# Weird temp file

**URL:** <https://forums.suse.com/t/weird-temp-file/27733>\
**Category:** Chatting over the Back Fence\
**Created:** [December 16, 2015, 9:14pm UTC](https://forums.suse.com/t/weird-temp-file/27733 "2015-12-16T21:14:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\
**Post date:** [December 16, 2015, 9:14pm UTC](https://forums.suse.com/t/weird-temp-file/27733/1 "2015-12-16T21:14:49Z")

</div>

We’ve been getting some weird possible virus notifications from a  
couple machines.

The file is c:\windows\temp\WAX\*\*\*\*.tmp where the \*\*\*\* is some random  
string. Happens on win7, 8, and 10, but very sporadic.

Looking at a machine that generates this notification, that file does  
not exist, it’s not in the anti-virus quarantine, and according to the  
a/v logs, no file of that name was detected on the machine ever.

Been searching for some answers, just thought I’d drop a line here to  
see if anyone has run into something like this and has any ideas.

–  
Stevo

---

<div class="post-metadata">

**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\
**Post date:** [December 16, 2015, 9:37pm UTC](https://forums.suse.com/t/weird-temp-file/27733/2 "2015-12-16T21:37:24Z")

</div>

Fire up procmon and have it watch things that happen in c:/windows/temp  
for a long time until something shows up, and then it should show the  
process doing that. Obviously you need to have this run until something  
shows up, since it is a real-time monitor.

–  
Good luck.

If you find this post helpful and are logged into the web interface,  
show your appreciation and click on the star below…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\
**Post date:** [December 16, 2015, 10:57pm UTC](https://forums.suse.com/t/weird-temp-file/27733/3 "2015-12-16T22:57:37Z")

</div>

ab sounds like they ‘said’:  
[color=blue]

> Fire up procmon and have it watch things that happen in  
> c:/windows/temp for a long time until something shows up, and then it  
> should show the process doing that. Obviously you need to have this  
> run until something shows up, since it is a real-time monitor.[/color]

So my response to ab’s comment is…

Really weird thing is, the last few this has happened on, no one had  
been logged into the machine, the one today had not been logged into  
for almost two weeks.

–  
Stevo

---

<div class="post-metadata">

**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\
**Post date:** [December 16, 2015, 11:28pm UTC](https://forums.suse.com/t/weird-temp-file/27733/4 "2015-12-16T23:28:05Z")

</div>

You’re running windows; if nothing else the hackers are logged in the  
entire time. Even if this box were not hacked, you’d still have things  
running 24x7; it’s a computer after all.

–  
Good luck.

If you find this post helpful and are logged into the web interface,  
show your appreciation and click on the star below…