MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Software
Register FAQ Members List Calendar Casino Mark Forums Read

Software Software such as operating systems like Windows XP, Windows Vista, Windows 7 etc., or specific programs.


Reply
 
Thread Tools Display Modes
  #1  
Old 05-27-10, 11:53
mercadmin mercadmin is offline
Private E-2
 
Join Date: May 2010
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
Default Randomly generated files in %temp% folder when Outlook receives messages

Hi all,

I was recently clearing out temp files on the computers here at work and came across two users who have strange files in their %Temp% folder. One is on XP and the path is C:\Documents and Settings\<userprofile>\Local Settings\Temp. The other is on Vista and the path is C:\Users\<userprofile>\AppData\Local\Temp. Most of our users run with limited rights but these two users run programs that require them to have local admin rights. The suspicious looking files are as follows:

s2j0.1o
s2j0.2
s2j0.3
s2j0.4
s2j0.5
s2j0.6
s2j0.7
s2j0.8
s2j0.9
s2j0.a
s2j0.b
s2j0.c
s2j0.d
s2j0.e

etc,etc.

I cannot delete these files as they come up as accessed denied. But I copied one of the files to the desktop of the afflicted computer and changed the extension to a .txt. When I opened the file it was a copy of an email message that had come into Outook that day. Every one of these files that I open is a copy of an email received into Outlook. I sent a test message to the afflicted computer and as soon as it received the message a new file was created in the %temp% directory with the same nomenclature and the next available serialized extension. I tested a few other systems and none of the other computers exhibit this same behavior when Outlook receives messages. Every day the filenames will change to some other 3-5 random letter and number combination but the extensions are always .a, .b, .c, .d, .e, .f, etc and .1, .2, .3, .4, .5 etc and are always copies of email messages. Does anyone have an explanation as to what this could be? I'm assuming it is virus related but Symantec, MalwaryBytes, and Sophos Anti-Rootkit scans are clean.

Any help or insight would be greatly appreciated.

Thanks!
Reply With Quote
Sponsored links
  #2  
Old 05-27-10, 12:05
DavidGP's Avatar
DavidGP DavidGP is offline
MajorGeeks Forum Administrator - Grand Pooh-Bah
 
Join Date: Jan 2002
Location: UK
Posts: 38,832
Thanks: 3,008
Thanked 3,105 Times in 2,819 Posts
Default Re: Randomly generated files in %temp% folder when Outlook receives messages

Hi

What is the original extention of these files? its not a .exe is it by any chance as if so I would suspect malware. I cannto say I've ever noticed Outlook save copies of emails like that in temp folder with those extentions.

What you could do is to follow the below guide and start a new thread in malware for our malware experts to review and see what they think

Quote:
Please read and follow the following READ & RUN ME FIRST. Malware Removal Guide and once finished please start a new thread in the Malware Forum plus a guide on how to attach the logs HOW TO: Attach Items To Your Post
Reply With Quote
  #3  
Old 05-27-10, 12:42
mercadmin mercadmin is offline
Private E-2
 
Join Date: May 2010
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Randomly generated files in %temp% folder when Outlook receives messages

The files are showing up in the %temp% folder whenever a new message is received in Outlook. The filename and extension doesn't change after it is created. But there is a definite pattern to the extensions as these files are generated. They go in order numerically and then alphabetically. Here is an example of the emails that came in this morning and the filenames and extensions that were created:

1st email: s3s8
2nd email: s3s8.1
3rd email: s3s8.2
4th email: s3s8.3
5th email: s3s8.4
6th email: s3s8.5
7th email: s3s8.6
8th email: s3s8.7
9th email: s3s8.8
10th email: s3s8.9
11th email: s3s8.a
12th email: s3s8.b
13th email: s3s8.c

I wasn't going to post to the malware forum yet as I wasn't sure if that is what is causing the behavior. I've tried lots of google searching but can't seem to find anything similar to what I'm experiencing.
Reply With Quote
  #4  
Old 05-27-10, 12:49
collinsl's Avatar
collinsl collinsl is offline
MajorGeeks Rather Average Moderator
 
Join Date: Feb 2009
Location: Portsmouth, UK
Posts: 2,929
Thanks: 46
Thanked 430 Times in 400 Posts
Default Re: Randomly generated files in %temp% folder when Outlook receives messages

Quote:
Originally Posted by mercadmin View Post
The files are showing up in the %temp% folder whenever a new message is received in Outlook. The filename and extension doesn't change after it is created. But there is a definite pattern to the extensions as these files are generated. They go in order numerically and then alphabetically. Here is an example of the emails that came in this morning and the filenames and extensions that were created:

1st email: s3s8
2nd email: s3s8.1
3rd email: s3s8.2
4th email: s3s8.3
5th email: s3s8.4
6th email: s3s8.5
7th email: s3s8.6
8th email: s3s8.7
9th email: s3s8.8
10th email: s3s8.9
11th email: s3s8.a
12th email: s3s8.b
13th email: s3s8.c

I wasn't going to post to the malware forum yet as I wasn't sure if that is what is causing the behavior. I've tried lots of google searching but can't seem to find anything similar to what I'm experiencing.
I do agree with halo that you should go through the malware forum, if not just for being certified clean. This will close off one avenue of exploration.
__________________
"Tombstone has two dance halls, a dozen gambling places and more than 20 saloons. Still, there is hope, for I know of two Bibles in town." -- Judge Wells Spicer in 1881
Reply With Quote
  #5  
Old 05-27-10, 13:01
mercadmin mercadmin is offline
Private E-2
 
Join Date: May 2010
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Randomly generated files in %temp% folder when Outlook receives messages

Ok, thanks for the suggestions. Because these computers are in use all day I will have to schedule a time when I can run through the process of creating all the logs needed. It will probably be next week sometime.

Thanks again!
Reply With Quote
Sponsored links
Reply

Tags
file extensions, outlook, random, suspicious, temp

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
unwanted csv files generated? jdeh Malware Removal 2 06-11-09 20:57
Norton Antivirus creating excessive files in Windows/Temp folder klpruitt Software 1 06-05-09 19:05
Issues with saving/downloading files into temp folder (Vista Home Premium) Action_Al Software 1 01-22-09 10:27
Missing Content.IE5 folder in Temp Internet Files newport dave Software 17 03-01-07 06:41
Temp Folder (not internet files) frybo30 Software 9 08-19-03 07:58


All times are GMT -5. The time now is 23:29.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger