[eliuri]

Hello:

I noticed that when I empty my Temporary Inernet Files subfolders [TIF] they all are deleted except for one titled RNQ8SGD6 and containing only a .dat file dating back to 2003.

I also find that eight such Temporary Internet Folders are regenerated within minutes after I begin browsing the internet after TIF deletion.


1) Is it safe to manually delete that RNQ8SGD6 folder which seems to survive the normal method of deleting TIF and offline content via Internet Properties-->Delete Files-->Delete Offline content?


2) Does the fairly rapid regenration of eight such TIF subfolders after deletion indicate some sort of malware infection?


I've scanned with NortonAntivirus 2004, Spybot 1.3, AdAware SE, Online Trojan scan GFI, and several other online viral scans.

All that shows up in these scans are some tracking cookies.

Thanks in advance:

-Eliuri

*********************

Windows ME

IE 6.0 SP 1 with all critical updates

Norton AntiVirus 2004

Norton Personal Firewall 2003

Spybot 1.3

AdAware SE

Edited by eliuri, 24 May 2005 - 06:36 PM.

[Advertisements]

Hello and welcome to Geeks to Go! I'm kool808

Temp folder is where temporary files(pictures,cookies,etc.) are stored by IE each time it visits a webpage. This way when it comes back to that page again it does not need to reload that file from the server but instead just reload from your hard disk (temp folder). However, some of the files lurking around it are malicious files used by malwares to hide themselves and inflect damage (that depends on the website you visited).

Here is a freeware program CleanUp, found on my signature below, download and install. This safely clears up temp files, cookies, recent list, etc. Visit the link I provided and learn more info.

Edited by kool808, 24 May 2005 - 10:33 PM.

[kool808]

Hello and welcome to Geeks to Go! I'm kool808

Temp folder is where temporary files(pictures,cookies,etc.) are stored by IE each time it visits a webpage. This way when it comes back to that page again it does not need to reload that file from the server but instead just reload from your hard disk (temp folder). However, some of the files lurking around it are malicious files used by malwares to hide themselves and inflect damage (that depends on the website you visited).

Here is a freeware program CleanUp, found on my signature below, download and install. This safely clears up temp files, cookies, recent list, etc. Visit the link I provided and learn more info.

Edited by kool808, 24 May 2005 - 10:33 PM.

[eliuri]

Thanks Kool

Kool wrote:

However, some of the files lurking around it are malicious files used by malwares to hide themselves and inflect damage (that depends on the website you visited).

My major concern in my post was whether the fact that eight subfolders within the Temporary Internet Files\CONTENTS.IE5 folder are regenerated so quickly after I delete them. This happens within minutes of browsing the internet.

Does this phenomenon in itself suggest that there may be some malware on the PC?


I don't seem to have any difficulty manually deleting temporary files, but I may try that CleanUp tool you mentioned. I am a bit hesitant as it also deletes items in the registry. I try to avoid altering the registry, knowing so little about it...

So far all scan with the AV and AntiSpy scans mentioned below haven't shown anything. [Other that a few tracking cookies...]

I've scanned the entire PC with:

--Norton AntiVirus 2004

--Spybot S&D 1.3

--AdAware SE

--MacAfee online AV scan

--Symantec Security online AV scan

--GFI online Trojan scan.

No threats were found.


-Eliuri

Edited by eliuri, 24 May 2005 - 11:07 PM.

[kool808]

If you are unsure that malwares are in your PC please take this advices:

First I need you to read and install the files HERE.
Follow the recommended configurations and settings for each applications.

RUN in the following order in Safe Mode:
1. Run CleanUp at least twice
2. Run Ad-Aware
3. Run CWShredder
4. Run Spybot S&D

Even the best antispyware programs are only able to remove about 70% of infections. Also, the line between spyware and trojans is getting blurred. You can never be too careful with these, I recommend at least one online scan.

Now, REBOOT in Normal Mode and have an On-line scan at this sites: Trend Micro or Panda Scan.

REBOOT.

Then we'll need you to use a free diagnostic tool (HiJackThis) and post a log HijackThis Log <username> - Please Diagnose as a new topic in the HijackThis Forum. It will get a better response there from the people most qualified to analyze logs.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.