what are these files from

Discussion in 'Computer Support' started by Chris Hunt, Dec 6, 2004.

  1. Chris Hunt

    Chris Hunt Guest

    I was searching through my windows directory and found thousand of files
    stating with what Ive shown below. is this a virus gone wrong. where the
    heck are they coming from and if there coming from a program I use is there
    a way to direct then to another folder that microsoft windows cleans up??

    fffeff5_{}.tmp
    note :the files have o kb size and also the {} holds a registry like number
    code inside. but each ones different

    thanks for your help
    Chris
     
    Chris Hunt, Dec 6, 2004
    #1
    1. Advertisements

  2. Chris Hunt

    Valverdez Guest

    #fffeff. That translates to red:255 green:254 blue:255 for decimal RGB
    system color values... I don't think that is what they are but that is what
    they look like. Are all these thousands of files in one directory? If so,
    move the directory and see what happens after a few days. If the system
    does not ask for the files, if after checking the original directory, more
    are not created, delete them, they are tmp files after all, they should not
    be missed. As to how they got there in the first place, not a clue.

    Valverde
     
    Valverdez, Dec 6, 2004
    #2
    1. Advertisements

  3. Chris Hunt

    °Mike° Guest

    Are they in your temporary folder?


     
    °Mike°, Dec 6, 2004
    #3
  4. Chris Hunt

    Chris Hunt Guest

    no they are in my windows directory

     
    Chris Hunt, Dec 6, 2004
    #4
  5. Chris Hunt

    °Mike° Guest

    Boot into Safe Mode, highlight each and every
    one of them (they are zero byte and they have
    a .tmp suffix, so they are safe to delete in Safe
    Mode), and then delete them -- see the link in
    my signature. Boot back into normal mode
    and scan your system for adware, malware,
    viruses etc. Use AT LEAST two different online
    antivirus scanners:
    http://housecall.trendmicro.com/housecall/start_corp.asp
    http://www3.ca.com/virusinfo/virusscan.aspx
    http://security.symantec.com/sscv6/default.asp
    http://us.mcafee.com/root/mfs/default.asp


    Download, update and use ALL of the following -- even
    if you already have them installed, UPDATE THEM NOW.
    Malware changes by the day, even by the hour, so you MUST
    have the latest version of removal tools:

    Spybot Search & Destroy
    http://www.safer-networking.org/en/index.html
    SpyBot S&D guide
    http://www.chem.wisc.edu/~network/spybot/

    Ad-Aware SE
    http://www.lavasoftusa.com/
    Ad-Aware VX2 cleaner plug-in
    http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml
    IMPORTANT NOTICE:
    http://www.mvps.org/winhelp2002/hosts.htm#Attention

    Spyware Blaster
    http://www.javacoolsoftware.com/spywareblaster.html

    CWShredder (CoolWebSearch remover)
    http://cwshredder.net/cwshredder/cwschronicles.html
    Now maintained by InterMute
    http://www.intermute.com/spysubtract/cwshredder_download.html


    <snip>
     
    °Mike°, Dec 6, 2004
    #5
  6. Chris Hunt

    Chris Hunt Guest

    if only it was that simple.I cleared out them all last month and they
    return.

    if it help in any way on of the many file names it calls itself is

    fffd3b89_{BC76FEC9-6087-48EB-B600-56362CC62A}.tmp

    origional location c:\windows

    does that give anymore of a clue to it??
     
    Chris Hunt, Dec 6, 2004
    #6
  7. Chris Hunt

    why? Guest

    You have what version of MS Office. Some where in the dim and distant
    past IIRC there is a MS KB article for this filename.

    Here you go, 5 seconds after typing in www.google.com and a few keywords
    Web Results 1 - 10 of about 156,000 English pages for
    microsoft office temp file registry key
    (0.36 seconds)


    http://support.microsoft.com/kb/q221438/
    Files with names that begins with "fff" appear in your Windows folder
    after you install Office 2000

    SYMPTOMS
    After you install Office 2000, you may notice files whose name begins
    with "fff" appearing in your Windows folder. For example, the file name
    may be similar to "fffeeecf_{44BE8B61-235B-11D2-8E66-D59A4E66D32D}.tmp".
    Also, every time you restart your computer, two more files beginning
    with "fff" appear in your Windows folder.


    read the rest for yourself.


    Me
     
    why?, Dec 6, 2004
    #7
  8. Chris Hunt

    why? Guest

    Interesting......

    <snip>

    Me
     
    why?, Dec 6, 2004
    #8
  9. Chris Hunt

    °Mike° Guest

    On Mon, 06 Dec 2004 20:11:30 GMT, in
    <>
    why? scrawled:

    Darn, I have that link bookmarked, too. Well spotted.
     
    °Mike°, Dec 6, 2004
    #9
  10. Chris Hunt

    Valverdez Guest

    Dude, nice one, I never heard of that...

    Valverde
     
    Valverdez, Dec 6, 2004
    #10
  11. Chris Hunt

    why? Guest

    Just never ask me to remember holidays, birthdays etc.

    Me
     
    why?, Dec 6, 2004
    #11
  12. Chris Hunt

    why? Guest

    YW.

    Me
     
    why?, Dec 6, 2004
    #12
  13. Chris Hunt

    °Mike° Guest

    Me too; I can just about remember my own birthay.
     
    °Mike°, Dec 6, 2004
    #13
  14. Chris Hunt

    Chris Hunt Guest

    thank you for your assitance. apparently to you it was stupid, but I was
    unaware of this being a microsoft problem (amongf other things that could go
    wrong). but just to double check if i've got this right beacaue it sound
    like the MS link you gave me sounded like more then one file that had to be
    edited. it was just the one saying mdm.exe ??

    thanks for the info

     
    Chris Hunt, Dec 7, 2004
    #14
  15. Chris Hunt

    why? Guest

    Would you care to explain ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ there is
    nothing in any of my posts to suggest anything like this.
    Read the article, I have never had that problem nor read the article.
    http://groups.google.com see what others have said.

    Searched all groups Results 1 - 10 of 385 for
    q221438 (0.09 seconds)
     
    why?, Dec 7, 2004
    #15
  16. Chris Hunt

    Chris Hunt Guest

    i got the impreesion that you had said I should have used other methods
    before looking here. this was the first place I thought to look.

    "Here you go, 5 seconds after typing in www.google.com and a few keywords
    Web Results 1 - 10 of about 156,000 English pages for
    microsoft office temp file registry key
    (0.36 seconds) "

    this may not have ment to be interpreted this way but I did. the forum im
    usaly in would have shown that as sarcasm as of the question being asked
    too many times.

    but i do thank you for your assitance and it seems to have stoped the files
    for the moment. but atleast now i know what they are from.


     
    Chris Hunt, Dec 8, 2004
    #16
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.