Member Avatar for vickerps

Hi i recently had the Teekids virus on one of the computers i manage. I used the laster stinger.exe to clear the virus and cleared system restore. However i have just notice that there is a file in the prefetch directory. I have read up on the prefetch directory and found that it like a cache for frequently used programs. However what is unclear is is the file in the prefetch directory a complete file i.e the virus it-self or is like and index file (meaning it harmless.)

Any help would be great.

  • 2 Contributors
  • 2 Replies
  • 268 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by vickerps

Dani AI

Generated

Follow-up note tying together and : the Prefetch entry left behind is a trace of execution, not a duplicate of the TeeKids binary. Prefetch (.pf) files store structured metadata (execution timestamps, a run count and lists of files/DLLs the process touched) plus a short content hash used in the filename. They are useful for timeline/forensics but are not an executable payload and cannot “run” by themselves.

Practical checklist to be confident the machine is clean:

  • Search the whole disk for any actual copies of TeeKids.exe (Program Files, %APPDATA%, %TEMP%, and the root of drives). A lingering .exe is the real risk.
  • Enumerate persistence points: Startup folder, HKCU/HKLM Run keys, Services, Scheduled Tasks, browser extensions and shell hooks. Sysinternals Autoruns makes this quick.
  • Perform at least two full scans with up-to-date engines (main AV + a second-opinion scanner such as Malwarebytes). For suspected rootkits, use an offline rescue disk scanner.
  • If system restore was cleared (as noted), check shadow copies or third-party backup locations where the binary could persist.

Handling Prefetch files and forensics:

  • Deleting the single TeeKids*.pf is safe; Windows will recreate prefetch entries if the executable runs again. Deleting prefetch files does not remove malware.
  • If preservation is needed for investigation, copy the .pf file before removing it. Tools like WinPrefetchView can extract the run timestamps and module list for timeline analysis.
  • Use administrative tools (Autoruns, Process Explorer, Event Viewer) to correlate the prefetch timestamps with process creation events before concluding the system is fully cleaned.

Summary: the .pf file itself is an evidence artifact, not the infection. Confirm absence of the actual executable and other persistence mechanisms, and run layered scans to be sure the system is clean.

Recommended Answers

All 2 Replies

Member Avatar for gerbil

No, it cannot be used by a virus to attack your computer, unless the virus wrote a file in there [NOT a .pf file] and then called it from some other location. If a virus process or a trojan once ran then xp would create a prefetch file for it so that next time it was run it would load more quickly! Heh. But the .pf file on its own is benign. If you feel uncomfortable about it you can just delete that file.....

Member Avatar for vickerps

Thanks Gerbil

That is exactly what i wanted to clarify. I informed this to the user but just wanted a second opinion

Thankyou

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.