Windows XP forum: Huge TMP files in Windows\Temp

My own C:\Windows\Temp folder has just a few entries that seem to be log entries, eg

MpCmdRun.log is a log for Windows Defender.
WGAErrLog.txt is a log of Windows Genuine Advantage, and
ZLT01a91.TMP where the a91 are random characters are logs of my ZoneAlarm firewall.

Do you have similar logs, and do you use ZoneAlarm and any virus/spyware scanners?

Mark

Hi Peter.

Everything that's been suggested here is good, especially CCleaner. But CCleaner will only clean out these temp files every time you run CCleaner.

I think you have got to hunt down the process that is producing these. It seems FileMon doesn't work for your system without difficulties, so you will need to do this manually. It might mean hard work.

The way I would do this is a step by step process.

1] I would run my anti-virus and all my anti-spyware utilities in Safe Mode. If there's an infection it is more unlikely to load in Safe Mode. Then back in normal mode I would run to online scans at Housecall, (anti-virus), and Ewido, (anti-spyware).
http://housecall.trendmicro.com and http://www.ewido.net/en/onlinescan/ (You need Internet Explorer for the Ewido scan).

Remove everything they find.

2] I would try and open one of these PR files, preferably the smallest, using Wordpad. Notepad may not do the trick because of the sizes of the files, but Wordpad is Notepad's big brother, and will open anything, Wordpad should be in your Start menu > All Programs > Accessories folder. If not, search for wordpad.exe.

See if any of these files give a clue which process/application/utility is producing these.

3] Review all your System Tray icons, (near the clock), open up each application and check to see if they are producing and saving logs. EG my ZoneAlarm firewall produces logs of intrusion attempts, etc.

4] Check every running process in the Task Manager. http://www.answersthatwork.com/Tasklist_pages/tasklist.htm will help.

5] Open up the System Configuration utility, (Start > Run, type in msconfig, click OK), and check the Startup tab for anything that looks suspicious. Google will help.

6] The last option is a HiJackThis log, (HJT). But we will look into that if necessary.

Whatever is doing this is running in the background. That means it must be listed somewhere.

Good luck, and let us know how it goes.

Mark

That was found by google. Unluckily, one of the 2 hits was yours, and the other one was in Polish, but it's obviously exactly your issue. Have a look at http://forum.purepc.pl/lofiversion/index.php?t137288.html

My knowledge of Polish is zero, but I get the impression it has to do with something called looksmart. If that's on your system indeed, better visit our Virus and Security Forum and tell the story there.

Hope this helps.


Kees

I'll paste some of the highlights:

C:\WINDOWS\Temp pliki PR3DF.tmp ktry zajmuje 670mb, PR4C5.tmp 400mb i PR21C.tmp 300mb można je usunąć?

Suspected files from hijackthis log:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.looksmart.com/p/search?pi=lstb2&tv=1
O2 - BHO: XBTB01232 - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\Programy\LOOKSM~1\tbuD47\toolbar.dll
O3 - Toolbar: LookSmart Toolbar - {CC8C8F4F-F2E8-404B-A43D-5CC57876A008} - C:\Programy\LOOKSM~1\tbuD47\toolbar.dll
R3 - URLSearchHook: LookSmart Toolbar - {CC8C8F4F-F2E8-404B-A43D-5CC57876A008} - C:\Programy\LOOKSM~1\tbuD47\toolbar.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-its:mhtml:file://c:\nosuxxx.mht!http://www.kazaalite.pl/stats/loudklite.chm::/bridge-c46.cab

Shows a Looksmart search assistent and toolbar and BHO (browser helper object), use of P2P (kazaalite). See if you have these files and this BHO (=IE add-on, can be managed from Tools>Addons).

Hope this helps.

Kees

C:\Documents and Settings\Admin\Local Settings\Temp\bridge-c46.cab

Hi Mark, hi Kees, and everyone who has helped with this. Here are a link to some screen caps of these files, one of which is an excerpt of the content in a hex editor.

http://www.putfile.com/activate.php?username=prvk&activate=x6h4ox

Note the date and version of my email program in the content. It is a very old date, and a much older version of Agent than I am using now.
I have no idea why these files are being genterated. Even after running full scans with Kaspersky, CounterSpy, Housecall and Ewido, I am still getting these files. Do you think a grenade might help? :-/

Peter

Hi Mark.

