TempNEW Files -- What are they???

[Guest]

Not having received any answers to this question posted two days ago, I am posting it again. If anyone knows the answer, please respond. Many thanks.

In my Documents and Settings\...\Local Settings folder, I discovered several hundred files, all starting with the characters TempNER...followed by 8 alphanumeric characters, with various extensions such as exe, cab, dll, etc.

I have a hardware firewall and I keep Norton AntiVirus up-to-date, but these files look mighty suspicious. They take up several MB of space.

Can anyone tell me what purpose they serve and whether it would be a good idea to delete them?

Thanks.

 

[Guest]

Oops, I did a typo. It was referring to files that start with the name TempNER... not TempNEW...

 

[Wesley Vogel]

What folder are they in?
C:\Documents and Settings\YourNameHere\Local Settings\Temp
C:\Documents and Settings\YourNameHere\Local Settings\Temporary Internet
Files

 

[Wesley Vogel]

What folder are they in?
C:\Documents and Settings\YourNameHere\Local Settings\Temp
C:\Documents and Settings\YourNameHere\Local Settings\Temporary Internet
Files

 

[Wesley Vogel]

Google, AltaVista and Msn Search all return nothing on TempNER85006784.sys
A sys extension is usually a System Device Driver.
What does right clicking any of these files | Properties reveal?

 

[Guest]

They are not just sys files. There are TempNER... files with a variety of extensions, such as .sys, .dll, .exe, .pdf, .bat, .bin, .cab, .chm, .dat, etc., etc.

Because of all the different extensions, it seems like these files may have been created as a result of a backup going awry. But, I have not been able to find any reference to the creation of such files by any of the backup programs that I have used -- such as DriveImage, Retrospect, TrueImage and IomegaBackup.

Clicking on Properties reveals nothing other than the basic information provided by Explorer.

 

[Wesley Vogel]

You're not giving much to work with here.

Right click file(s) | Properties |
Opens with??? on the General tab
on the Version tab:
Description??
Comments??
Company??
et cetera??

If not scumware or virus there may be some clues.

Backups would probably not have these extensions.

Update your anti virus software and run a complete scan.

Free online virus scans

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php

===============

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp

 

[Guest]

Sorry I wasn't more specific about what is revealed under Properties.

I just opened the Properties box for the largest file --TempNER90BB0B2E.exe, a 125 MB file. Here's what it says:

General Tab:
Type of file: Application
Description: Self-Extracting Cabinet
Location: C:\Documents and Settings\MyName\Local Settings
Size: 125 MB (131,170,400 bytes)
Size on disk: 125 MB (131,170,400 bytes)
Created: Tuesday, April 13, 2004, $:04:09 PM
Modified: Tuesday, April 13, 2004, 4:05:10 PM
Accessed: Friday, June 11, 2004, 8:02.10 PM

Version Tab:
File Version 1.16.121.0
Description: Self-Extrating CAbinet
Copyright: Copyright (C) Microsoft, 1997-2000
Other version information:
File Version - 1.16
Language - English (United States)

Compatibility Tab
No entries

Digital Signatures Tab
Signature list
Name of signer: Microsoft Corpora..
E-mail address: Not available
Timestamp: Friday, January 24, 20..

Summary Tab
No Entries

Backup Tab
Backup Status: File is not selected for backup.

I noticed that all the files have the characters NER in the title. That made me wonder whether these files may have been created as a result of an aborted copy of a backup to a DVD using NERO DVD-burning software. I sent a message to NERO support with that query but have not yet had an answer.

My Norton AntiVirus is up to date, and I run a daily complete scan. No viruses are detected. I also run Ad-a-ware frequently. I downloaded a program called Moosoft Cleaner Professional, which I am about to run. Do you recommend that I run any of the programs you suggested before I run Cleaner Professional?




--
j.segel

You're not giving much to work with here.

Right click file(s) | Properties |
Opens with??? on the General tab
on the Version tab:
Description??
Comments??
Company??
et cetera??

If not scumware or virus there may be some clues.

Backups would probably not have these extensions.

Update your anti virus software and run a complete scan.

Free online virus scans

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php

===============

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp

 

[Wesley Vogel]

I'd wait to see what Nero has to say.

Description: Self-Extrating CAbinet doesn't make any sense because that
description is for a cab file not an exe file.

The Temp at the begining probably means you can delete all of them.
But I'm not suggesting this yet.

--
Hope this helps. Let us know.
Wes

In

Sorry I wasn't more specific about what is revealed under Properties.

I just opened the Properties box for the largest file
--TempNER90BB0B2E.exe, a 125 MB file. Here's what it says:

General Tab:
Type of file: Application
Description: Self-Extracting Cabinet
Location: C:\Documents and Settings\MyName\Local Settings
Size: 125 MB (131,170,400 bytes)
Size on disk: 125 MB (131,170,400 bytes)
Created: Tuesday, April 13, 2004, $:04:09 PM
Modified: Tuesday, April 13, 2004, 4:05:10 PM
Accessed: Friday, June 11, 2004, 8:02.10 PM

Version Tab:
File Version 1.16.121.0
Description: Self-Extrating CAbinet
Copyright: Copyright (C) Microsoft, 1997-2000
Other version information:
File Version - 1.16
Language - English (United States)

Compatibility Tab
No entries

Digital Signatures Tab
Signature list
Name of signer: Microsoft Corpora..
E-mail address: Not available
Timestamp: Friday, January 24, 20..

Summary Tab
No Entries

Backup Tab
Backup Status: File is not selected for backup.

I noticed that all the files have the characters NER in the title.
That made me wonder whether these files may have been created as a
result of an aborted copy of a backup to a DVD using NERO DVD-burning
software. I sent a message to NERO support with that query but have
not yet had an answer.

My Norton AntiVirus is up to date, and I run a daily complete scan.
No viruses are detected. I also run Ad-a-ware frequently. I
downloaded a program called Moosoft Cleaner Professional, which I am
about to run. Do you recommend that I run any of the programs you
suggested before I run Cleaner Professional?




--
j.segel

You're not giving much to work with here.

Right click file(s) | Properties |
Opens with??? on the General tab
on the Version tab:
Description??
Comments??
Company??
et cetera??

If not scumware or virus there may be some clues.

Backups would probably not have these extensions.

Update your anti virus software and run a complete scan.

Free online virus scans

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php

===============

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are
really good. Download, install, run, update and run again; one or
all. They are all good, FREE utilities.

Run CWShredder first!!! <<<<<<<<<<<<

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it
from ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp


--
Hope this helps. Let us know.
Wes

In

They are not just sys files. There are TempNER... files with a
variety of extensions, such as .sys, .dll, .exe, .pdf, .bat, .bin,
.cab, .chm, .dat, etc., etc.

Because of all the different extensions, it seems like these files
may have been created as a result of a backup going awry. But, I
have not been able to find any reference to the creation of such
files by any of the backup programs that I have used -- such as
DriveImage, Retrospect, TrueImage and IomegaBackup.

Clicking on Properties reveals nothing other than the basic
information provided by Explorer.



--
j.segel


:

Google, AltaVista and Msn Search all return nothing on
TempNER85006784.sys A sys extension is usually a System Device
Driver.
What does right clicking any of these files | Properties reveal?

--
Hope this helps. Let us know.
Wes

In jsegel <[email protected]> hunted and pecked:
Hi Wesley,

Thanks for taking an interest in solving my problem.

These TempNER.... files are ALL in C:\Documents and
Settings\Myname\Local Settings. There are 1700 such files,
totaling 496 megabytes, all but one of which were created on the
same date in April.

They are NOT in the Temp or Temporary Internet Files
subdirectories.

A typical complete file name is: TempNER85006784.sys

Hope you can come up with the answer.
--
j.segel


:

What folder are they in?
C:\Documents and Settings\YourNameHere\Local Settings\Temp
C:\Documents and Settings\YourNameHere\Local Settings\Temporary
Internet Files


--
Hope this helps. Let us know.
Wes

In jsegel <[email protected]> hunted and pecked:
Not having received any answers to this question posted two days
ago, I am posting it again. If anyone knows the answer, please
respond. Many thanks.

In my Documents and Settings\...\Local Settings folder, I
discovered several hundred files, all starting with the
characters TempNER...followed by 8 alphanumeric characters,
with various extensions such as exe, cab, dll, etc.

I have a hardware firewall and I keep Norton AntiVirus
up-to-date, but these files look mighty suspicious. They take
up several MB of space.

Can anyone tell me what purpose they serve and whether it would
be a good idea to delete them?

Thanks.