Desktop

Ask something
Discussion Locked

Malicious code filling windows temp dir.

0 helpful
4 replies

by jsaccomandi

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Only a couple of strategically placed pcs have Internet access here. Those pcs from time to time suffer from congestion of the windows temp directory. Files will be created up to 30,000 before the pc slows to a halt. The files will be around 10 or 30 Kilobytes so they may accumulate to about 900 MB which won’t fill the drive but will drastically slow the pc. The files are similar to “TM2B7E37.TXT”. The name portion seems to count up in hexadecimal format. The extension changes between TXT and HTM and GIF and lots of other valid file extensions. If you view the files they always seem to have some valid info like Microsoft Internet Explorer update pages or gifs of popular web sites. Norton Antivirus with the latestvirus definitions doesn’t find anything even set to scan all files.
At first I thought one of our users was trying to install Netscape Communicator and it went haywire repeatedly expanding its files over and over again because that’s what the temp files looked like. Is anyone else out there seeing this problem? I created batch programs, which clear the temp directory upon login and boot up so I’m not getting problem calls anymore but I sure would like to know if anyone withmore time on their hands was able to determine what the cause is. The way the temp directory is filled with files in such a short amount of time is malicious at best. The computer performance is also degraded while the process is happening. Thanks, John

4 replies

by dklippert

Are these temporary Internet files? You can DL a copy of Tweakui. It will allow you to set the machione for "Paraniod" and will delete all these files. You can go to Tools>Internet options, and set where you would like the files stored and be able to delete them.
On the settings tab you can choose what amount of disk space to allow.

by jsaccomandi

DKlippert - Thanks but you didn't answer the question. I am trying to determine the cause of the rapid accumulation of files in the temp directory. I am familiar with tweak and it's settings.

by rcom

You may have done this but, have you checked to see if something is starting in startup folder or startup section of "msconfig.exe" utility or in the win.ini file under load= or run=. You may also be getting a high amount of ".tmp" files in the rootof the Windows folder.

Here's a thought,

Try switching the path for the TEMP folder to another location. that way if the code is written to save the files in C:\Windows\TEMP then that may help in isolating the problem. This can be done changing the environment settings in msconfig.exe.

by jsaccomandi

Thanks RCOM, I had already checked those locations and the registry and didn't find anything suspicious. I don't think changing the windows temporary file directory location would help. Windows would place it's temporary files in the new location,the rogue code would most likely follow the environment variable but even if it still placed them in the hard coded c:\Windows\Temp folder I still would be no closer to being able to identify the source. I failed to mention that these are all Windows 98SE pcs which don't have file auditing capabilities.

This discussion is closed to new replies.