3

Every 5 seconds, a new folder with the name MSI*.tmp is created at my c:.

1 seconde before, this folder is deleted.

How can I know who is creating this folder. Can it be a virus?

enter image description here

4
  • Domain machine? Any installs going? Apr 4, 2013 at 17:08
  • Fire up SysInternals Process Explorer and try to capture the msiexec.exe process that's running every 5 seconds.
    – jnovack
    Apr 4, 2013 at 17:13
  • Yes, this is a domain machine... This is happening for 3 days... Windows is not showing the update icon... Apr 4, 2013 at 17:13
  • I would contact your IT support staff.
    – Ramhound
    Apr 5, 2013 at 11:57

1 Answer 1

8

Run Process Monitor from Microsoft (originally SysInternals). It will give you a ton of output, but you can filter on your folder name.

3
  • Thanks, i run the process monitor and the program that is creating this folder is the msiexec.exe, how can i know what is driving this execution? Apr 5, 2013 at 16:28
  • I would dig in with Process Monitor and see if there is any more useful information. One thing to try: double-click one of the lines that contains msiexec.exe. You should see "Event Properties". Switch to the "Process" tab and look at "Command Line". This may contain the path to the program it is trying to install. Also, the advice above to talk to your IT staff is really good. It is possible this is malicious software, but even if it is well-meaning software, it's still doing bad things to you.
    – kmort
    Apr 5, 2013 at 18:07
  • Look into your Windows log, MSI installs are usually logged there, and you'll be able to find out what product is installed. Apr 5, 2013 at 20:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .