Printable View
Me again, another mystery:
I have a file called Layout.ini that appeared at 4:06 this am under user Administrator - Administrator is only accessible in my XP through safe mode. The first line is OptimalLayoutFile and it lists pages and pages of exe files...A Google search provides REALLY confusing info, can anyone help? :)
Hi
Your not being hacked...it's your system doing what is normally called "Prefetch" of files:
Quote:
The operating system keeps a log of which files are needed at application start up and which data files are typically used (for example, a certain spreadsheet that is regularly used when Excel is booted). When the app is started, Windows XP looks at this list of files and seeks all of them at once. In so doing, it can consolidate disk seeks optimally and reduce head movement. So rather than thrashing the disk, application launch process now minimizes disk seeks.
To enhance this process further, Windows XP will moves the files around on your disk during lulls in computing activity. For example, it will reposition all files used in starting up your favorite browser and place them in contiguous blocks on the disk. This way, in just a few disk seeks, the entire application can be loaded. And to reduce head seeks even more, it places these blocks as much as possible on the outermost sectors of the disk, so that the heads have to travel as little as possible.
Whatever you do, do not delete this file, can be a pain to recreate....Quote:
Layout.ini is what keeps track of this....
XP keeps track of files used by every application. After several launches
of the same application, it has some sense of what files are required.
Thereafter, it uses an algorithm that says, basically, if a file has not
been used in the last six launches, it is marked for removal; if a file has
been used in the last two launches, it's marked for inclusion. Then based
on these notations, Windows XP determines which files need to be brought
into the block, and which ones moved out. When this move will take place
depends on several factors, such as how recently files were moved for this
application, and when the machine is available? Consistent with the idea
that disk activity should not interfere with performance, Windows XP won't
move the application files unless there has been no user-initiated I/O
activity for 13 minutes. Microsoft presumes this means the user is away
from the machine. It then begins migrating the files to the optimal place
on the disk.
Windows
Info on Prefetch
My first guess would be that the system was rebooted at the file modification time. Perhaps the disk was defragged. This file is used by XP's prefetch system to "index" applications and their files.
www.edbott.com/weblog/archives/000024.html
and it looks like by default windows updates that layout.ini file every three days. Look at the following link, under Disk Efficiency Optimizations
www.microsoft.com/whdc/system/sysperf/benchmark.mspx
Okay, that helps. But why did it occur under Administrator? I've never seen that before and I check daily. Is it an automatic process - not user-initiated?
afaik..the Admin account is all powerfull...hence can backup settings from other accounts.
If it doesnt run as admin it would not have the needed permissions to access all the files and folders, settings on the disk....
MLF
morganlefay - does it run automatically?
It will if the Task Scheduler has the setting's set to run at a time specified by the user.
Task Scheduler
User Profiles
Luck
Scheduled Tasks shows only Easy Internet Signup - I'll check all users and come back this pm - by the way - thank you!
Why on earth is "Easy Internet Signup" a scheduled task?
Jennifer, scheduled tasks run at the same security level as the administrator... Thus they can do anything they like. If you right click the task you can select properties. Please tell me what it says it runs on this schedule...
AFAIK....it is part of the way the operating system functions...so it is automatic...created by the system...not sure if it is a configurable optionQuote:
morganlefay - does it run automatically?
I have this file in my c:\windows\prefetch directory....not in my admin profile....but I am also running XP Pro...not home
Tiger is right....why would easy internet setup be scheduled????
MLF
Don't they really run as "System" which is more powerful? I've used the at command before to schedule a cmd window to popup and when it does I can then use it to kill off tasks that the local administrator account does not have access to. Nothing more fun than scheduling a cmd window to popup 1 minute into the future, because that window is truely god on that computer ;)Quote:
Originally posted here by Tiger Shark
Jennifer, scheduled tasks run at the same security level as the administrator... Thus they can do anything they like.
jcjz:
You are absolutely correct... However, I'm fairly confident of Jennifer's understanding of her OS and deemed it best to put it in terms that I knew she understands.
Jennifer:
jcjz is correct... System is the most powerful account on your computer and the scheduler runs in that context... So, what is running with that sceduled item? Inquiring minds need to know... It _might_ help explain some other things we have discussed... ;)
Hey guys, sorry for the delay, baby had a dr. appt.
Properties shows that the file was created the day after the destructive recovery (remember that fiasco) and that it was modified at 4:06 this am.???
Hubby is home, I'll be back later.
You guys are the best.
Jennifer... What is the file name and extension?
Tiger Shark - "layout.ini"
I'm checking on the scheduled tasks...
Thank you all for being patient with my limited skills -- I'm learning, or leaning....
Okay, I checked as Administrator (in safe mode) under scheduled tasks. All it shows is "Add Scheduled Task" and "Easy Internet Signup", the latter shows it has never been run... There must be another place to check - I'm looking in Accessories/ System Tools/Scheduled Tasks. ???
The midnight oil is spent and so am I, see you all tomorrow.
I lied, I'm back.
Tiger Shark, I just realized I didn't answer your question: There are four files noted
ntuser.dat.log in c\documents and settings\guest (an account that hasn't been used in weeks); the next three are in c\windows\prefetch - Layout.ini, DEFRAG.EXE-2858C7E2.pf, DFRGNTFS.EXE-38C3807C.pf.
Does that reveal anything?
What is the exe and path to that exe that is set in the scheduled task? Looking here at some HiJackThis logs people have posted, it looks like a legit HP application.Quote:
Originally posted here by jenniferaloette
Okay, I checked as Administrator (in safe mode) under scheduled tasks. All it shows is "Add Scheduled Task" and "Easy Internet Signup", the latter shows it has never been run... There must be another place to check - I'm looking in Accessories/ System Tools/Scheduled Tasks. ???
