Please Help in Identifying Recurring Locked Temp Files

[Maxxwire]

Lately these 3 locked Temp files have been appearing every day even though I unlock and delete them. They are 640KB, 1.8MB and 1.8 MB in size.

The LockHunter program which I have been using to unlock and delete these temp files says that they are being locked by C:Windows\system32\DllHost.exe. I just scanned the computer using both Emmisoft and MBAM while these files were in place and there were 0 detections from either scan.

I just discovered that 3 more files along with Java's hsperfdata temp file have appeared within the last 10 minutes. These have contents of 3.68 MB, 640 KB and 2.25 MB in size.

I'm hoping that someone will be able to identify the source and purpose of these persistent locked temp files that keep showing up in my computer's AppData> Temp file.

Thanks for your help; Maxx

.

 

[Carolyn]

Many programs create temp files. If the scans you have not found any malware, then you have no need to be concerned. It is a good idea, from a maintenance perspective, to clean out temp files from time to time. There accumulation can have a negative effect on system performance.

CCleaner is a very good temp file cleaner

 

[seekermeister]

Most likely, the reason that they are locked, is that they are in use by the app that created them. If you can identify the app, then you may be able to prevent these files by the apps settings.

EDIT: If you can use the right click menu to access their properties, it may identify the app that made them.

 

[Corrine]

Hi, Maxxwire.

Since hsperfdata is a Java file, I suggest that you make sure you have the latest version of Java installed on your computer and that all older/vulnerable versions have been removed. The current version is Java SE Runtime Environment (JRE) 6 Update 25.

I also suggest clearing the Java cache: How do I clear the Java cache?.

 

[Maxxwire]

Corrine- Thanks! Upon your advise I used Revo to uninstall Java v6.0.240.7 (from 4-13-11) and then installed the latest iteration v6.0.650.6.

~Maxx~

.

 

[Maxxwire]

Most likely, the reason that they are locked, is that they are in use by the app that created them. If you can identify the app, then you may be able to prevent these files by the apps settings.

EDIT: If you can use the right click menu to access their properties, it may identify the app that made them.

The details pane available through the context menu gave no clue as to what program created these Temp files, but as you indicated going into the Java Control Panel revealed a way to stop the Java program from storing information on the computer and since I rescinded permission to store files on the computer there have been no such files appear in AppData\Temp which indicates their original source.

I confirmed that these Temp files were placed by the Java program this morning by briefly allowing and then immediately turning off the permission again which created the first 3 of these Temp files since I originally turned off the permission for them to be created on the computer yesterday afternoon.

I have now returned the program which uses Java back to full use and so far only Java's empty hsperfdata folder has appeared. I will post back if any of the Java Temp files show up again...

~Maxx~

.

 

[logicearth]

Is having temporary files that much of an issue?
Do you have an obsessive compulsive disorder?

 

[Maxxwire]

Is having temporary files that much of an issue?
Do you have an obsessive compulsive disorder?

I'm not concerned that there are files in the AppData Temp file because that is what it is used for. What I am most concerned about is the identification of these files. In my experience most temp files are fairly easily identifiable as to the program which placed them there, but since there is absolutely no indication of where these files came from or what they are being used for it raises a level of concern on my part especially after my computer started malfunctioning as it never has before.

Last night Explorer quit working properly so I tried a system restore which has worked every time that I have used it in the past and I was shocked when system restore failed for the very first time ever in Win 7 x64. I was finally able to do a Macruim Reflect image restore at about 4:30 am, but today I just noticed a completely new set of 4 temp files (screenshot attached) appear in addition the perfdata file none of which I've ever seen before and there is absolutely no indication where they came from either so yes, I am concerned about that considering the unprecedented problems I had with the computer last night especially since I have prevented Java from placing any files whatsoever anywhere on the computer which makes me all the more uncertain about what these 11 constantly incarnating files in the AppData Temp folder which so far have appeared as locked files, unlocked files and even an XML file are doing there and if this is related to the most serious malfunction I've had with Win 7 to date which occurred in the midst of the same 24 hour period that all of these before unseen AppData files appeared especially even though the computer continues to scan clean.

~Maxx~

.

 

[Maxxwire]

I want to thank everyone for their help, but I have decided not to continue to use this Java based program any longer in that in the beginning it seemed like a convenient way to download operational files from the internet, but it has turned into such a hassle that I have decided that I will continue to do the download once a day manually (which as it turns out is all the program was doing anyway) which process only takes a couple of minutes anyway. As a result I have uninstalled both the Java based program as well as Java Runtime which I only needed to run that one program with anyway in that my Opera browser already has Java onboard.

Again, thanks for your help, but having the 'convenience' that this program offers is just not worth all the hassle it has become. Hopefully the unique problems that my Win 7 x64 computer has been having during this period will cease and I can get back to enjoying the new Intel 320 SSD I had installed in it just 2 weeks ago.

