What creates these files?

[Guest]

For less than one full day, both NAV and AVG indicated that files that are
constantly created in "C:/Documents and settings/<user>/Local settings/Temp"
with names "CC*.tmp" (they appear to be named using hexadecimal notation of a
byte) have the Netsky.P or .Q worms. Is this NAV/NIS creating these files as
a result of using MS Outlook, and why would the files have an old worm?

Investigating how these worms work shows that the system does not appear to
be infected with these worms. But the "CC*.tmp" files are always being
recreated.

Any suggestions how to eliminate the problem?

Kevin

 

[Diane Poremsky [MVP]]

do you use outlook express? Outlook doesn't create files in that folder - it
uses a subfolder. NAV could be doing it as it scans incoming email.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)



Subscribe to Exchange Messaging Outlook newsletter
mailto:[email protected]

 

[Guest]

I use MS Outlook, Diane. There are no subfolders in "<user>/Local
settings/Temp", but I imagine MS Outlook would use a folder somewhere in
"Local settings".

For further information, warning messages from AVG and NAV only now appear
when I access that folder/files to try to solve the problem. Maybe there's no
real problem after all. But if NAV/NIS is creating those files, then why
would it be creating them with an apparent security flaw?

I will copy my original post with this post onto the Security discussion
group. Many thanks for your effort in responding to my post.

do you use outlook express? Outlook doesn't create files in that folder - it
uses a subfolder. NAV could be doing it as it scans incoming email.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)



Subscribe to Exchange Messaging Outlook newsletter
mailto:[email protected]

For less than one full day, both NAV and AVG indicated that files that are
constantly created in "C:/Documents and settings/<user>/Local
settings/Temp"
with names "CC*.tmp" (they appear to be named using hexadecimal notation
of a
byte) have the Netsky.P or .Q worms. Is this NAV/NIS creating these files
as
a result of using MS Outlook, and why would the files have an old worm?

Investigating how these worms work shows that the system does not appear
to
be infected with these worms. But the "CC*.tmp" files are always being
recreated.

Any suggestions how to eliminate the problem?

Kevin

 

[Brian Tillman]

I use MS Outlook, Diane. There are no subfolders in "<user>/Local
settings/Temp", but I imagine MS Outlook would use a folder somewhere
in "Local settings".

It uses a folder under %UserProfile%\Local Settings\Temporary Internet Files