Search the Community

Hey guys, I noticed a strange folder in my temp folder called BCLTMP containing subfolders with the names of my browsers. Inside of these folders are files that contain my saved favourites, visited urls and searches. After deletion of the BCLTMP folder it appears again after a while, sometimes after a day, a week or a month. After scanning my PC with all the tools I have (which didn't find much and didn't stop the folder appearing) I decided it might be normal.. Then I bought a new laptop which showed the same behavior within the same week I bought it. Nothing was installed on the laptop, no usb used, it had only been connected to my router. I have connected other laptops to my network in the past which showed the same behavior. Could this BCLTMP folder which seems to track my browser history be spyware/malware? No one else seems to have the folder. I am using Windows 10 pro on both devices. I tried scanning with malwarebytes, roguekiller, adwcleaner, eset sysrescue, exterminate it, spydllremover (which reports hidden rootkit, with processID, hidden), superantispyware. tdsskiller won't boot (redownloaded, same result) and comodo CCE crashes the computer and then refuses to boot. Note that the laptop with the BCLTMP folder is a clean windows 10 install with no installed software. My router reports synflood attacks from within and outside of my network, and it's firmware has been reinstalled by the isp just to be sure. Not much else to see there. How can I figure out what is happening to my devices, and what this folder is for?

I can confirm that the 3.4 beta fixes the update failure which was occurring when Windows TEMP/TMP is on a RAM Drive. (As previously reported in the topic "Update Failure IS because of TEMP on RAM Drive" in Malwarebytes 3, Malwarebytes Forums at https://forums.malwarebytes.com/topic/206678-update-failure-is-because-of-temp-on-ram-drive/) During installation, the initial "Runtime Error (at ...): Could not call proc" error message still appears but, after that is acknowledged, installation continues with a request for a Windows re-start so that installation can be completed. After restarting, a prompt is issued asking if the user wishes to run a file from an address in the TEMP directory (on RAM drive). When this is agreed to, installation proper begins and proceeds as would have been expected. For me, the process appears to have completed successfully and resulted in an on-top update from MBAM 3.3.1.2183 to MBAM 3.4.0.2380 Beta. The process was straightforward and I did not need to tamper with any environment variables at all. My previous settings were all preserved apart from the currently usual need to restore the 'Display Language' to my required value. Thank you for the fix.

Runtime Error (at 47:120): Could not call proc =================================== Microsoft Windows 10 Pro x64 Version 1607 (OS Build 14393.1480) My %Temp% and %Tmp% are normally set to a RAM drive, in format 'Z:' (no quotes). Attempting to update, offline, from MBAM 2.2.1.1043 free to MBAM 3.1.2.1733 free using mb3-setup-consumer-3.1.2.1733.exe I repeatedly found that immediately after selecting the language, installation failed with the message: "Runtime Error (at 47:120): Could not call proc" I saw the same behaviour when I tried the mb3-setup-consumer-3.2.0.1959.exe beta installer. Today (Thu 03 Aug 2017) I tried the 3.1 update again but first changed both %Temp% and %Tmp% back to: '%USERPROFILE%\AppData\Local\Temp' (No quotes). I then immediately, without reloading Windows, ran the MBAM 3.1 installer/updater again. It ran right through and appears to have sucessfully updated to MBAM 3.1. I inspected the settings, which appear to be, as far as is applicable, migrated. During the update, MBAM appears to have been completely removed from 'Program Files (x86)' and MBAM 3.1.2.1733 has been installed in 'Program Files' That seemed excellent until I noticed that 'Task Manager' > 'Processes' showed Malwarebytes is running as a 32 bit application, so shouldn't it be in 'Program Files (x86)'? I set my %Temp% and %Tmp% both back to my normal values, directing them to the RAM drive. I then went on line and requested whatever updates were available. (nb Controls for that are not well presented and neither could I clearly see what updates were actually done at that stage) I now see: " Version Information Malwarebytes version: 3.1.2.1733 Component package version: 1.0.160 Update package version: 1.0.2503 " So I am able to report that temporarily switching to the default Temp and Tmp directories fixed the update failure ===================================================================================== and it is proven that otherwise the install/update failed because it couldn't cope with those directories being on the RAM drive. =============================================================================================== I cannot commit to any further testing or diagnostics on this but hope that my information helps. Now I need to actually try running MBAM 3.1 and hope it will behave tolerably well.

