[SOLVED] Suspicious Temp File ?

[steffanb]

Hello.
Before i came to this forum i ofcourse did my own research and found out this temp file im talking about seems to be legitimate in windows10, anyways i would like to get help from professionals here, to explain why this temp file is created and what the content does.
When i delete this temp file it is comming back every few days but my computer does function well without it, so why do i need it?
Is there any way to stop this file from appearing again and over again?

Here the directory: C:\Users\Username\AppData\Local\Temp\randomnumberandletters
In my case: ECE9D82B-E8BA-41C1-A87A-E5E23A9912E9
Can this numbers and letters be translated like decoded to something that makes any sense? Id like to find out what this means.
Here two screenshots from the file and its content:
https://i.postimg.cc/2jyHHL36/Screenshot-118.png

https://i.postimg.cc/RhJLvfnL/Screenshot-119.png

 

[Colif]

Try using Process explorer to show you what uses the folder - https://www.dariawan.com/tutorials/windows/how-know-which-process-using-file-or-folder-windows/

see my next reply for better answer

 

[MJS WARLORD]

i tried to look at the screen shot and kaspersky flashed up a warning of malicious content not a virus.

Not suggesting you doing anything bad , just reporting what it said.

 

[Colif]

Bitdefender sees no problems with links.

looks at 2nd pic

Hi Pagefile'sys,

I have seen this before, it seems to be caused by Windows Defender not being able to run a scheduled scan

You should manually perform a scan with Windows Defender, which should resolve this for you . . .

https://answers.microsoft.com/en-us...r/9e5e827a-bb95-49d8-bc68-414e143f89d8?auth=1

 

[Mtop]

So Defender runs even when it shouldn't?

 

[Colif]

You can set when it scans. If you do a manual one, it won't do one. It checks to see when the last one was... I think.
Windows Defender regularly scans your PC to help keep it safe. To choose when and how often you want to scan your PC, use the Task Scheduler.

1. Search for and open Schedule tasks.
2. In the left-hand menu, open the Task Scheduler Library, then select Microsoft > Windows > Windows Defender.
3. Double-click Windows Defender Scheduled Scan.
4. Select the Triggers panel and then select New.
5. Now choose when you want to scan and how frequently.
6. “Begin the task” (daily, weekly, on idle, et)
7. I Set up two Dailey’s one at 2:30AM, one at 10:AM
8. Select OK to add each trigger.

https://answers.microsoft.com/en-us...ndows-10/ec30ddf0-ff36-4bc8-96fb-1fa03b376801

or you can use a 3rd party AV that replaces it, that is what I did.

 

[gardenman]

This is normal. I have these folders on my system all the time, in that location. They contain DISM and other files. I assumed they were put there by Windows Update, but I could be wrong.

 

[Colif]

Answer I found suggests its Windows defender puts Dismhost there if a scan isn't finished. running a manual scan is meant to fix it.

 

[gardenman]

I have no (known) issues with Defender. I occasionally run it manually. These files still show up. Since it's"DISM", it's likely to be from Microsoft itself. I know malware could use the same filename, but I'm pretty sure my system is clean.

 

[Colif]

tenforums suggest sfc/dism

Run CMD as admin and copy/paste:

chkdsk /scan
Dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow
Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase
cleanmgr /sageset:65535 & cleanmgr /sagerun:65535

https://www.tenforums.com/general-support/54973-dismhost-exe-recursively-recreating-itself.html

this shows it can be caused by windows update not running - https://www.bleepingcomputer.com/forums/t/604648/dlls-muis-dismhostexe-re-appearing-in-temp-folder/

 

[gardenman]

The first link is a different issue. That's if it's re-creating itself over and over very quickly, taking up a huge amount of space. Mine isn't. I'm not sure about the OP but that didn't seem to be the issue in the original post. Mine also shows up every day or so.

I also want to mention that I monitor this folder and have for the past few years. I always clean it out before each monthly backup, so the files are almost always there. I've never seen more than 20 copies at a time.

My Windows Update is doing fine.

I don't want to run SFC because I do have modified system files that I don't want replaced (specifically WinHelp.exe since I require the older WinHelp for Borland C++ Builder 5). It could help the OP though.

I still think they are normal because I have seen them on my system for years, but I have no proof. If there are other Defender users who watch this folder often, maybe they will chime in.

Here's a better view of my Temp folder:

DismHost is in 9 of those 10 folders. The 3rd one is empty. It looks like it shows up about every day. Sometimes it skips a day. Sometimes twice a day. I think that's about how often Windows Defender is updated, but... that's only a guess.

 

[steffanb]

Thanks everyone for sharing your informations.
Now i can stop deleting this file and let it be.

I downloaded process explorer from sysinternals, seems like a usefull tool.

 

[Colif]

the fixes weren't for you Gardenman, I wouldn't even try to fix your PC

 

[gardenman]

Just a quick update.

A Windows Update which included a Defender update did not create the folder yesterday.

A Defender scan did not create the folder yesterday.

I woke up early today and setup my computer to run for 3 hours then automatically go back to sleep, then I went back to bed. 2 folders were created. One when I woke up. One when the PC went back to sleep. Both with DismHost.exe.

Yet when I got back up later and woke the PC up again, another folder was not created.

 

[Colif]

interesting fact. Windows update will fail if the temporary folder is moved.
https://social.technet.microsoft.co...porary-folder-moved?forum=winserverManagement

Clearly DISMHost is there on purpose.

finds link saying its not part of windows but is crucial. Yes, DISM is part of windows lol.

its likely its in more than 1 place - https://docs.microsoft.com/en-us/wi...nd-management-technical-reference-for-windows