What creates these files?

Kevin · External Since: Jul 07, 2004 Posts: 156

For less than one full day, both NAV and AVG indicated that files that are
constantly created in "C:/Documents and settings/<user>/Local settings/Temp"
with names "CC*.tmp" (they appear to be named using hexadecimal notation of a
byte) have the Netsky.P or .Q worms. Is this NAV/NIS creating these files as
a result of using MS Outlook, and why would the files have an old worm?

Investigating how these worms work shows that the system does not appear to
be infected with these worms. But the "CC*.tmp" files are always being
recreated.

Any suggestions how to eliminate the problem?

Kevin

Diane Poremsky [MVP] · External Since: Jul 28, 2005 Posts: 6715

do you use outlook express? Outlook doesn't create files in that folder - it
uses a subfolder. NAV could be doing it as it scans incoming email.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)

Outlook Tips: http://www.outlook-tips.net/
Outlook & Exchange Solutions Center: http://www.slipstick.com
Subscribe to Exchange Messaging Outlook newsletter
mailto:EMO-NEWSLETTER-SUBSCRIBE-REQUEST@PEACH.EASE.LSOFT.COM

"Kevin" <Kevin.DeleteThis@discussions.microsoft.com> wrote in message
news:119E4D1B-65EE-4E1C-A7F8-614F1A6EA156@microsoft.com...
> For less than one full day, both NAV and AVG indicated that files that are
> constantly created in "C:/Documents and settings/<user>/Local
> settings/Temp"
> with names "CC*.tmp" (they appear to be named using hexadecimal notation
> of a
> byte) have the Netsky.P or .Q worms. Is this NAV/NIS creating these files
> as
> a result of using MS Outlook, and why would the files have an old worm?
>
> Investigating how these worms work shows that the system does not appear
> to
> be infected with these worms. But the "CC*.tmp" files are always being
> recreated.
>
> Any suggestions how to eliminate the problem?
>
> Kevin

Kevin · External Since: Jul 07, 2004 Posts: 156

I use MS Outlook, Diane. There are no subfolders in "<user>/Local
settings/Temp", but I imagine MS Outlook would use a folder somewhere in
"Local settings".

For further information, warning messages from AVG and NAV only now appear
when I access that folder/files to try to solve the problem. Maybe there's no
real problem after all. But if NAV/NIS is creating those files, then why
would it be creating them with an apparent security flaw?

I will copy my original post with this post onto the Security discussion
group. Many thanks for your effort in responding to my post.

"Diane Poremsky [MVP]" wrote:

> do you use outlook express? Outlook doesn't create files in that folder - it
> uses a subfolder. NAV could be doing it as it scans incoming email.
>
> --
> Diane Poremsky [MVP - Outlook]
> Author, Teach Yourself Outlook 2003 in 24 Hours
> Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
> Author, Google and Other Search Engines (Visual QuickStart Guide)
>
> Outlook Tips: http://www.outlook-tips.net/
> Outlook & Exchange Solutions Center: http://www.slipstick.com
> Subscribe to Exchange Messaging Outlook newsletter
> mailto:EMO-NEWSLETTER-SUBSCRIBE-REQUEST@PEACH.EASE.LSOFT.COM
>
>
> "Kevin" <Kevin DeleteThis @discussions.microsoft.com> wrote in message
> news:119E4D1B-65EE-4E1C-A7F8-614F1A6EA156@microsoft.com...
> > For less than one full day, both NAV and AVG indicated that files that are
> > constantly created in "C:/Documents and settings/<user>/Local
> > settings/Temp"
> > with names "CC*.tmp" (they appear to be named using hexadecimal notation
> > of a
> > byte) have the Netsky.P or .Q worms. Is this NAV/NIS creating these files
> > as
> > a result of using MS Outlook, and why would the files have an old worm?
> >
> > Investigating how these worms work shows that the system does not appear
> > to
> > be infected with these worms. But the "CC*.tmp" files are always being
> > recreated.
> >
> > Any suggestions how to eliminate the problem?
> >
> > Kevin
>
>
>

Brian Tillman · External Since: Mar 29, 2005 Posts: 20862

Kevin <Kevin RemoveThis @discussions.microsoft.com> wrote:

> I use MS Outlook, Diane. There are no subfolders in "<user>/Local
> settings/Temp", but I imagine MS Outlook would use a folder somewhere
> in "Local settings".

It uses a folder under %UserProfile%\Local Settings\Temporary Internet Files
--
Brian Tillman