Jump to content

Recommended Posts

I have used the fix and rebooted. The BCLTMP folder has returned within hours. no tempaddons in the TEMP. *Edit* I noticed the folder returned each time after we did something to the browser. Normally it might have taken a day or a week before the folder would return.

Edited by Seda145
Link to post
Share on other sites

Yes, software that "spawns" a process is difficult to track down in a case like this as it's a valid, legal program. There are debugging tools to find that but way beyond the scope of help provided here. From the research shown on the web I was not able to find any evidence that it's a malicious process. It looks to be caused by a few different ways and normally involving a browser.

Using the Auditing though may potentially help track it down


Link to post
Share on other sites

I have a procmon log file, on which I'm browsing the internet using firefox.

Firefox creates a mozilla-temp-files folder in the TEMP,  then

Explorer.exe reads C:\Windows\System32\TaskFlowDataEngine.dll for some reason, then

avgsvc (avg antivirus) creates the BCLTMP folder in TEMP.

operations used on the BCLTMP folder include QueryNetworkOpenInformationFile , QueryRemoteProtocolInformation and many others.


the .txt file included should be renamed to .PML

Avast also creates the BCLTMP.

I noticed a firewall rule in my custom software firewall about the BCLTMP folder months ago that I did not create.

Looks like my data is send over the internet. Any attempts to look for it with Wireshark failed.


Logfile - Copy.txt

Link to post
Share on other sites

For now, temporarily uninstall Avast from Control Panel, Programs, Add/Remove and reboot the computer.
Then download and run the Avast removal tool and reboot again.

Next, uninstall AVG antivirus from Control Panel, Programs, Add/Remove and reboot.
Then download and runt the AVG removal tool and reboot again.

Reset Firefox back to factory defaults

Then monitor again and see if this folder is still being created or not.


Link to post
Share on other sites
  • 1 month later...

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.



Link to post
Share on other sites
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.