Strange 4 digit files downloaded.

Page 1 of 2 12 LastLast

  1. AJP
    Posts : 5
    Windows 10
       #1

    Strange 4 digit files downloaded.


    On my windows 10 machine I notice every couple of days a file is downloaded to my app data,local, temp folder.
    These files have names such as 4179, 8932 or 6745 and vary in size from 240MB to 1,700MB. There is no indication where they have come from. I have run Bitdefender, Norton, Malwarebytes with no infection found. Can anyone shed any light on what they are? Thanks
      My Computer


  2. Posts : 35,508
    Win 10 Pro (21H2) (2nd PC is 21H2)
       #2

    Hi, suggest you start by identifying the process or program that downloaded them.

    By the way, are you sure these were downloaded from the Internet? How do you know?

    If so and you wish to record this over time, you could try e.g. Networx -free
    Example:
    Strange 4 digit files downloaded.-snap-2019-09-17-08.36.09.png
    You can see, for example, my small email client poppeeper received some data- I just checked for email.

    Download NetWorx 6.2.5
      My Computers


  3. AJP
    Posts : 5
    Windows 10
    Thread Starter
       #3

    Thank you Dalchina. I notice these files when I open firefox and see that the download arrow has turned blue (indicating a download has been completed.) and by clicking on location I find them in app data,local,temp. I will try NetWorx, thanks.
      My Computer


  4. Posts : 35,508
    Win 10 Pro (21H2) (2nd PC is 21H2)
       #4

    That's very odd... as it seems you know they are downloaded via Firefox, Networx won't tell you more, i think.

    Could the download be triggered because FF is restoring a previous session?
    Restore previous session - Configure when Firefox shows your most recent tabs and windows | Firefox Help

    If you are experiencing this with Firefox, try starting it in safe mode- that used to be possible from a command prompt, but it seems now the only way is to launch FF then immediately restart it in safe mode - which to me seems daft, but there we are.
    Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems | Firefox Help

    You could disconnect or disable your internet and then launch FF in safe mode and reconnect/enable I suppose to avoid starting such a download when launching FF.
      My Computers


  5. AJP
    Posts : 5
    Windows 10
    Thread Starter
       #5

    Yes it does seem to be FF. It is also worth noting that the download is not going to the specified FF download folder. I will try all that you have suggested and monitor the situation. I take it that you have never come across files with just a four digit title? Thanks.

    - - - Updated - - -

    Just gone into it in depth and note that the ip address the files are downloaded from is 78.157.200.194
      My Computer


  6. Posts : 35,508
    Win 10 Pro (21H2) (2nd PC is 21H2)
       #6

    % This is the RIPE Database query service.
    % The objects are in RPSL format.
    %
    % The RIPE Database is subject to Terms and Conditions.
    % See http://www.ripe.net/db/support/db-terms-conditions.pdf

    % Note: this output has been filtered.
    % To receive output for a database update, use the "-B" flag.

    % Information related to '78.157.200.192 - 78.157.200.207'

    % Abuse contact for '78.157.200.192 - 78.157.200.207' is '[email protected]servers.com'

    inetnum: 78.157.200.192 - 78.157.200.207
    netname: NOE001
    descr: NOE001
    country: GB
    admin-c: DH1778-RIPE
    tech-c: DH1778-RIPE
    status: ASSIGNED PA
    mnt-by: UKSERVERS-MNT
    created: 2019-07-17T11:55:04Z
    last-modified: 2019-07-17T11:55:04Z
    source: RIPE

    person: David Howes
    address: UK Dedicated Servers Ltd
    address: 61 Somers Road Industrial Estate
    address: Rugby
    address: Warwickshire
    address: CV22 7DG
    mnt-by: UKSERVERS-MNT
    phone: +44 (0)870 067 2522
    nic-hdl: DH1778-RIPE
    created: 2007-04-23T09:45:22Z
    last-modified: 2017-10-30T21:54:49Z
    source: RIPE

    % Information related to '78.157.192.0/19AS42831'

    route: 78.157.192.0/19
    descr: UK Dedicated Servers Limited
    org: ORG-UDSL2-RIPE
    origin: AS42831
    mnt-by: UKSERVERS-MNT
    created: 2013-08-01T11:08:35Z
    last-modified: 2013-08-01T11:08:35Z
    source: RIPE

    organisation: ORG-UDSL2-RIPE
    org-name: UK Dedicated Servers Limited
    org-type: LIR
    address: 61 Somers Road Industrial Estate
    address: CV22 7DG
    address: RUGBY
    address: UNITED KINGDOM
    phone: +448700672522
    fax-no: +448712247026
    mnt-ref: RIPE-NCC-HM-MNT
    mnt-ref: UKSERVERS-MNT
    mnt-by: RIPE-NCC-HM-MNT
    mnt-by: UKSERVERS-MNT
    abuse-c: UAM9-RIPE
    created: 2007-04-19T15:29:32Z
    last-modified: 2017-10-30T14:42:45Z
    source: RIPE Filtered
    admin-c: DH1778-RIPE

    % This query was served by the RIPE Database Query Service version 1.94.1 (HEREFORD)
      My Computers


  7. AJP
    Posts : 5
    Windows 10
    Thread Starter
       #7

    Yes and been reported for abuse twice in the last 2 years.
    Will just have to monitor over the next few days. Thanks for your help.
      My Computer


  8. Posts : 35,508
    Win 10 Pro (21H2) (2nd PC is 21H2)
       #8

    If it doesn't happen in FF safe mode then consider any extensions you may have.
    Does it happen if you launch a different browser?
    Make sure you launch FF without restoring a previous session.
      My Computers


  9. AJP
    Posts : 5
    Windows 10
    Thread Starter
       #9

    I'll come back in a few days with a report.
      My Computer


  10. Posts : 35,508
    Win 10 Pro (21H2) (2nd PC is 21H2)
       #10

    And as you know the IP address you could choose to block that- say in the Hosts file.
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 23:15.
Find Us




Windows 10 Forums