anything wrong?

[Jam3s-Zer0]

No, you didn't need it Sorry.
I was just wondering if you had it.

Could you go to:

C:\windows\system32\logfiles\wmi\

and tell me whats inside and what sizes they are.

 

[Todd0]

holy crap pretty sure u found it,
there are two files

1A2.tmp - was 1.6gb when i looked at it first and now is 2.04gb

trace.txt - 2.5gb

 

[Jam3s-Zer0]

Please open trace.txt and see if it has a name of a program/process included at the start of the text?

Both are safe to delete after this but we need to find out what is creating them and I thought it was Bootvis

 

[Todd0]

nah it wont open, an i cant delete them because they are in use

 

[Jam3s-Zer0]

Right, first boot up into safe mode and try delete them there. (To get into safe mode press f8 before the windows loading screen at boot)

If you cannot delete them in safe mode run HijackThis and go to 'misc tools' then open process manager. When it is open press the floppy disk icon and save the list.

Boot back up into normal mode and post the list here.

 

[Todd0]

sorry about taking ages to reply i had some stuff to do, here is the log.

Process list saved on 9:49:14 PM, on 8/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)

[pid] [full path to filename] [file version] [company name]
164 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
244 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
288 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
300 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
456 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
564 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
616 C:\Program Files\DigitalPersona\Bin\DPWinLct.exe 3.0.0.624 DigitalPersona, Inc.
828 C:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
1012 C:\HijackThis.exe 1.99.0.1 Soeperman Enterprises Ltd.

 

[Jam3s-Zer0]

Also sorry for the late reply. So you couldn't delete it in safe mode?

That means one of the process' above is stopping you and creating such a large file.

Ok, Next thing to do, since you can't delete it in safe mode...re-run HijackThis and go to the misc tools list again. Open 'delete a file on reboot' and select it and reboot when prompted.

 

[Jam3s-Zer0]

O ye, and repeat for the other file.

 

[Todd0]

hey i got rid of it, thanks for your help

 

[Todd0]

well i got rid of it, but it comes back each time i reboot, any ideas?