The midnight oil is spent and so am I, see you all tomorrow.
forums.spywareinfo.com/lofiversion/index.php/t43413.html
Here's some info on hpsdpapp.exe
hpsdpapp
Most likely you can just disable or delete that from your scheduled tasks. Personally, from what has been posted in this thread, you haven't been hacked. It looks like the layout.ini and the .pf files you posted are legit.
Most if not all OEM HP/Compaq's will have this process of Easy Internet Signup if you go past the install screen where it asks you what internet connection you have (Select/LAN/Modem/Later) if you decide to chose later, on the welcome screen after the install starts you will probably be prompted to connect to the internet via the Easy Internet Sign up Wizard.
It is probably set to run as a scheduled task until such time as it is removed.
TheIs from a Defrag that was either scheduled or done manually, and if you refer to post#2, there is some information there about Prefetch and about the layout.ini fileQuote:
There are four files noted
ntuser.dat.log in c\documents and settings\guest (an account that hasn't been used in weeks); the next three are in c\windows\prefetch - Layout.ini, DEFRAG.EXE-2858C7E2.pf, DFRGNTFS.EXE-38C3807C.pf.
Luck
;)
I believe that this could be a legitimate task but two questions nag me:
Where should I search for this task if it is scheduled?
Why did the guest account show activity at that time and none of the other accounts?
You should be able to go to Control Panel and select the folder marked scheduled tasks, open that and it should show you an icon to "add scheduled task" and if there are any scheduled they will appear underneath.
Click on the scheduled task and a window will open with 3 tabs Task/Schedule/settings
Under the settings tab you can check the box marked delete the task if not scheduled to run again.
In the schedule you will see when it is set to run.
In the task tab in the box "run as" is where the account responsible for running the task has been identified, and under that is two boxes "run only if logged on" and "enabled(scheduled task runs at specified time)"
If the "guest" account was the account used to login, it may have defaulted to the task settings for the scheduled task..... ;)
dalek - That's the thing. There is no scheduled task called Layout.ini. All that's listed in Scheduled Tasks is Easy Internet Signup and it says it has never run....so where and how did this task initiate? Should I look somewhere other than the usual places? According to what you say, I should have already found it if it is an automatic task. It's difficult to believe that someone got out of bed at 4:06 am just to run this one task...what would be the purpose?
When I searched Google for Layout.ini and "OptimalLayoutFile" (the first line of text) there was one entry that showed the exact exe files that my file lists. This entry called Layout.ini an unfriendly ("subversive") file. I'll go back and get the specifics, but do you see why I'm concerned? The morning I found this activity, the computer had been left idle with one user (hubby) still logged on from the night before. Recognizable activity stopped around midnight, then those four files at 4:06 am, then my logon. It just seems weird.
Hi
The layout.ini file is part of the "prefetch" function with Windows XP, all it does is reside in the folder C:\Windows\Prefetch in this folder you will see all of the programs or applications which have been prefetched by WinXp, amongst these files will be a file called“layout.ini” file it is a consolidating of all the files in your prefetch folder. And sets the parameters for prefetching boot priorities. This file is okay and should not be removed, unless you are familiar with doing a repair of the prefetch folder.
The application or Wizard "Easy Internet Signup" may have been scheduled to run at some point...did you check the settings for this program, it should tell you what account used it and when, AFAIK it is only for setting up a new internet connection on a repair/recovery or fresh install of the OS, usually by HP/Compaq's, it may even have been set to run as part of the initial login, and maybe the guest account being used for the first time prompted the startup of the Wizard?
I would say it's benign and is a leftover from the recovery process you just went through and I would ignore it or plain remove it from the Task Scheduler.
The Prefetch function is a normal process for WinXP... Prefetch Info
Hope this helps. ;)
Thanks dalek!
You're right about the Easy Internet Signup. I was never concerned about that task - it became an issue because it is the only task scheduled in the Task Scheduler.
I _am_ concerned about the Layout.ini file (I do understand that it is a normal function of Windows) because a) it has never run before, b) it doesn't appear to be a scheduled task, and c) the three other files generated at the same time - particularly the hit on the guest account as I related earlier.
Is this a dead horse?
Hit it any more and it will be considered necrophilial animal abuse... ;)Quote:
Is this a dead horse?
Hi jenniferaloette
What TS said.... :D
The file in question is okay..... ;)
HAve you done a search for other Layout.ini files on your PC?
Its normal location is the Prefetch folder.. if it has landed else where, and as you say the guest account was active on the same date /time that this file was created.. I suspect that this file may have been "moved" in or about due to what ever your big crash was..
While the Prefetch service NEEDS the task scheduler..IT ISNT and WONT be listed in the Scheduled tasks..IT IS A SYSTEM SERVICE..and it uses the resources of the Task scheduler to do its job.
My advice.. Your right..at the moment your beating a dead horse..
1/ If there is a legit Layout.ini in the windows\prefetch folder (I wager that there will be) then rename this ring-in Layout.ini to SUS-layout.ini (you could even open the file and compare the contents you will most likely find they are similar). then
2/ come back in 3 or 4 days and check for a new version of that file, check your guest account for activity..
But most importantly.. dont panic.. if it hasn't been accessed since that time, and the same goes for your guest account (disable it to by the way.. you dont need it).. during some hangups (i am not up to speed on your other problem) all manor of things happen
Und3ertak3r- that helps, and you can bet I'll keep an eye on it. The guest account has been turned off for weeks by the way...that's another mystery I suppose.
Hey Tiger Shark, I think you've diagnosed my entire problem: post mortem equine abuse addiction! :)
Thanks everyone, from the bottom of my paranoid heart.