Can't find source of temp file buildup

Question

trogdor4387 0 Newbie Poster

16 Years Ago

I've been working on a laptop and I can't seem to find out why there are temp files constantly and rapidly building up in my temp folders. I ran MalwareBytes which discovered and removed viruses and I also ran AVG Free Antivirus and nothing new came up. I also ran several disk and registry cleanups and defrags. The files are named iexxxx.tmp, inx.tmp, perflib_perfdata_xxx.dat where x can be any number or letter. Here is my log file from HijackThis. Can anyone see anything that might be causing this problem or does anyone have further suggestions?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:19:52, on 10/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlservr.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.salisburyarea.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [\\server\EPSON Stylus Photo 1400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIBUA.EXE /FU "C:\DOCUME~1\Cathie\LOCALS~1\Temp\E_S9C.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Windows\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
O17 - HKLM\Software\..\Telephony: DomainName =
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC91ADF8-0D8F-4A99-9EB5-FE4A88F5A217}: NameServer = ,
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\Windows\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe (file missing)

--
End of file - 5486 bytes

file-system microsoft:windows-nt-2000-xp virus-malware

1 Contributor
1 Reply
215 Views
1 Day Discussion Span
Latest Post 16 Years Ago Latest Post by trogdor4387

Dani AI

Generated 7 Months Ago

Good follow-up from . Rapid, repeated temp-file creation is a classic sign that a persistent background component (legitimate or malicious) is spawning files faster than normal cleanup can remove them. After an initial removal, several verification and hardening steps help ensure no remnants remain and reduce the chance of recurrence.

Capture live activity with a file-system tracer such as Procmon.exe (Process Monitor). Filter for the temp folder path and the CreateFile/WriteFile operations, run for a short interval, then inspect the Process/Image column to identify the exact binary responsible and its full path.
Enumerate auto-start locations with Autoruns.exe (Sysinternals). Pay attention to entries with missing or unsigned files, scheduled tasks, services, and any protocol/LSA/WinSock hooks. Use the “Verified Signer” column and the Jump-To-Entry feature before deleting.
Inspect scheduled tasks, Services, and Recent Items for newly created entries or odd timestamps. Compare timestamps of suspicious binaries with known good system-file dates.
Verify Windows system files with sfc /scannow (note: on older installs this may require original media). If system files were tampered with, a repair install or clean image is the safest recovery.
Run a hidden-driver/rootkit check from trusted rescue media (bootable AV rescue ISO or a dedicated rootkit scanner) to detect kernel-level persistence that normal scanners can miss.
Clear System Restore (disable then re-enable) to remove infected restore points and change any passwords that were used on the machine or exposed to remote access. If remote-access software was present, reset credentials on both host and any router/firewall devices.

Longer-term hardening: remove or replace unused remote-access tools, keep the OS and apps on supported platforms, apply least-privilege for daily accounts, and keep a known-clean backup or image. When doubt remains about stealthy or kernel-level compromises, a full reinstall from trusted media is the most reliable final step.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

trogdor4387 0 Newbie Poster · Answer 1 · 2009-10-07T20:53:53+00:00

I found the problem. It was due to a program called realVNC. The program had a trojan attached to userinit.exe. First I ended all running processes related to the program. Then I deleted all registry keys for it. Lastly, I ran SUPERAntiSpyware and MalwareBytes in safemode. It found the virus, deleted it, and the problem was fixed.