Do you know what is in your temp files? Maybe you ought to? There might potentially be a new sneaky form of spyware and monitoring vulnerabilities happening there?
I certainly have been getting this indication as I monitor the contents of my *.TMP files. Some of those temp files may initially appear as hex files - I use the shareware tool ‘ULTRAEDIT’ to display all readable and converted contents (H button). I have been finding:
- Very selective content excerpts of my HOSTS file (twelve items at a time – only one file at a time - with occasional recurring duplication) [~df*.tmp],
- Excerpts/logs re: anti-virus checking and updates carried out [~df*.tmp],
- Contents of security alert related matters that I have been made aware of [sofe*.tmp],
- Recurring monitoring information on only very very selective spyware related links that I have gone to (all seemingly favicon related?) [www*.tmp]:
Dealing with Unwanted Spyware and Parasites Can you go too far to protect your Windows PC? Script Sentry - block potentially malicious scripts Potential relationship between favicons and spyware? Recurring (registry-like) filename entries in the temp files directory
- Many of these such files immediately get recreated at the next boot or user profile change regardless of whether they have been deleted or not.
- A potentially related issue is that seemingly is both a source of favicon icons and a source of spyware. I have notice a recurring pattern. In each case a favicon (a very distinctive icon) has appeared only to soon thereafter be replaced by the standard IE icon.
Who or what processes are behind this? Which temp files have a legitimate or necessary purpose, and which are just simply vulnerably invasive? Potentially, such content could be sent out over the Internet without challenge from a firewall (through open port 80). Such information, in the wrong hands, might provide the capability to:
- Identify, for replacement, browser filter blocks that are in place (127.0.0.1) in the HOSTS file,
- Flag the status of my anti-virus updates,
- Monitor security alerts that I have been made aware of via email,
- Selectively monitor spyware related links that I have gone to and am aware of (information that might contribute to the protection of my system).
Can anyone report similar happenings – especially the occurrences of files? I have not been able to find the same occurrences on any other machines for which I am responsible. How does one neutralize such suspect behaviours? Any suggestions?
I certainly have been getting this indication as I monitor the contents of my *.TMP files. Some of those temp files may initially appear as hex files - I use the shareware tool ‘ULTRAEDIT’ to display all readable and converted contents (H button). I have been finding:
- Very selective content excerpts of my HOSTS file (twelve items at a time – only one file at a time - with occasional recurring duplication) [~df*.tmp],
- Excerpts/logs re: anti-virus checking and updates carried out [~df*.tmp],
- Contents of security alert related matters that I have been made aware of [sofe*.tmp],
- Recurring monitoring information on only very very selective spyware related links that I have gone to (all seemingly favicon related?) [www*.tmp]:
Dealing with Unwanted Spyware and Parasites Can you go too far to protect your Windows PC? Script Sentry - block potentially malicious scripts Potential relationship between favicons and spyware? Recurring (registry-like) filename entries in the temp files directory
- Many of these such files immediately get recreated at the next boot or user profile change regardless of whether they have been deleted or not.
- A potentially related issue is that seemingly is both a source of favicon icons and a source of spyware. I have notice a recurring pattern. In each case a favicon (a very distinctive icon) has appeared only to soon thereafter be replaced by the standard IE icon.
Who or what processes are behind this? Which temp files have a legitimate or necessary purpose, and which are just simply vulnerably invasive? Potentially, such content could be sent out over the Internet without challenge from a firewall (through open port 80). Such information, in the wrong hands, might provide the capability to:
- Identify, for replacement, browser filter blocks that are in place (127.0.0.1) in the HOSTS file,
- Flag the status of my anti-virus updates,
- Monitor security alerts that I have been made aware of via email,
- Selectively monitor spyware related links that I have gone to and am aware of (information that might contribute to the protection of my system).
Can anyone report similar happenings – especially the occurrences of files? I have not been able to find the same occurrences on any other machines for which I am responsible. How does one neutralize such suspect behaviours? Any suggestions?
