New
#11
Malware? I doubt if a bona fide program would delete files without sending them to the recycle bin.
I will have to keep an eye on things on the suspicion that I have a malware infection.
Hello @jsampson45,
I carried on investigating this for you.
TMP
is exactly the same asTEMP
as far as thePath
[ Folder ] is concerned, and appears to be left over from Win Vista and Win 7. Some programs still use or create theTMP
folder if it isNOT
already present, although this mainly applies to older programs that get downloaded asTEMP
is the standard these days.
In order to prove that BOTH theTMP
andTEMP
folders exist in theEnvironment Variables
, although theTMP
folder doesNOT
necessarily exist on every ones system. I wrote a Script to list theEnvironment Variables
. The advantage of the Script is that it doesNOT
cut the end off of the lines of the output, whereas running just the command does.
Strangely enough, I used theTEMP
folder for manipulations.
The Script will output anEnv_Variables.log
file on your Desktop. If you have a re-located Desktop, then obviously change thePath
accordingly for theOFN
variable.
Copy & Paste
the below into the CMD Prompt and pressEnter
.
Code:@echo off set "OFN=%UserProfile%\Desktop\Env_Variables.log" set "OUT=%Temp%\OUT.log" if exist %OFN% (del /f /q %OFN% >nul 2>&1) if exist %OUT% (del /f /q %OUT% >nul 2>&1) >> %OUT% PowerShell "Get-ChildItem Env:* | Sort-Object Name | Format-Table -Autosize | Out-String -Width 1000" findstr /rc:"[^ <Tab>]" %OUT% >> %OFN% & del %OUT% echo. & echo ^>Press ANY key to EXIT . . . & pause >nul & Exit
These are theEnvironment Variables
that I have on my system . . .
Code:Name Value ---- ----- ALLUSERSPROFILE C:\ProgramData APPDATA C:\Users\System-Admin\AppData\Roaming CommonProgramFiles C:\Program Files\Common Files CommonProgramFiles(x86) C:\Program Files (x86)\Common Files CommonProgramW6432 C:\Program Files\Common Files COMPUTERNAME System-Admin-LT ComSpec C:\Windows\system32\cmd.exe DriverData C:\Windows\System32\Drivers\DriverData FPS_BROWSER_APP_PROFILE_STRING Internet Explorer FPS_BROWSER_USER_PROFILE_STRING Default HOMEDRIVE C: HOMEPATH \Users\System-Admin LOCALAPPDATA C:\Users\System-Admin\AppData\Local LOGONSERVER \\System-Admin-LT NUMBER_OF_PROCESSORS 2 OFN C:\Users\System-Admin\Desktop\Env_Variables.log OneDrive C:\Users\System-Admin\OneDrive OS Windows_NT OUT C:\Users\SYSTEM~1\AppData\Local\Temp\OUT.log Path C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files (x86)\AOMEI\AOMEI Backupper\6.5.0;C:\Users\System-Admin\AppData\Local\Microsoft\WindowsApps; PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL PROCESSOR_ARCHITECTURE AMD64 PROCESSOR_IDENTIFIER Intel64 Family 6 Model 37 Stepping 5, GenuineIntel PROCESSOR_LEVEL 6 PROCESSOR_REVISION 2505 ProgramData C:\ProgramData ProgramFiles C:\Program Files ProgramFiles(x86) C:\Program Files (x86) ProgramW6432 C:\Program Files PROMPT $P$G PSModulePath C:\Users\System-Admin\Documents\WindowsPowerShell\Modules;C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules PUBLIC C:\Users\Public SESSIONNAME Console SystemDrive C: SystemRoot C:\Windows TEMP C:\Users\SYSTEM~1\AppData\Local\Temp TMP C:\Users\SYSTEM~1\AppData\Local\Temp USERDOMAIN System-Admin-LT USERDOMAIN_ROAMINGPROFILE System-Admin-LT USERNAME System-Admin USERPROFILE C:\Users\System-Admin windir C:\Windows
Do you have these two on your system? . . .
Code:TEMP C:\Users\SYSTEM~1\AppData\Local\Temp TMP C:\Users\SYSTEM~1\AppData\Local\Temp
I really hope this helps as this has taken quite a while to compile for you.
Last edited by Paul Black; 05 Aug 2022 at 17:09.
[The arrangement for giving replies seems complicated so where this will go I am not sure]
I have run your script and I see both TEMP and TMP environment variables pointing to a folder Temp at Appdata\Local\
The log file should be attached to this posting.
Many thanks for the time you are putting into this matter.
Kind regards
John S.
In this video, i will show you the way to restore data using Windows Shadow Copy.
Here you can download the latest version of ShadowExplorer: ShadowExplorer.com - Downloads
Hello @jsampson45,
The.log
file looks OK.
Have you got aSystem Image
with the folder in that you couldMount
and retrieve it?
Thanks for all the time you have spent on this, but it is more than I would spend. Life is short for both myself and my client so I have worked round the problem. I do not need the files now.
Now that I know that files disappear I will need to be alert and not use the temp or tmp folders. Lesson learned. I would be interested to know why it happens, but if there is no ready answer I don't want to spend much time on fruitless investigations.
Hello @jsampson45,
You are very welcome, and I understand what you mean. I am glad that you have found a workaround.
That's why whenever I use them in a Script, they are ONLY there momentarily.
Please mark this Thread asSolved
.