Results 1 to 5 of 5
  1. #1
    New Lounger
    Join Date
    Apr 2011
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts

    PF*.pdf file constantly written to windows/temp folder

    In viewing my resource monitor, I found very high disk usage with strange PF*.pdf files being constantly written to the windows/temp folder. Turns out there were not multiple files, but only a single file that is constantly changing its name, sometimes with apparent content (+bytes).

    When I tried to manually delete the file, the file would not delete...BUT would again change its name! All on its own! And because of that, Foxit PDF did not find any file to open. The error message was "!".

    Virus? I ran "threat-level" Malwarebytes, MSE (both programs resident, current and running on the system), and Trend Micro (online, non-resident). I also have EMET 5.1 installed. No problems found.

    Just in case, I performed a complete system restore back to a very old date with the intention of reestablishing the computer to before any potential virus might have occurred. Yes, it was a guess. But worth a try as I have not noticed any strange .pdf's before.

    CCleaner would not delete the .pdf file until I uninstalled Nuance PaperPort (original with computer).

    But now the file has returned, still changing its name, and using my disk resources.

    What in the world is going on????

    Many thanks,
    NLW
    Last edited by NLW; 2015-02-12 at 12:42.

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts
    Have you checked your startup programs using either Autoruns or WhatInStartup. Autoruns produces a lot of information. You should primarily be concerned with the Logon tab. If you aren't sure of what is listed please post a screenshot and someone here will help.

    You can also use Process Explorer to track down what process is creating the files. The Process Explorer help files should explain how to use it. There is also a Process Explorer forum at Sysinternals Forums for even more help.

    Joe

  3. #3
    New Lounger
    Join Date
    Apr 2011
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thank you, Joe. I will use your suggestions for further research.
    NLW

  4. #4
    New Lounger
    Join Date
    Apr 2011
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Success. Mostly....

    I was able to stop the program from auto-starting, but have not found the .exe and cannot delete the folder.

    Even so, the weird .pdf behavior has stopped and my disk usage has calmed down.

    If a virus had overtaken the PDFProFiltSrv file, I believe it has been effectively neutralized.

    Info source:
    http://nuance.custhelp.com/app/answe...desktop-search

  5. #5
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts
    Both of the programs I mentioned show the file path.

    Joe

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •