Mysterious .tmp files generated in C:\Windows\System32\ folder upon booting

Question

After I boot my machine, I get 4-5 .tmp files generated in C:\Windows\System32\ , usually with names like: 3.tmp, 5.tmp, 6.tmp, 7.tmp, 8.tmp

These files are like 100K in size each. I can delete them manually, and they do not seem to affect anything.

This just started happening about 2,3 days ago. I think I got a virus, because once my anti-virus program popped up saying a isvchost.exe file was infected, and the iscvhost file was generated by one of those .tmp files. Even after I delete the iscvhost.exe file, it gets re-created the next time I boot, again by those .tmp files. and those .tmp files are re-generated as well, by some process I don't know.

I checked into my registry key and look for startup programs I don't know about, but everything in my startup program list is clean and known.

So how can a program regenerate files upon rebooting without me knowing?

Answer 1

So how can a program regenerate files upon rebooting without me knowing?

Oh, there are loads of ways a program can get itself run on startup, and equally loads of ways to hide from you.

You can try running HijackThis to find many more startup hooks that just the Software-MS-Win-CurVer-Run key, and a rootkit finder such as BlackLight to see if there are any more hidden files you can't see. But a persistent self-recreator is often very difficult to remove from inside the OS itself.

Michael is right: the only safe course of action is nuke and pave (reformat and reinstall the OS). Don't rely on your anti-virus to keep you clean, because today's anti-virus tools are almost totally useless against the ever-growing-and-mutating range of web-sploit-installed threats.

Answer 2

It's on a development machine, which leads me to think those are temporary files (= .tmp) from developing environments.

Maybe you installed a new app or changed configs in some apps.

Answer 3

Take a look at Process Monitor from Sysinternals. It can log process, registry, file system, and network activity on yor system. It can also do boot logging, so you should be able to follow the creation of those temp files from the beginning.