~Maxx~

.

 

[Maxxwire]

I thought that this was all over after Java was uninstalled, but a few minutes ago another mystery temp file showed up in the AppData Temp file. Both HitmanPro and MBAM say that it is not malware, but interestingly enough during the MBAM scan another temp file shows up next to it and then disappears when the scan is complete. There are as many as 4 more phantom files that will appear briefly and then disappear. I'm really curious now as to where these temp files are coming from and why they have been placed there.

~Maxx~

.

 

[Maxxwire]

I was browsing the Comodo Defense+ log and found these entries from last night from the Windows Installer-

MSI94CD.tmp

MSIDF69.tmp

MSIB2CD.tmp

They can not be searched on Google so I was wondering if anyone any of you were familiar with what they are. I have attached a screen capture.

Thanks for your help. I just may go and re-image the computer to an even earlier date and see if I can get beyond all this...

~Maxx~

 

[Maxxwire]

I re-imaged my computer back as far as I could to the day after I got it back from the shop which was 2 weeks ago nevertheless the fun and games continue as these mysterious temp files which names each begin in ~ which I originally thought were Java temp files appeared once again 8 hours after uninstalling Java and restarting the computer. These are the same type and size as the ones pictured in my first post and I'm asking once again if anyone recognizes them because even though the computer scans clean and is using an image from 2 weeks ago these same locked temp files keep appearing.

One thing that they all have in common is each of their file names begins with ~PI. Can any of you interpret what that might mean?

Thank you so much for bearing with me as I'm hoping that the continued re-occurrence of these kind of locked temp files might somehow be related to some function of the Win 7 OS and one of the Members might be able to identify their true function.

~Maxx~

PS- This just in... I just finished checking out my Vista laptop where I originally started using the program that was using Java Runtime and the AppData file had no folders like the 3 ~PI files I've been seeing in Win 7 lately so it appears that the 3 ~PI files are not Java related at all...

.

 

[logicearth]

Seriously...if you are so OCD about this just use Process Monitor and Process Explorer...

 

[Maxxwire]

logicearth- I frequently see people here on the Forum report new and unfamiliar files that they have not seen before which have appeared on their computer in order to get opinions from the Membership as to what the nature of these new files might indeed be.

This is the first time I have posted this kind of an inquiry here on the Windows 7 Forums or anywhere else in hopes of getting feedback from the Membership as to what the nature of these strange new files might be and so far no one seems to know what these locked temp files are for or by what agency they have appeared so I feel justified in my concern over them as I think any conscientious and computer security minded person would be.

The latest event was early this morning when these locked temp files appeared with such a fury that they deleted the legitimate 1.25 MB GIMP fontconfiguration file from the AppData Temp folder where it had been since the old HDD had been cloned onto the new SSD nearly 3 weeks ago and GIMP's temp file had to be reconfigured.

~Maxx~

.

 

[logicearth]

I'll tell you what these files are then. They are files that start with "~PI" followed by random hex number with an extension of "tmp". You are taking "conscientious and computer security minded person" way overboard. Either past or are bordering on OCD.

Again use Process Monitor.

 

[Corrine]

Maxx, I agree with logicearth -- see what you can find out with Process Monitor. All I'm finding on PID is that it stands for Process ID. I don't know if this is of any value: Temp File Management for PowerShell 2.0 CTP 3.

 

[Maxxwire]

Corrine- Now I see what you guys mean. I've had Process Explorer for several years and up until now I've only used it on running processes, but I searched for each of the ~PI .tmps and found their dllhost.exe PID number of 1960! Your bit of knowledge shared has gone a long way toward helping me to finally understand what is actually going on in my computer and has been of infinite more use than condemnation over my level of concern for the security of my computer and its recently installed SSD which has changed so many things.

It was not easy making all of this public, but as I hoped I got the answer I needed at the Windows 7 Forums and most valuable of all I learned some new Process Explorer skills as a bonus that I will certainly be able to use in the future!

Thanks again!

~Maxx~

.

 

[Maxxwire]

Corrine- 3 new .tmp files just arrived and thanks to your tip on using Process Explorer I was able to check out each one of them! Thanks for the gift of knowledge as to what these .tmp files are although I am still curious as to what their purpose might be on my Win 7 computer and I don't remember seeing them at all before the Intel 320 SSD was installed.

~Maxx~

.

 

[Corrine]

I'm glad I was able to indirectly help, Maxx.

This may help further with dllhost.exe: http://www.processlibrary.com/directory/files/dllhost/22846/

 

[Maxxwire]

Corrine- That was another great link about the dllhost! You know what they say-

If you help someone with their computer security problem it will be solved, but if help them learn to use the right diagnostic tool they can solve their own computer security problems both now and in the future! Every time I use Process Explorer to research a file I will be indebted to you for getting me started.

~Maxx~

.