are these temp files legit? CR_FD3F0.tmp, SETUP_PATCH.PACKED.7z

[Keyes]

I found the .tmp folder in appdata/local/temp, and inside was the 7z file setup_patch.packed.7z


Also, in windows/temp there was another .7z file by the same name. The .tmp folder and file had been created at the same time of a google chrome update (same minute). The other .7z file in windows temp was made about10 days go, and I think there was a new update then aswell.


I uploaded the files to virus total. The detection for both was 0/55 however one of them had a negative downvote.
Are these legimate files? The one in windows temp was about 4kb, and the one in the .tmp folder was 2kb.


Using Event Viewer for the first .7Z file, I could find the gupdate service (google updater) was active within 10s of seconds of when these files were modifiedand ceqted. For the second one that was in windows/temp/(another cr_xxxx) I couldnt find a gupdate log in event viewer, howver I found a log for service control manager stating the google update service entering a running state, 20 seconds before the file was created.


It seems to me its googles bidding but I would like a second opinion, thank you

 

[HarriePateman]

Well SETUP_PATCH.PACKED.7z, would indicate there are illegal things on your computer does anyone else have access to your PC, or is it new?

 

[Keyes]

Why would it indicate that? It only appeared after a google chrome update and as I said it is only 2kb. If ypu search it on google one of the first results is about google update, but I want to get clarification. There is also a chrome.7z file (not in local temp). Unless chrome is somehow illegal?

 

[HarriePateman]

Well the Patch is a term used in counterfiet software, i mean its possible its legit.

However an update by Google chrome, would not use the term " Patched"

 

[Keyes]

Do you use chrome? If you could, search for .7z on drive. Do any such files appear? If not, if you check shadow volume copies of appdata/local/temp and windows/temp

They dont seem to be the actual update file. But the file was created literally within, if not the same second as a new Google update came in, and when the gupdate service started according to google. I dont use any utorrent or pirates bay for obvious security reasons, and dont download any illegal patches.

 

[Keyes]

https://code.google.com/p/chromium/issues/detail?id=30402


As you can see there is reference to it here in a different context, so im trying to confirm whether it is a legit file.

 

[HarriePateman]

Yeah i have he same, dont worry there legit

 

[Keyes]

Yeah i have he same, dont worry there legit

What directories do you have them in? And are some of them in .tmp folders?

 

[HarriePateman]

Yeah there in the TEMP Folder

 

[Keyes]

Yeah there in the TEMP Folder

Does that include windows/temp and local/temp ? And they in the cr_xxxxx.tmp folders within the above temp folders? E.g

Windows/temp/cr_f6o7d.tmp/setup_patch.packed.7z?

 

[HarriePateman]

There in CR_XXXXXXX

 

[Keyes]

There in CR_XXXXXXX

Would you be able to give an example? Mine is CR_FD3F0.tmp

 

[HarriePateman]

Dont worry about the files, there legit.

The numbers would be different as there Temp.

 

[Keyes]

Dont worry about the files, there legit.

The numbers would be different as there Temp.

Well I know they're temp but does yours have 5 characters? E.g cr_xxxxx.tmp or more Xs? Sorry if im being very picky, its just you wrote xxxxxxx so I thought you meant 7?

 

[HarriePateman]

No, its the same is yours only with different letters and numbers

 

[Ztruker]

Why not just post the full file name and path instead of going round and round with this ?
Not a criticism, just curious.

 

[HarriePateman]

Good point, however we are finished now

 

[Keyes]

No, its the same is yours only with different letters and numbers

Okay so to clairfy, were they in both temp folders mentioned above (local/temp and or windows/temp?), and they were in a format of cr_xxxxx.tmp, and had the .7z file in them?

I apologise for asking so much, i just get paranoid easily and look too far into these things.

 

[HarriePateman]

No, its the same is yours only with different letters and numbers

Okay so to clairfy, were they in both temp folders mentioned above (local/temp and or windows/temp?), and they were in a format of cr_xxxxx.tmp, and had the .7z file in them?

I apologise for asking so much, i just get paranoid easily and look too far into these things.

Its fine dont worry

Yes they are the same as yours, nothing to worry about mate.