[SOLVED] Suspicious Temp File ?

Status
Not open for further replies.
Oct 20, 2020
4
0
10
0
Hello.
Before i came to this forum i ofcourse did my own research and found out this temp file im talking about seems to be legitimate in windows10, anyways i would like to get help from professionals here, to explain why this temp file is created and what the content does.
When i delete this temp file it is comming back every few days but my computer does function well without it, so why do i need it?
Is there any way to stop this file from appearing again and over again?

Here the directory: C:\Users\Username\AppData\Local\Temp\randomnumberandletters
In my case: ECE9D82B-E8BA-41C1-A87A-E5E23A9912E9
Can this numbers and letters be translated like decoded to something that makes any sense? Id like to find out what this means.
Here two screenshots from the file and its content:
https://i.postimg.cc/2jyHHL36/Screenshot-118.png
 

Colif

Win 10 Master
Moderator
You can set when it scans. If you do a manual one, it won't do one. It checks to see when the last one was... I think.
Windows Defender regularly scans your PC to help keep it safe. To choose when and how often you want to scan your PC, use the Task Scheduler.
  1. Search for and open Schedule tasks.
  2. In the left-hand menu, open the Task Scheduler Library, then select Microsoft > Windows > Windows Defender.
  3. Double-click Windows Defender Scheduled Scan.
  4. Select the Triggers panel and then select New.
  5. Now choose when you want to scan and how frequently.
  6. “Begin the task” (daily, weekly, on idle, et)
  7. I Set up two Dailey’s one at 2:30AM, one at 10:AM
  8. Select OK to add each trigger.
https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings-winpc/how-to-schedule-a-full-scan-with-windows-10/ec30ddf0-ff36-4bc8-96fb-1fa03b376801

or you can use a 3rd party AV that replaces it, that is what I did.
 

Colif

Win 10 Master
Moderator

Colif

Win 10 Master
Moderator
You can set when it scans. If you do a manual one, it won't do one. It checks to see when the last one was... I think.
Windows Defender regularly scans your PC to help keep it safe. To choose when and how often you want to scan your PC, use the Task Scheduler.
  1. Search for and open Schedule tasks.
  2. In the left-hand menu, open the Task Scheduler Library, then select Microsoft > Windows > Windows Defender.
  3. Double-click Windows Defender Scheduled Scan.
  4. Select the Triggers panel and then select New.
  5. Now choose when you want to scan and how frequently.
  6. “Begin the task” (daily, weekly, on idle, et)
  7. I Set up two Dailey’s one at 2:30AM, one at 10:AM
  8. Select OK to add each trigger.
https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings-winpc/how-to-schedule-a-full-scan-with-windows-10/ec30ddf0-ff36-4bc8-96fb-1fa03b376801

or you can use a 3rd party AV that replaces it, that is what I did.
 

gardenman

Admirable
Moderator
I have no (known) issues with Defender. I occasionally run it manually. These files still show up. Since it's"DISM", it's likely to be from Microsoft itself. I know malware could use the same filename, but I'm pretty sure my system is clean.
 

Colif

Win 10 Master
Moderator
tenforums suggest sfc/dism

Run CMD as admin and copy/paste:

chkdsk /scan
Dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow
Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase
cleanmgr /sageset:65535 & cleanmgr /sagerun:65535
https://www.tenforums.com/general-support/54973-dismhost-exe-recursively-recreating-itself.html

this shows it can be caused by windows update not running - https://www.bleepingcomputer.com/forums/t/604648/dlls-muis-dismhostexe-re-appearing-in-temp-folder/
 

gardenman

Admirable
Moderator
The first link is a different issue. That's if it's re-creating itself over and over very quickly, taking up a huge amount of space. Mine isn't. I'm not sure about the OP but that didn't seem to be the issue in the original post. Mine also shows up every day or so.

I also want to mention that I monitor this folder and have for the past few years. I always clean it out before each monthly backup, so the files are almost always there. I've never seen more than 20 copies at a time.

My Windows Update is doing fine.

I don't want to run SFC because I do have modified system files that I don't want replaced (specifically WinHelp.exe since I require the older WinHelp for Borland C++ Builder 5). It could help the OP though.

I still think they are normal because I have seen them on my system for years, but I have no proof. If there are other Defender users who watch this folder often, maybe they will chime in.

Here's a better view of my Temp folder:


DismHost is in 9 of those 10 folders. The 3rd one is empty. It looks like it shows up about every day. Sometimes it skips a day. Sometimes twice a day. I think that's about how often Windows Defender is updated, but... that's only a guess.
 
Oct 20, 2020
4
0
10
0
Thanks everyone for sharing your informations.
Now i can stop deleting this file and let it be.

I downloaded process explorer from sysinternals, seems like a usefull tool.
 
Last edited:

gardenman

Admirable
Moderator
Just a quick update.

A Windows Update which included a Defender update did not create the folder yesterday.

A Defender scan did not create the folder yesterday.

I woke up early today and setup my computer to run for 3 hours then automatically go back to sleep, then I went back to bed. 2 folders were created. One when I woke up. One when the PC went back to sleep. Both with DismHost.exe.

Yet when I got back up later and woke the PC up again, another folder was not created.
 

Colif

Win 10 Master
Moderator
interesting fact. Windows update will fail if the temporary folder is moved.
https://social.technet.microsoft.com/Forums/ie/en-US/1a99a1ae-72a4-47ee-b53a-0126176dbac4/dismwindows-updates-failing-when-temporary-folder-moved?forum=winserverManagement

Clearly DISMHost is there on purpose.

finds link saying its not part of windows but is crucial. Yes, DISM is part of windows lol.

its likely its in more than 1 place - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows
 
Status
Not open for further replies.

ASK THE COMMUNITY

TRENDING THREADS