Hi, I used hitman pro and several malware files were detected in the Appdata\Local\Temp\ folder. I deleted them only to reboot and it picked up more of the same only different names example: "1234.tmp.exe" after deleting and reboot, 5678.tmp.exe would be found. I don't know where this came from or how to get rid of it. Malwarebytes does not pick it up at all so far. Is this something I should worry about. The info on HitmanPro says it is from Nircmd and NirSoft which I have no idea how it got on my pc unless installing a security feature on an external drive causes a false positive. I would appreciate any help.

So I have this 'Temp' files in my windows folder and I dont know if this is a malware or something inside the 'Temp' folder I have many subfolders and applications with names here are some of the names: Folders:1.6CB1F574-F625-49C1-830B-8C54F5DE8BA7 2.7D8D418C-8391-40B8-9B00-29A179B9D84B 3.AF6666CB-F4D6-49ED-B8E7-BD13942C7C82 applications:1.{1DFE796C-0E04-4A77-86F6-5ECE11DE1951} 2.{1F04A3EA-17A2-4A65-BD35-1BAAF1E1848C} 3.{2AF06F42-95AE-4916-AFB3-6945EB6CF1A2} can somebody tell me if these are malwares or something I cant risk getting this laptop infected also I think there are more than 100 of these files and theres those tmp files:TS_8668, TS_87E0 those two are just one part of many, also, theres this "LOCAL" and "LOCAL1" executable windows command files and I dont want to run them coz theyre probably a virus or something my online realtime protector is Windows defender Most of the folders have "dismhost" Applications and dimhost.dll

Hi, So a couple weeks ago, I installed a suspicious .exe file from an untrusted source. And then I find my computer was infected with malwares. Now in order to use my computer, I uninstall IE and use opera and Edge as explorer. And there are always many strange .tmp and .exe files in /temp/ folder. After scanning with MSE and Malwarebytes, they would be deleted. But days later, they will reappear. Can you please help me solve this situation? Thanks! Addition.txt FRST.txt

So I don't know for how long I have this but I only noticed it today when I was looking through my taskmanager and I saw it's weird name. At first I tried to just delete the exe's but they reappeared afterwards and I don't know what makes them reappear. I tried installing Malwarebytes but this: After that I tried running it through an Admin console and got So then I browsed a bit through the forums and found this ADWCleaner. Tried to run it and got an red screen telling me the app is blocked, but got it running later through an admin console, AdwCleaner[S0].txt Oh and I'm german so if I wrote anything wrong please correct me. Addition.txt FRST.txt

good afternoon, recently my laptop symantec program started sending messages with an oct4ba2.tmp.exe file being reported as having been downloaded and of suspicious origin, each time im given the option of removing the program but it persists each time on computer startup. I downloaded malwarebytes and have attempted to use that program but havent seen any proogress from simply scanning and quaraanting the problem, any help would be greatly appreciated.

Hello, I've been noticing a suspicious programs in Task Manager. First letter of all of them is 'g' and then four always different letters with extension .tmp.exe. Sometimes that program has very high disk usage but rarely. It's location is always in Windows\Temp folder and next to it is file with the same name but with only .tmp extension. Few hours after I stop and delete the file, new one is created and ran. Sometimes I find registry entry in RunOnce with location of g****.tmp.exe. I've downloaded Farbar Recovery Scan Tool and ran it. I attached the FRST.txt and Addition.txt. Thank you for help. Addition.txt FRST.txt