Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently I have seen tons of *.tmp files automatically generated on my c:\temp directory. The file name is as follows:

FLT1A00.tmp
FLT1A5.tmp
...
FLT3EF3.tmp

The content of the file is related to boost library:

//
// signal_set.cpp
// ~~~~~~~~~~~~~~
//
// Copyright (c) 2003-2011 Christopher M. Kohlhoff (chris at kohlhoff dot com)
//
// Distributed under the Boost Software License, Version 1.0. (See accompanying
// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
//

// Disable autolinking for unit tests.
#if !defined(BOOST_ALL_NO_LIB)
#define BOOST_ALL_NO_LIB 1
#endif // !defined(BOOST_ALL_NO_LIB)

// Test that header file is self-contained.
#include <boost/asio/signal_set.hpp>

#include <boost/asio/io_service.hpp>
#include "unit_test.hpp"

//------------------------------------------------------------------------------

// signal_set_compile test
// ~~~~~~~~~~~~~~~~~~~~~~~
// The following test checks that all public member functions on the class
// signal_set compile and link correctly. Runtime failures are ignored.

namespace signal_set_compile {

void signal_handler(const boost::system::error_code&, int)
{
}

void test()
{
  using namespace boost::asio;

  try
  {
    io_service ios;
    boost::system::error_code ec;

    // basic_signal_set constructors.

    signal_set set1(ios);
    signal_set set2(ios, 1);
    signal_set set3(ios, 1, 2);
    signal_set set4(ios, 1, 2, 3);

    // basic_io_object functions.

    io_service& ios_ref = set1.get_io_service();
    (void)ios_ref;

    // basic_signal_set functions.

    set1.add(1);
    set1.add(1, ec);

    set1.remove(1);
    set1.remove(1, ec);

    set1.clear();
    set1.clear(ec);

    set1.cancel();
    set1.cancel(ec);

    set1.async_wait(&signal_handler);
  }
  catch (std::exception&)
  {
  }
}

} // namespace signal_set_compile

//------------------------------------------------------------------------------

test_suite* init_unit_test_suite(int, char*[])
{
  test_suite* test = BOOST_TEST_SUITE("signal_set");
  test->add(BOOST_TEST_CASE(&signal_set_compile::test));
  return test;
}

Does anyone know what the problem is?

Thank you

share|improve this question
1  
So what was it? –  Synetech Feb 11 '12 at 5:12
add comment

3 Answers

up vote 1 down vote accepted

You did not tell what OS it is exactally. a web search shows this particular thing happens via the "indexing service" related to office 2010 . ms answers link 1 & msanswers link 2

To determine if it is a virus or not, disable the index service , or in win7 disable the service called Search, and see if it stops.(I suspect that the legit occurance of this is an XP only thing) Also using a program like resource monitor or process explorer you could find out What program is doing it.

The Boost thing, doesnt make sence for it to be the above indexer thing, and instead it looks like some running program, or possible virus. What program/process is creating the files is most important.

To test for the indexer, open up "computer managment" in the Administration tools, or type compmgmt.msc /s into run Look for the section called "Services and Applications" expand that, and you will see "services" in services double click on "Indexing Service" and set it (temporarily) to disabled, then hit the STOP button on the left side.

share|improve this answer
add comment

Did it happen only once or does it happen again and again? Do you do any programming? Did you install any programs recently?


You can use Windows Security Auditing to monitor from where and when the files are created and accessed.

You can also use Process Monitor to set a file filter to watch what process creates/accesses the files, including during your next boot:

enter image description here

share|improve this answer
add comment

Virus... hmmm... What's your anti-virus said?

I found the code related to this tmp file there:

http://www.koders.com/cpp/fid024CECB842BD1FDCABCFD63C392C135FB873E597.aspx?s=thread

and this is related to this Google code application:

http://code.google.com/p/solwidget/

Is'nt? IF I'm right you have this application running in your system. If you don't trust it you my upload the program to VirusTotal for example...

Hope this help. Let us know. :)

share|improve this answer
    
> Virus... hmmm... What's your anti-virus said? Antivirus programs don’t generally bother to detect source code anymore. –  Synetech Feb 10 '12 at 5:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.