I copied the links they provided, which obviously didn't work. Putfile's site isn't exactly an easy one to navigate. Try these new links. There are two pics. One is a hex dump of part of one of the files. Hopefully they will work. These file appear somehow to contain my old emails. How strange. Agent has a user's list. I think I'll post there and see what the Agent gurus think. I'll keep you posted. Thanks again for all your interest in this.


http://www.putfile.com/pic.php?img=5847126
http://www.putfile.com/pic.php?img=5847125

Peter

>Do you recognise anything there? EG, From prvk@earthlink.net, "Hi >Bart, Good God 15 tons...."?
Oh yes! I recognised it as mostly old email, although in one of the files, I saw more recent stuff.

>If not then there appear to be two possibilities.
>2] Your computer is a zombie, sending out spam email.
>I fear the 2nd may be true.
I too, fear this. I just need to find out how to fix the problem.

>Tell us more about what you use to defend the computer from hackers, >viruses and spyware.
I'm using Kaspersky Internet Security Suite 6.0. It dowloads new updates every three hours, and the latest database was at 6:30 this morning. I'm running CounterSpy V2, which updated yesterday.

>I would, as soon as possible, get two online scans done, an >anti-virus at Housecall, http://housecall.trendmicro.com
>and an anti-spyware at Ewido, http://www.ewido.net/en/onlinescan/
>Let them remove everything they find.
I've done all this, per your previous suggestion. Not much of anything was found.

>Then update your own anti-virus and anti-spyware definitions, and in >Safe Mode re-scan with them, one at a time. In Safe Mode viruses and >spyware cannot normally get a hold. Delete everything they find.
Again, They are fully updated and functional, have been run in safe mode, and reported nothing.

My email proggy, Forte Agent, which I've been using since 1994, has been bullet-proof all these years, has a users' forum, and I've posted there asking for ideas and suggestions. Eventually, this will be solved, and I'll post accordingly.

Thanks again for all your help.

Peter

Hi Mark.

I'll follow your suggestion and report back. As regards Agent, the files appear with or without Agent being open. I have not received a reply from the Agent users' group yet. I have to go to town now, and probably won't get a chance to reply again until late tonoght or tomorrow. Thanks again, very much.

Peter

Thanks Kees. I've d/l'ed it and will report on it's use.

Peter

You can get CCleaner Slim or Basic (other builds) which cleans out many & varied unnecessary file build ups. These versions are 100% adware/spyware free.
One of it's options is defaulted to "only clean Windows Temp files older than...." You can uncheck this option and it will wipe Windows Temps each time you run it. Normally less than 5 seconds except FIRST run which can take awhile as often 100's of megs need initial cleaning. This "uncheck" is also used when an infection has located itself in Temp files as a base to operate from.
Not a cure but a good product to have & use daily & it's free!!

Additionally, add the download page below to your IE Favorites or Bookmarks list and use it to check for updates about once per month.
In "Options", click on "Settings" and uncheck:
"automatically check for updates" to prevent getting an undesirable (adware toolbar) version from built in updater link.
Link for CCleaner SLIM & Basic:

http://www.ccleaner.com/downloadbuilds.asp




Help file (descriptions of items to be cleaned) to print out (click left side Cleaner Information):
http://www.internetrotsyourbrain.com/ccleanerbeginnersguide/

This will at least be an immediate help and a good long term utility.
Note: CCleaner must be run on EACH DESKTOP (if more than 1 user) since you wouldn't want to accidentally erase info from another user.

Hope this is helpful.

In the ZDNet Tech Update Today newsletter;
http://ct.zdnet.com/clicks?t=39102598-36ff5ffe2542924797270bdbdae78950-bf&s=5&fs=0

(I'm not sure if you need to register for this newsletter, so I have copied the relevant part below).

