JETxxxx.tmp file

[zestril5]

In cleaning up a really messy computer I have come across a file that I haven't noticed before and believe it to be some sort of malware. I can't find any reference to it on the web.
Everytime I start up a file appears in the temp folder that starts with JET there are 4 other letters or numbers that follow and then .tmp. Each time the JETxxxx.tmp file name is different. If I try to delete it I receive a message that it's in use and can't be deleted. However it does dissappear only to reappear if I access the temp directory again and with a different name.
I have nothing starting in msconfig but avg. There is nothing under the various runs in the registry (acept avg) and there is nothing showing in the task mgr that doesn't belong with the possible exceptions of 2 servhosts which I can't stop without the computer rebooting.
I have rerun avg antivirus, stinger, spybot, and adaware all with no reported problems.
One other problem with the computer is that it takes forever to start after choosing a username. (about 1min 45 sec) I think the two things are related.
Ran bootvis but this was no help since I suspect the delay comes after all of the things bootvis checks for.
Any help or suggestions would be greatly appreciated.
One last thing, I did all of these things under each users name. the jet file name changes with each start or change of user. AND I noticed that the operating files on this machine are all under a winnt folder and not windows although its starts up as xp home.

 

[jrbarnett]

Hello

The .tmp file extension is commonly used for temporary files by the operating system and applications, and as such, many antivirus packages and spyware search tools will by default not scan files with such extensions.
Best bet is to run the scanner set to search all files, but remember that this will take several times as long as usual because more data will be scanned.

Failing this, run HijackThis and post a log file in the Virus/Spyware forum for analysis.

John

 

[linney]

If you are running a third party firewall like Outpost Firewall this will create JETxxxx.tmp files at every Startup. It should delete the old temp file at bootup and create a new temp file in its place. As the temp file is in use by the firewall it can't be deleted while the firewall is running. Incidentally if you are using Outpost, there was a new version (2.1) released just recently

A visit to this site will give you freeware programs which will allow you to check what file is in use by which program. One of the programs is called Handle.exe and the other I believe is Process Explorer.

http://www.sysinternals.com/ntw2k/utilities.shtml

There might be some clues to your slow login here.
Fast User Switching AIN'T fast!
thread779-787435

The name of the Windows folder for the install of XP may be a result of an upgrade installation over an older operating system or a deliberate choice to install into a folder called winnt using advanced setup options at install time.

 

[zestril5]

Thanks for the responses. I don't have any firewall on this computer.
This system was really messed up. The startup screen said it was XP home. When trying to run sfc it said that it wanted an XP Pro disk not xp home. I had an xp pro disk but it wouldn't take it either. In addition there were no files in the windows folder. They were all in a Winnt folder.
In looking throught the winnt folder I found a file called jet500.dll There was a reference for this file in the ms knowledge base but only for window nt and nothing about any temporary files.
I finally deceided that the best thing I could do for this system was shoot it and start over.
A clean reformat and install of XP Pro and the machine is working like a charm.
Again thanks for the input.