Can someone identify this file in my Temp folder ..??

D

delta

jatmlano.sys I can't find what is associated with, if anything..I
cant delete it..(Being used by program or another user!!)Thanks
 
W

Will Denny

Hi

Have you virus checked your system with the latest definitions for your Anti
Virus program?

Also please try these programs to check for any spyware that may be on your
system:

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://forum.aumha.org/downloads/cwshredder.zip
Spy Sweeper - www.webroot.com

Try SpyWareBlaster to stop intrusions:

http://www.javacoolsoftware.com/spywareblaster.html

Also see the following links:

http://aumha.org/a/parasite.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.microsoft.com/security/articles/spyware.asp
 
D

delta

Hi

Have you virus checked your system with the latest definitions for your Anti
Virus program?

Also please try these programs to check for any spyware that may be on your
system:

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://forum.aumha.org/downloads/cwshredder.zip
Spy Sweeper - www.webroot.com

Try SpyWareBlaster to stop intrusions:

http://www.javacoolsoftware.com/spywareblaster.html

Also see the following links:

http://aumha.org/a/parasite.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.microsoft.com/security/articles/spyware.asp


I run a virus program constantly and use SpyBot and Ad-aware..Do you
believe this is some sort of virus..??
 
W

Will Denny

I run a virus program constantly and use SpyBot and Ad-aware..Do you
believe this is some sort of virus..??

Hi

I don't what that file is - never come across before. If you can, right
click on it and then select Properties. Anything in there that might
indentify the file? Try and delete it via a command prompt.
 
D

delta



I found that as well, but don't speak German..It was also in that
gentlemans temp file as far as I could tell...The only way I am able
to delete it is with a reboot, then it will delete because something
else (??) is no longer accessing it....A properties check on the file
just says its name with no other info to go on..!! Ill keep checking,
thanks all for the info so far...

barry
 
R

Ron Martell

jatmlano.sys I can't find what is associated with, if anything..I
cant delete it..(Being used by program or another user!!)Thanks

Nothing in your Temp folder should ever been in use by a legitimate
application or device driver, except while that item is being
initially installed. Once installed it should delete all of the
temporary files that it created and all of the files that it needs
should either be in the program folder or in one of the system folders
such as \windows\system32.

I therefore suspect that this file may be related to some form of
malware that has found its way onto your computer. The fact that a
google search turns up only a single reference to this file name, in a
German language security forum, reinforces my suspicion.

Make certain that your antivirus software is fully up to date, with
the virus definitions not more than a week old and do a complete virus
scan of your hard drive. Get a second opinion by doing a free online
virus scan at http://housecall.trendmicro.com

Then check for possible spyware on your computer by following the
steps in MVP Jim Eshelman's Spyware Quick Fix Protocol web page at
http://www.aumha.org/a/quickfix.htm

If these fail to turn up anything then you could try booting your
computer into Safe Mode and then deleting the file. Booting into
Safe Mode should bypass the loading of whatever scumware item it is
that is keeping you from deleting this file.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."
 
D

delta

Make certain that your antivirus software is fully up to date, with
the virus definitions not more than a week old and do a complete virus
scan of your hard drive. Get a second opinion by doing a free online
virus scan at http://housecall.trendmicro.com

I went to the Website (thanks) D/L the cab file and it scanned with
clean results...I was able to delete the file after a reboot but this
the second time it had reared its head...I'll do a registry search for
it, as a HD search had negative results...
 
A

André Gulliksen

Jim said:

From what I understand of this link somebody else has a problem with the
connection to internet going down, and all the info is a dump of all
relevant system info, including startup programs and services. The file
troubling our OP is listed as 'jatmlano:
\??\C:\DOKUME~1\Knista\LOKALE~1\Temp\jatmlano.sys (manual start)' under
services.

I must agree that the location (temp) looks suspicious. Also, the file
reappearing after deletion may suggest it is just one of several points of
infection. It may be a malicious, but recent and/or very little widespread,
virus or other form of program. If a virus is not very widespread it may not
be a big priority for AV companies to make a cure for it.

I would make a _thorough_ manual scan of all startup points in your system,
including registry, services and even the Start meny startup folder. Also
check running processes. Do a Google search on every single item you can't
immediately recognize. The HijackThis logfiles provided in the link above
can also be a good point for cross reference.
 
D

delta

From what I understand of this link somebody else has a problem with the
connection to internet going down, and all the info is a dump of all
relevant system info, including startup programs and services. The file
troubling our OP is listed as 'jatmlano:
\??\C:\DOKUME~1\Knista\LOKALE~1\Temp\jatmlano.sys (manual start)' under
services.

I must agree that the location (temp) looks suspicious. Also, the file
reappearing after deletion may suggest it is just one of several points of
infection. It may be a malicious, but recent and/or very little widespread,
virus or other form of program. If a virus is not very widespread it may not
be a big priority for AV companies to make a cure for it.

I would make a _thorough_ manual scan of all startup points in your system,
including registry, services and even the Start meny startup folder. Also
check running processes. Do a Google search on every single item you can't
immediately recognize. The HijackThis logfiles provided in the link above
can also be a good point for cross reference.


I have tried to recreate its appearance by running specific
programs I had running when it had appeared..and of course I cant get
it to show up again...I'm still trying..!! Thanks All !!
 
D

delta

From what I understand of this link somebody else has a problem with the
connection to internet going down, and all the info is a dump of all
relevant system info, including startup programs and services. The file
troubling our OP is listed as 'jatmlano:
\??\C:\DOKUME~1\Knista\LOKALE~1\Temp\jatmlano.sys (manual start)' under
services.

I must agree that the location (temp) looks suspicious. Also, the file
reappearing after deletion may suggest it is just one of several points of
infection. It may be a malicious, but recent and/or very little widespread,
virus or other form of program. If a virus is not very widespread it may not
be a big priority for AV companies to make a cure for it.

I would make a _thorough_ manual scan of all startup points in your system,
including registry, services and even the Start meny startup folder. Also
check running processes. Do a Google search on every single item you can't
immediately recognize. The HijackThis logfiles provided in the link above
can also be a good point for cross reference.



I found it in the registry under software/ATI tecnologies/device/0
...Following the keys values it deviceitem 0065 non-plug and play items
driver...I have an ATI card. It also shows up in the registry under
root/legacy_jatmlano...I don't know what it is but it doesn't look
like a virus...
 
D

delta

Not to beat a dead horse but that jatmlano.sys only appears in the
temp file when I play halflife 2.. It still wont delete until I
reboot, but I think it had to do with my ATI card..Anyone playing
Hlflife 2 that can look in their temp file(s) for it..??
 
N

Norman R. Cross

The page appears to refer to the file being found in a log file for
something called HijackThis. Did a search for that and found that
HijackThis is a detector and remover for browser hijacker programs (those
that hijack your home page).
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top