Go Back   Hardware Canucks > SOFTWARE > O/S's, Drivers & General Software

    
Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old June 30, 2008, 08:17 PM
MVP
 
Join Date: Apr 2007
Posts: 292
Default EFA DATA?????????

i usually peek inside system volume information once in awhile to see whats in there.
i have 8, yes 8 hard drives.
today on the 7 after the "C" drive i found a folder called EFA DATA. inside the folder i found a file called efadata.db

since i have never seen this file in all my days of computing i tried to delete it. what a surprise that i couldnt. i went to safe mode and could only delete it after i changed permissions.

has anyone else seen this name before?

just curious

thx

rob123
Reply With Quote
  #2 (permalink)  
Old July 1, 2008, 08:46 AM
Jack Rabbit's Avatar
Allstar
 
Join Date: Sep 2007
Location: Toronto, ON
Posts: 784

My System Specs

Default

Download Filemon.exe from Microsoft (was Sysinternals) and see if you can find out what process is using. The boot from a Linux live CD and see if you can delete it. If neither goes well start breaking out the rootkit detection software.
__________________
He either fears his fate too much, or his deserts are small, that dares not put it to the touch, to gain or lose it all.
- James Graham
Reply With Quote
  #3 (permalink)  
Old July 1, 2008, 10:22 AM
3.0charlie's Avatar
3.0 "I kill SR2's" Charlie
F@H
 
Join Date: May 2007
Location: Laval, QC
Posts: 9,600

My System Specs

Default

Usually google is your friend when finding "odd" files... but this time around, there is only one hit, and that is your own thread. Keep us posted.
__________________
Hydro-Quebec is salivating...
Reply With Quote
  #4 (permalink)  
Old July 2, 2008, 06:38 PM
MVP
 
Join Date: Apr 2007
Posts: 292
Default

as you say i cant find any reference to efadata.db on the web, i have never seen them before or since. as i said i deleted them in safe mode.

the only thing i have did this weekend that i have never done was to go into the regedit and force a name change for one of my hard drives. windows had for whatever reason picked the letter "J:" for the system drive. this led to numerous problems with windows update. so i forced the name change and ended up doing a reformat (again). i also elected to put service pack 3 on and all other high priority windows updates.

i think either the name change or the service pack 3 had something to do with it.

i scan nightly with updated spybot and norton. i am also behind 3 software and 1 hardware firewalls. i also have norton set to scan continuously for virus like activities. for years now i have removed system volume information from the exceptions list. i do not think it was an infection. probably some new thing from microsoft.

in any case the files have not reappeared.

will continue to look for info

thx

rob123
Reply With Quote
  #5 (permalink)  
Old July 2, 2008, 06:42 PM
sswilson's Avatar
Moderator
F@H
 
Join Date: Dec 2006
Location: Moncton NB
Posts: 14,238

My System Specs

Default

Just a shot in the dark, but is it possible that it's tracking information for the drive letter change? (i.e. program X tries to access something on "j" drive, XP redirects it to "c" drive and writes a report for registry to automatically redirect the query).
__________________
EVGA X58 3X SLI / i7 980X / 3X 4G Mushkin Blackline Frostbite / XFX Pro 1000W / EVGA GTX 680 SC+ 2GB / Intel DC S3700 200G / WD 6401AALS / TT Lvl 10 GT
Swiftech MCP655 WC Pump / EK XT 240 Rad / 2X Scythe Ultra Kaze / EK Supreme HF / Primochill Myriad Dual Bay Res / Dell UltraSharp U2412M

Gigabyte C1007UN-D / 2X4G Gskill PC3-10700 / Pico PSU / 2.5" 750G Toshiba HDD / Mini-Box M350 / 1X 19" BenQ / 1X 17" HP
Reply With Quote
  #6 (permalink)  
Old July 3, 2008, 06:27 AM
Jack Rabbit's Avatar
Allstar
 
Join Date: Sep 2007
Location: Toronto, ON
Posts: 784

My System Specs

Default

Quote:
Originally Posted by rob123 View Post
as you say i cant find any reference to efadata.db on the web, i have never seen them before or since. as i said i deleted them in safe mode.
Ooops, sorry. I read that wrong.

Yeah, if you do not have one disk with one partition on it then Windows installer can do weird things.
__________________
He either fears his fate too much, or his deserts are small, that dares not put it to the touch, to gain or lose it all.
- James Graham
Reply With Quote
Reply


Thread Tools
Display Modes