Is malware in temp folder harmful?

GSDog · 12 Mar 2013 at 19:13

I just got my parents computer working after it being down for about 18 months.

I installed Kaspersky AV 2013 and did a scan, which detected the following:

Trojan-Spy.Win32.EmailGrabber.ak Deleted 12/03/2013 19:08:11 c:\documents and settings\*****\local settings\temp\

I think the actual file name of it was 49.tmp

My question is, would that Trojan have been active/harmful or is it just a temporary file? Where would it have come from?

On Holiday · 12 Mar 2013 at 19:14

I imagine it's something that was on a website you once clicked.

Possibly keylogger according to google. I'd get passwords changed to be on the safe side.

demonix · 13 Mar 2013 at 16:28

If memory serves most malware and viruses dump themselves and run from the temp folder, so it would have been harmful even in that location.

bledd · 13 Mar 2013 at 16:29

I'd run a few more scan tools to be sure

MBAM is a good one
hijackthis will tell you if that file is being called at startup

GSDog · 15 Mar 2013 at 14:41

Thanks.

Kaspersky seems to have dealt with it and I have run MBAM and SAS to be sure.

I couldn't see anything suspicious in start up but the PC did display a rundll error every time windows booted; it was trying to launch a .dll file at start up but the file was not there. I'm wondering if an anti virus in the past had partially deleted/removed the trojan.

bledd · 15 Mar 2013 at 14:47

use hijackthis and paste the log file in here, the dll will be referenced in there somewhere

hugobosslives · 15 Mar 2013 at 21:32

if possible its probably worth nuking the OS and doing a clean install. Could be anything on there if a simple text grabber was in there.