1

I took a look in my c:\windows\temp directory and I found lots of file.log files. The names are built with this syntax: Machinename-YYYYMMDD-XXXX.log.

And I found this:

Timestamp   Process TID Area    Category    EventID Level   Message Correlation
01/30/2016 12:43:10.754 OFFICEC2 (0xde8)    0xb6c       Click-To-Run Telemetry  aqkhc   Medium  {"MachineID":"a3c8037bfedf40479c3023588639eb6d","SessionID":"b292f44b-e5a6-41c3-a68e-000582c1e920","GeoID":"84","Ver":"0.0.0.0","ExeVer":"15.0.4787.1002","SecuritySessionId":"0","ModulePath":"C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe","CommandLine":"/update SCHEDULEDTASK displaylevel=False","Bitness":"64","IntegrityLevel":"0x4000"}  
01/30/2016 12:43:10.754 OFFICEC2 (0xde8)    0xb6c       Click-To-Run Telemetry  aqkhe   Medium  {"MachineID":"a3c8037bfedf40479c3023588639eb6d","SessionID":"b292f44b-e5a6-41c3-a68e-000582c1e920","GeoID":"84","Ver":"0.0.0.0","OSVersion":"6.2","SP":"0","ProductType":"1","ProcessorArch":"9","Locale":"1036"}   
01/30/2016 12:43:10.770 OFFICEC2 (0xde8)    0xb6c       Click-To-Run Telemetry  amebh   Medium  ClientExe complete. {"MachineID":"a3c8037bfedf40479c3023588639eb6d","SessionID":"b292f44b-e5a6-41c3-a68e-000582c1e920","GeoID":"84","Ver":"15.0.4787.1002","Action":"1","Result":"0"}   
01/30/2016 12:43:10.770 OFFICEC2 (0xde8)    0xb6c       Logging Liblet  aqc99   Medium  Logging liblet uninitializing.  

Most of the files are this long but some are much longer. All the logs turn around OFFICE2. Could those logs files come from a malicious program ?

P.S: I perform multiple scans for malware with multiple proven applications every month.

5
  • You're question isn't clear. What exactly are you asking?
    – Jack Bahou
    Mar 10, 2016 at 15:44
  • I was asking if those log could come from a malicious program installed in my computer.
    – MickMRCX
    Mar 10, 2016 at 16:29
  • Related question. superuser.com/questions/173256/windows-7-what-is-windows-temp
    – Moab
    Mar 10, 2016 at 17:55
  • @Moab I don't think as I didn't ask if those files are deletable without risk or the purpose of this folder, but if those files may be created by a malicious software.
    – MickMRCX
    Mar 10, 2016 at 18:16
  • It is next to impossible to determine what created a file after the fact.
    – Moab
    Mar 10, 2016 at 21:46

1 Answer 1

1

Click-to-run is a feature that Microsoft uses to distribute software over the Internet.

Like many other dodgy software of today (Chrome, Spotify, etc.) the "installer" runs with standard user privileges and writes files to locations where non-admin users can write to. In this case, some updater has chosen to write its logs to your temp directory.

There's probably no harm in this if your anti-virus did not detect any threats, but such practice does weaken overall security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .