OT: strange files in %TEMP

May 20, 2008
11,400
99
Syracuse, NY, USA
This is way off-topic, but with all the experts here ...

On my home computer (Win7/32), **every** time I start an EXE which does not reside in the c:\Windows tree, I get the likes of this in the %TEMP directory.
Code:
20:40:57.996123  CREATE  TMP000003B87C0F2266F9A64046
20:40:57.996288  MODIFY  TMP000003B87C0F2266F9A64046
20:40:58.020166  DELETE  TMP000003B87C0F2266F9A64046
The files are exactly 512K (2^19) in size and are owned by NT_AUTHORITY/SYSTEM. They allow no sharing so I can't read/copy them. I tried denying "SYSTEM" the delete privilege in %TEMP (so I could look at one) but they're deleted anyway.
This **never** happens on my work computer, also Win7/32, and set up quite similarly.
I tried stopping several services that I could do without; that made no difference.
Does anyone have any ideas what they are or how I might get a look at one?
 
Jun 2, 2008
359
4
If you yank the power cord while some are there, do they stay there when you boot it back up?

This makes me wonder what your .exe file associating is like...
 
Jun 2, 2008
359
4
Code:
20:40:57.996123  CREATE  TMP000003B87C0F2266F9A64046
20:40:57.996288  MODIFY  TMP000003B87C0F2266F9A64046
20:40:58.020166  DELETE  TMP000003B87C0F2266F9A64046
What is that output from? SysInternals' Process Monitor? If so, what process does it say is doing that?
 
May 20, 2008
11,400
99
Syracuse, NY, USA
If you yank the power cord while some are there, do they stay there when you boot it back up?

This makes me wonder what your .exe file associating is like...
They don't exist long enough for me to even think of the power cord.
 
Jun 2, 2008
359
4
Oh.. sorry, I missed the interval. Wow, so they don't even stick around 'til the .exe is closed. Process Monitor should be able to catch anything since it monitors in real-time. The trick is to define the right filter to catch just that stuff and nothing else. Looking for the string \temp\ in the "Path" would probably do it.
 
Jun 2, 2008
359
4
Correction, "\temp\TMP" (no quotes) would be a good string to look for. There are lots of "\temp\" accesses just because of Process Monitor itself that you don't need to see.
 
May 20, 2008
11,400
99
Syracuse, NY, USA
Oh.. sorry, I missed the interval. Wow, so they don't even stick around 'til the .exe is closed. Process Monitor should be able to catch anything since it monitors in real-time. The trick is to define the right filter to catch just that stuff and nothing else. Looking for the string \temp\ in the "Path" would probably do it.
According to ProcessMonitor, the file is created by an instance of svchost.exe (secsvcs/WindowsDefender) which immediately creates a file mapping of it. A split second later, Explorer tries to access that file, but it is gone by then. Oddly, WinDefend also runs on my work computer (where this doesn't happen) and there, it has the same "real time protection" settings.
 
May 20, 2008
11,400
99
Syracuse, NY, USA
Mystery solved (I guess). I don't know exactly what WinDefend does but I guess I should be glad it's protecting me. On the home computer, TMP and TEMP refer to the same place for both the user and the system, so I see this behavior in my usual temp folder. On the work computer, the system environment variables TMP and TEMP point to the default (\Windows\Temp) which differs from the user temp folder. When I watch \Windows\Temp on the work computer, I see the same behavior. Thanks, TEA-Time, for suggesting ProcessMonitor. I had forgotten about it.

FWIW, stopping WinDefend eliminates this behavior and does not affect the startup time of apps at all (tested with TCC).
 
Jun 2, 2008
359
4
Aha.. interesting. I enabled Windows Defender on my Win7 64-bit machine and I saw it once, but now I can't get it to happen again. :-/
 
Jun 2, 2008
359
4
Uhoh, I think we brought the site down... Sorry Rex! Heh

No problem, Vince. I can't live without SysInternals' utilities!

-Tim
 
Similar threads
Thread starter Title Forum Replies Date
vefatica Strange behavior reloading SHRALIAS sav files. Support 1
R strange bug? Support 7
Jesse Heines Strange Line Wrapping Behavior Support 14
F strange results Support 9
M Strange error messages from TCC in FTP copy Support 7
M Another possibly strange remote registry issue Support 5
forbin Strange handling of [nonbright] magenta background (v22) Support 2
N Fixed Strange dir behavior Support 6
vefatica REGDIR, strange error message Support 7
T WAD Strange Unexpected "features" in the Debugger Support 2
P Strange mouse behavior with list Support 2
vefatica Strange tcc.exception.log Support 7
vefatica A strange one Support 0
D Strange DO behavior with /O Support 5
Glenn Bowes Strange text at startup Support 5
Steve Pitts WAD Strange output from DEL of a non-existent directory Support 7
vefatica Big numbers, strange errors Support 1
aedthuio Strange... lpksetup Support 4
CWBillow dir /4 strange Support 2
D Strange issue with FOR loop Support 15
MikeBaas Strange prob with %@replace.. Support 4
Dan Glynhampton Documentation v15 help: Strange links in @INT topic Support 0
R WAD Strange output from "memory" command Support 1
M Yet another strange something re something called "@TCONVERT" Support 8
Roedy How to? Strange colours Support 9
M WAD Strange "Start" misbehavior... Support 10
vefatica Very strange console font corruption Support 3
Steve Pitts Strange problem with FREE Support 10
A strange error in alias Support 9
newgeekorder Debugger IDE - strange tab and parameter behaviour Support 1
Exolon Strange Prompt. Support 6
vefatica Strange folders Support 1
T Strange CPU value Support 3
J Strange error: unset /s Support 14
M Strange behavior... Support 2
CWBillow Strange happenings Support 2
B Strange handling of a .BAT file Support 5
J ASSOC / FTYPE strange error message Support 3
D Strange crashes in @CRC32 and @MD5 Support 9
Charles Dye Strange output, here-doc redirection, TYPE, //UnicodeOutput=Yes Support 6
S Strange CHKDSK behavior Support 6
vefatica Strange results with CP 1252 Support 12
S Strange REN problem - non-English characters Support 3
dcantor Strange status in ACTIVATE command Support 0
MickeyF TCC crashing when copying multiple files (now resolved) Support 6
fpefpe How to? shortcuts and batch files Support 4
C v28 key files Support 2
J ffind does not find files Support 4
C duplicate files in multiple plugin sites Support 9
Dmitry L. Kobyakov Fixed The SETARRAY /R command works incorrectly with cyrillic files Support 2

Similar threads