while installing application GLB3.tmp wants to connect to ..

Hello,

I am a little bit paranoid as to the danger of malware on my computers
but that is nog a bad thing, I think.

On my comp. nr.1 I work with:
- Comodo firewall with Defense+ switched on (updated)
- Avast Personal Edition (updated)
- MBAM (updated)

It is a computer with WindowsXP SP3 and IE 7 (IE8 doesn't function
well), almost all the updates are installed but some of them would not
install, so...

If I want tot install a program then I see that always a file GLB3.tmp
starts up first and want to be connected to the internet and later on
wants to make changes to the configuration, if I well remember. I
suppose that it is not normal that a .tmp file wants to connect to
internet or wants to fiddle with my config.

If I switch off the possibility for this file to connect to internet
by means of Comodo and then proceed to installing two simple programs,
then in the first case there appears a file GLBA.tmp asking to be
connected to internet (what I forbid) and in the second case a file
GLBF.tmp asks for the same thing!

Looking for this file on my c:-partition only shows a file
GLB3.tmp(cyphers).pf in the Windows\System32\ map.

I have scanned with Avast and MBAM but to no avail. Since some time I
remark that in the Avast logfiles there is a whole bunch of files that
cannot be scanned because of error code 32 (file cannot be scanned
because of password protected). Avast has been configured for heavy
scanning.

What irritates me very much is that Avast cannot be configured to scan
archives though this possibility is mentioned in the helpfile and of
course this *should* be possible.

What does you think about this?

Massimo

Massimo wrote:

> Hello,
>
> I am a little bit paranoid as to the danger of malware on my computers
> but that is nog a bad thing, I think.
>
> On my comp. nr.1 I work with:
> - Comodo firewall with Defense+ switched on (updated)
> - Avast Personal Edition (updated)
> - MBAM (updated)
>
> It is a computer with WindowsXP SP3 and IE 7 (IE8 doesn't function
> well), almost all the updates are installed but some of them would not
> install, so...
>
> If I want tot install a program then I see that always a file GLB3.tmp
> starts up first and want to be connected to the internet and later on
> wants to make changes to the configuration, if I well remember. I
> suppose that it is not normal that a .tmp file wants to connect to
> internet or wants to fiddle with my config.
>
> If I switch off the possibility for this file to connect to internet
> by means of Comodo and then proceed to installing two simple programs,
> then in the first case there appears a file GLBA.tmp asking to be
> connected to internet (what I forbid) and in the second case a file
> GLBF.tmp asks for the same thing!
>
> Looking for this file on my c:-partition only shows a file
> GLB3.tmp(cyphers).pf in the Windows\System32\ map.
>
> I have scanned with Avast and MBAM but to no avail. Since some time I
> remark that in the Avast logfiles there is a whole bunch of files that
> cannot be scanned because of error code 32 (file cannot be scanned
> because of password protected). Avast has been configured for heavy
> scanning.
>
> What irritates me very much is that Avast cannot be configured to scan
> archives though this possibility is mentioned in the helpfile and of
> course this *should* be possible.
>
> What does you think about this?
>
> Massimo

Use SysInternals' FileMon to see what process is creating the file.
Wipe the temp directories, load FileMon (and you can even use its filter
to target just "GLB*" files, and do the install that causes these files
to appear. Check in FileMon what process created the files. Once you
have the process, you can SysInternal's Process Explorer to get more
info on it.