3

Every 5 seconds, a new folder with the name MSI*.tmp is created at my c:.

1 seconde before, this folder is deleted.

How can I know who is creating this folder. Can it be a virus?

enter image description here

4
  • Domain machine? Any installs going? – Austin T French Apr 4 '13 at 17:08
  • Fire up SysInternals Process Explorer and try to capture the msiexec.exe process that's running every 5 seconds. – jnovack Apr 4 '13 at 17:13
  • Yes, this is a domain machine... This is happening for 3 days... Windows is not showing the update icon... – Bruno Croys Felthes Apr 4 '13 at 17:13
  • I would contact your IT support staff. – Ramhound Apr 5 '13 at 11:57
8

Run Process Monitor from Microsoft (originally SysInternals). It will give you a ton of output, but you can filter on your folder name.

3
  • Thanks, i run the process monitor and the program that is creating this folder is the msiexec.exe, how can i know what is driving this execution? – Bruno Croys Felthes Apr 5 '13 at 16:28
  • I would dig in with Process Monitor and see if there is any more useful information. One thing to try: double-click one of the lines that contains msiexec.exe. You should see "Event Properties". Switch to the "Process" tab and look at "Command Line". This may contain the path to the program it is trying to install. Also, the advice above to talk to your IT staff is really good. It is possible this is malicious software, but even if it is well-meaning software, it's still doing bad things to you. – kmort Apr 5 '13 at 18:07
  • Look into your Windows log, MSI installs are usually logged there, and you'll be able to find out what product is installed. – Alexey Ivanov Apr 5 '13 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.