NODXXXX.TMP Files

Discussion in 'NOD32 version 2 Forum' started by Hexaguano, Nov 22, 2005.

Thread Status:
Not open for further replies.
  1. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    I've been deleting these files for quite a while now. Before I discovered them, I had ~250 of these jewels. Shouldn't NOD clean up after itself or am I the only one with this issue?

    They are located on the system disc under \Windows\Temp (see attached)
     

    Attached Files:

  2. WSFuser

    WSFuser Registered Member

    Joined:
    Oct 7, 2004
    Posts:
    10,632
    strange, my windows\temp directory is empty. i didnt think programs still used that folder.
     
  3. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    I didn't either, both both PCs with NOD exhibit this same problem (both running XP and both using Blackspear's settings). I would like to get to the bottom of it...
     
  4. GWA

    GWA Registered Member

    Joined:
    May 21, 2005
    Posts:
    59
    Location:
    Albuquerque, New Mexico
    Yea, I just found 150 (+) of them and deleted them. Same situation.
     
  5. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    Glad I'm not the only one, GWA. I run daily scans and at 6 .tmp files per day, it quickly adds up. Hope some Eset helpers take a peek...
     
  6. WSFuser

    WSFuser Registered Member

    Joined:
    Oct 7, 2004
    Posts:
    10,632
    do u use outlook to receive email?
     
  7. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    Hmm.. No nod .tmp files on my pc - Then again, I don't use Outlook or any email app, only web-based.
     
  8. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Maybe a scan of an archive was interrupted suddenly ? If the scan was actually completed successfully these files would have been removed.
     
  9. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    Marcos,

    Attached is the scan log from the most recent scheduled scan. The scan logs for the past month look similar.

    The Event Log gives this detail each time that the scheduled scan completes. The time of scan completion (log file), the modification time stamp of the NODXXXX.tmp files, and this event coincide to the second.

    Event Type: Information
    Event Source: HHCTRL
    Event Category: None
    Event ID: 1903
    Date: 11/23/2005
    Time: 5:29:44 AM
    User: N/A
    Computer:
    Description:
    The description for Event ID ( 1903 ) in Source ( HHCTRL ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: http://go.microsoft.com/fwlink?LinkID=45839.
     

    Attached Files:

  10. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    Like clockwork, six more .tmp files in \Windows\Temp.

    Attached is the Scan Log...
     

    Attached Files:

  11. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    More data...

    Ran two scans each,

    1) In-Depth Analysis
    2) "Run Now" using my sheduled scan. It uses the following parameters:
    /local /adware /ah /all /arch+ /clean /cleanmode /delete /heur+ /log+ /mailbox+
    /pack+ /quarantine /scanboot+ /scanmbr+ /scanmem+ /scroll+ /sfx+ /unsafe /wrap+ /quit+

    Each time,
    The In-Depth scan left 0 .tmp files
    The "Run Now" method left the 6 .tmp files

    To help narrow this down, what parameters does the "In-Depth" scan use?
     
  12. Hexaguano

    Hexaguano Registered Member

    Joined:
    Jan 4, 2005
    Posts:
    100
    Update - Problem Solved!

    Upon further investigation, I determined that the undeleted NODXXXX.tmp files remained as a result of scanning certain files (some .dll files from Wilson WindowWare). These files were then submitted to NOD32 support for analysis. They too found that they caused the problem and promptly updated the Archive Support Module (v1.036). Since that time, no more NODXXX.tmp files!

    Thanks Nigel!
     
Thread Status:
Not open for further replies.