On my windows 10 machine I notice every couple of days a file is downloaded to my app data,local, temp folder.
These files have names such as 4179, 8932 or 6745 and vary in size from 240MB to 1,700MB. There is no indication where they have come from. I have run Bitdefender, Norton, Malwarebytes with no infection found. Can anyone shed any light on what they are? Thanks
Hi, suggest you start by identifying the process or program that downloaded them.
By the way, are you sure these were downloaded from the Internet? How do you know?
If so and you wish to record this over time, you could try e.g. Networx -free
Example:
You can see, for example, my small email client poppeeper received some data- I just checked for email.
Download NetWorx 6.2.5
Thank you Dalchina. I notice these files when I open firefox and see that the download arrow has turned blue (indicating a download has been completed.) and by clicking on location I find them in app data,local,temp. I will try NetWorx, thanks.
That's very odd... as it seems you know they are downloaded via Firefox, Networx won't tell you more, i think.
Could the download be triggered because FF is restoring a previous session?
Restore previous session - Configure when Firefox shows your most recent tabs and windows | Firefox Help
If you are experiencing this with Firefox, try starting it in safe mode- that used to be possible from a command prompt, but it seems now the only way is to launch FF then immediately restart it in safe mode - which to me seems daft, but there we are.
Troubleshoot extensions, themes and hardware acceleration issues to solve common Firefox problems | Firefox Help
You could disconnect or disable your internet and then launch FF in safe mode and reconnect/enable I suppose to avoid starting such a download when launching FF.
Yes it does seem to be FF. It is also worth noting that the download is not going to the specified FF download folder. I will try all that you have suggested and monitor the situation. I take it that you have never come across files with just a four digit title? Thanks.
- - - Updated - - -
Just gone into it in depth and note that the ip address the files are downloaded from is 78.157.200.194
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '78.157.200.192 - 78.157.200.207'
% Abuse contact for '78.157.200.192 - 78.157.200.207' is 'abuse@ukservers.com'
inetnum: 78.157.200.192 - 78.157.200.207
netname: NOE001
descr: NOE001
country: GB
admin-c: DH1778-RIPE
tech-c: DH1778-RIPE
status: ASSIGNED PA
mnt-by: UKSERVERS-MNT
created: 2019-07-17T11:55:04Z
last-modified: 2019-07-17T11:55:04Z
source: RIPE
person: David Howes
address: UK Dedicated Servers Ltd
address: 61 Somers Road Industrial Estate
address: Rugby
address: Warwickshire
address: CV22 7DG
mnt-by: UKSERVERS-MNT
phone: +44 (0)870 067 2522
nic-hdl: DH1778-RIPE
created: 2007-04-23T09:45:22Z
last-modified: 2017-10-30T21:54:49Z
source: RIPE
% Information related to '78.157.192.0/19AS42831'
route: 78.157.192.0/19
descr: UK Dedicated Servers Limited
org: ORG-UDSL2-RIPE
origin: AS42831
mnt-by: UKSERVERS-MNT
created: 2013-08-01T11:08:35Z
last-modified: 2013-08-01T11:08:35Z
source: RIPE
organisation: ORG-UDSL2-RIPE
org-name: UK Dedicated Servers Limited
org-type: LIR
address: 61 Somers Road Industrial Estate
address: CV22 7DG
address: RUGBY
address: UNITED KINGDOM
phone: +448700672522
fax-no: +448712247026
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: UKSERVERS-MNT
mnt-by: RIPE-NCC-HM-MNT
mnt-by: UKSERVERS-MNT
abuse-c: UAM9-RIPE
created: 2007-04-19T15:29:32Z
last-modified: 2017-10-30T14:42:45Z
source: RIPE Filtered
admin-c: DH1778-RIPE
% This query was served by the RIPE Database Query Service version 1.94.1 (HEREFORD)
Yes and been reported for abuse twice in the last 2 years.
Will just have to monitor over the next few days. Thanks for your help.
If it doesn't happen in FF safe mode then consider any extensions you may have.
Does it happen if you launch a different browser?
Make sure you launch FF without restoring a previous session.
Quote
