:1614D4D4-630A-4440-967F-050FB4F27DA5@microsoft.com... > > > > > Thanks for feedback. See response to Daave > > > > > > > > > > "Alias" wrote: > > > > > > > > > > > barrowhill wrote: > > > > > > > Checked file properties but says nothing other than where it is - > > > > > > > c:\windows\temp . Summary tab gives no info. > > > > > > > > > > > > > > Uploaded file to bothe Jotti and VirusTotal and clean response > > from > > > > both. > > > > > > > > > > > > > > Only conclusion I can come to is that the file is related to the > > IBM > > > > ThinPad > > > > > > > or their ThinkAdvantgae range. If it is, then putting the file > > into > > > > the > > > > > > > c:\windows\temp folder wasn't the best choice seeing as it appears > > > > undeletable > > > > > > > > > > > > > > If anyone knows what the file is/does I'd be interested in > > knowing. > > > > > > > > > > > > > > Thanks for everyone's help > > > > > > > > > > > > Have you tried Crap Cleaner? Get it at http://www.ccleaner.com Try the > > clean up > > > > > > first and, if that doesn't work, use the Issues feature but only > > tick > > > > > > the file in question if it appears. Leave anything else it finds > > > > unticked. > > > > > > > > > > > > Alias > > > > > > > > > > > > > > "Rey Santos" wrote: > > > > > > > > > > > > > >> This temp file might have something to do with an IBM thinkpad. > > Right > > > > click > > > > > > >> it and check its properties to see what it belongs to or what is > > > > creating > > > > > > >> it?. Or upload the file to Virus Total http://www.virustotal.com/ > > and > > > > Jotti's > > > > > > >> malware scan http://virusscan.jotti.org/ for tests. > > > > > > >> -- > > > > > > >> Rey > > > > > > >> > > > > > > >> > > > > > > >> "barrowhill" wrote: > > > > > > >> > > > > > > >>> Running Lenovo/IBM Thinkpad Z60t with XP Pro installed....... > > > > > > >>> > > > > > > >>> Can anyone tell me what the > > file...........vtclrg41.tmp........is or > > > > belongs > > > > > > >>> to ??? malware or not ??? > > > > > > >>> > > > > > > >>> It resides in c:\windows\temp folder and cannot be deleted. > > I've > > > > used > > > > > > >>> various recommended utilities but it always comes back. > > > > > > >>> > > > > > > >>> > > > > > > > > > > > > > > > > > > > > > > > >
Recommended Posts