Better Understanding Suspicious Temp and other File Content

[vop]

In a previous thread (Do you know what is in your temp files? Maybe you ought to?) I identified TEMP files that were very suspicious in nature and worthy of concern:

http://www.tek-tips.com/viewthread.cfm?SQID=825169&SPID=760&newpid=760&page=1

Such files had extracts from my hosts file and refused to be be deleted. Why were they there and what was their purpose?

I have since discovered a freeware tool that links each of those *.TMP files to a valid running process. It is called 'Process Explorer'

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml.

Using the rightmost search button you can type a search string such as TMP, DAT, EXE, etc. This tool may very well become a critical component in understanding any unresolved questions as to what may be going on in your computer. In my case, I was able to establish that each TMP file only occurs when a given security tool is running.

BONUS: You can also KILL any given process within this tool.

 

[zebratech]

Thanks for sharing this find!! I believe its a must in the battle against malware. Small enough to fit on a floppy and run. Good post!



Unix IS user friendly... It's just selective about who its friends are.