It is about archiving emails in Outlook, and how Outlook archives emails onto the hard disk. Although Forte Agent is different to Outlook, I just wonder if there is a similar process. Here's the article;

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When you archive your Outlook email you probably suppose that your data is now safer than it was. After all, isnt archiving all about placing something important in a safe place?

Many of us run our business lives on email. So losing a few years worth of email is traumatic.

The sad truth is that archiving your Outlook email makes your data less safe. Heres why and how to fix it.

Archiving is convenient - for other people
If your company has an Exchange server, and far too many do, your sysadmin may be after you to reduce the size of your mailbox by deleting or archiving old emails. Exchange doesnt handle large mailboxes well. Many large mailboxes are even worse: recovery can take days.

When you archive email, Outlook deletes the email on the server, which makes your sysadmin happy. But where does it put it? Somewhere safe?

No. It puts your vital email on your hard drive. One crash and POOF! All your old email is gone. Forever. Hard drives crash, usually without warning. Ive had two hard drives crash in just the last week.

How to check for at-risk archives
It is easy enough to check where your archives are stored. From within Outlook

* Go to File
* Select Archive . . .
* At the bottom of the dialog box it should say Archive file: followed by a location. If that location is on your C: drive, your archives are at risk.

Dont bogart that mail, my friend, pass it over to me
If your archives are on your local hard drive you should make copies. The easiest ways to copy them are onto a USB flash drive, a second hard drive, a network drive (if you have one) or burn them to a CD or DVD and take them home.

It is possible that your company network backup system is saving your archives. Backups often fail to save data, but check with your sysadmin anyway.

Is Microsoft to blame?
I think so. Microsoft, as usual, is tone deaf to the needs of end-users. How hard would be it be to suggest in the archiving process that people should copy their archives?

Compare Microsofts behavior to Apples new Time Machine, coming out in the next version of OS X this October. Time Machine explicitly requires that you set it up with a second hard drive.

The first time you attach an external drive to your Mac, Time Machine asks if youd like to use that drive as your backup. Say yes and Time Machine takes care of everything else. Automatically. In the background. Youll never have to worry about backing up again.

I guess Microsoft was too busy getting WGA to sort of work to worry about fixing problems that actually matter to customers.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Possibly the same is happening to your emails?

Mark

"They appeared just minutes ago". Very strange m8.

What was running in the Event Viewer then?

Mark

This is all getting a bit messy now isn't it.

1] CCleaner.

In CCleaner you can see the list of cookies held on your system. I don't know if you know what cookies are, but they are little text files that help remember log-on details amongst other things. CCleaner will delete them all, but you can tell it to save any that you want. Under Options > Cookies, the ones you have are listed on the left. Move those you want to keep, (eg CNET, etc), to the right.

2] Add/Remove Programs. It looks like your Add/Remove Programs dialog isn't working.

Check if CCleaner has it listed in it's own Add/Remove programs. If not, look at this link;
http://support.microsoft.com/?kbid=266668
Not your problem precisely but it may help.

3] Roxio.

It seems Roxio is trying to finish the install. What would happen if you let it, then tested it, and if you want to remove it either try the Control Panel's Add/Remove Programs or CCleaner's option.

If you don't want to try that, hunt down any Roxio entries in the registry for "Run, RunOnce, RunServices, RunServicesOnce". These control what programs attempt to load at startup. This article may help;
http://support.microsoft.com/kb/179365

A re-install may be better in the long run if you are comfortable with that. Just a note though. If you do decide to reinstall, prepare a CD with firewall and an anti-virus installation files on it, so that when you have done the reinstall you can install those before you connect to the internet

Mark

That's one less worry then. Nice work

Mark

Which burning software did you use, and which version?

If it is Roxio 6, have a look at this forum;
http://forums.support.roxio.com/index.php?showtopic=10875
See if that helps. {Note, where Win-Pause is mentioned, that means press the Windows key and the Pause key together}.

If this was me, I would have uninstalled the CD Burning software, rebooted the computer, then installed the newer version. I'm not sure if that's how you did it.

If still no joy, try CDBurnerXP Pro from http://www.cdburnerxp.se/download.php a free utility.

Mark