file in recycle bin

[gaz2374]

everytime i start up my new rig my recycle bin has this file in it RB2.tmp i delete it but when restart its there again

how can i get rid for good.

 

[zeus]

Thats weird!
Try doing a search for it in windows and delete any results, or at least find where its coming from. Maybe a program is set to delete previous temporary files upon startup?

 

[Chris_]

Hey,

Please could you download & run HijackThis (right click > save target as [IE]). Then post the logfile you have. This can identify startup and other processes on your PC, which will help us find a solution.

 

[donkey42]

also look in Add / Remove programs and uninstall anything the shouldn't be there

 

[gaz2374]

will download that thing.

as for add/remove it only got turned on for the first time yesterday so there aint much there and certanly nothing harmfull

 

[donkey42]

will download that thing.

as for add/remove it only got turned on for the first time yesterday so there aint much there and certanly nothing harmfull

well post list of installed software here, and we'll have a look

 

[gaz2374]

adobe acrobat 5.0
athlon 64 cpu driver
bit comet
blueyonder instant support tool
blueyonder pc guard
doom 3
FEAR
firefox
nero suite
nvidia drivers
nvidia forceware network access manager
pc wizard 1.6
pc gaurd advisor
quake 4
webstar cable modem
SST programing software( keyboard control pad)
windows installer 3.1
winzip


thats the whole list from add/ remove programs

 

[Karanislove]

Dont you have any AntiVirus installed on ur system?? I would say install AVAST home edition, which is free and good. THen run an AV check coz it could be a virus or something..
Kind of simillar problem I've found [link=http://www.lavasoftsupport.com/lofiversion/index.php/t3131.html]here[/link] and I think the problem here was that person had 2 AV installed on his system. Which is not good..

 

[Chris_]

Dont you have any AntiVirus installed on ur system?? I would say install AVAST home edition, which is free and good. THen run an AV check coz it could be a virus or something..
Kind of simillar problem I've found [link=http://www.lavasoftsupport.com/lofiversion/index.php/t3131.html]here[/link] and I think the problem here was that person had 2 AV installed on his system. Which is not good..

heh, I found that link to :P

@gaz2374: get your HijackThis log posted ASAP! You could be vulnerable. :eek:

 

[gaz2374]

sorry i do have antivirus . iv got nvidia antivirus and firewall

also got pcguard which came with my blueyonder cable

 

[gaz2374]

Logfile of HijackThis v1.99.1
Scan saved at 17:07:49, on 19/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\blueyonder\PCguard\fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\blueyonder\PCguard advisor\PCguardadvisor.exe
C:\Program Files\blueyonder\PCguard\Rps.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\blueyonder IST\bin\mpbtn.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\TOOLS\WINZIP\winzip32.exe
C:\Documents and Settings\gaz\Local Settings\Temp\wzccd9\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = blueyonder > searches > searches_homepage
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = blueyonder > home > home_offnet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\blueyonder\PCguard\pkR.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\blueyonder\PCguard\FBHR.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [PCguardadvisor.exe] "C:\Program Files\blueyonder\PCguard advisor\PCguardadvisor.exe"
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\blueyonder\PCguard\Rps.exe"
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: blueyonder Instant Support Tool.lnk = C:\Program Files\blueyonder IST\bin\matcli.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCguard Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\blueyonder\PCguard\fws.exe

thats the log now what

 

[Chris_]

I'll take a look and analyse it - thanks.

Edit below:

Firstly, I recommend you uninstall nVidia Firewall & Anti-Virus through Start > Control Panel > Add/Remove Programs .. as having 2 firewall's is very bad and can cause heavy conflict.
This would leave you with PC Guard firewall & no antivirus.. so before you uninstall anything download Free avast! Home Edition, install it and do any required restarts in this whole process.

You also have a lot of other non-needed startup applications running.. I have compiled a registry script which if you run will remove these entries.

Download:
Warning: always backup your registry (Start > regedit > File > Export) before you make modifications!
remove_startups.reg
(Scroll down the page and choose 'Free' download from rapidshare.de)

Now when you next start up you should find some improvement in performance, this might also take affect on the temp files appearing in your Recycle bin at startup.. try all this and get back to us..

 

[gaz2374]

did everything u listed chris but the file still appears in recycle bin.

 

[donkey42]

add remove software

looks fine

Logfile of HijackThis v1.99.1

looks fine too, unless i'm missing somthing, don't know what your problem is, i'll keep an eye on your thread, if i have any further input, i'll post it

 

[Chris_]

did everything u listed chris but the file still appears in recycle bin.

Do you think that you could provide information about this file:

Is it always named 'RB2.tmp'?
What is the size of this file?
Is this file a ligher shade than others (as if its cut)?


Thanks

 

[gaz2374]

depends how long i leave it if i leave it a few shutdowns there will be a few RB2.tmp
rb3.tmp
rb4.tmp

etc etc

there 0kb in size

 

[Chris_]

I have done some more research on your issue and hopefully found a solution. Someone from this forum has said that he downloaded PC-cillin and successfully stopped the RB#.tmp files from appearing in the recycle bin..

Download: PC-cillin Internet Security Trial (win32)

Hope this works out for you!