(3/4/5 digits).tmp 450 files totalling 650MB found in SysWOW64 folder - What are they?

acosta

New Member
Hi,

I found 650MB .tmp files in my SysWOW64 folder, why are they there? I can't find anything online about them.

Some of the file names are 445.tmp, 3903.tmp and 11920.tmp

My attention was drawn to them after ESET detected one of them as a virus, the detection name was something like "google.toolbar"

Thanks for the help!
 

patcooke

Microsoft MVP
Staff member
Microsoft MVP
.tmp files are invariably temporary files created during software install/updates and may have been left behind or not cleaned up if the install/update failed so you should have no problem deleting them. If this worries you then make a copy of the tmp files onto a pen drive or something and keep them until you are confident that their deletion does no cause any issues. A google toolbar is amongst the many bits of junk which many software installs try to add on. When you run an install it's always best to select any "advanced" options during the install process and deselect optional add ons like this. They are not usually viruses, rather something called a PUP (potentially unwaunted program) but anti virus software reports them as unwanted junk.
 

acosta

New Member
.tmp files are invariably temporary files created during software install/updates and may have been left behind or not cleaned up if the install/update failed so you should have no problem deleting them. If this worries you then make a copy of the tmp files onto a pen drive or something and keep them until you are confident that their deletion does no cause any issues. A google toolbar is amongst the many bits of junk which many software installs try to add on. When you run an install it's always best to select any "advanced" options during the install process and deselect optional add ons like this. They are not usually viruses, rather something called a PUP (potentially unwaunted program) but anti virus software reports them as unwanted junk.
Thanks for the advice.

Since I cannot confirm that they are harmless and require admin to delete I'd rather not since I don't want the hassle of trying to move them back if Windows doesn't load.

I have CCleaner (+ the enhancer) installed and it didn't remove those files, I highly doubt that if they were safe to remove that CCleaner would have missed them.
 

acosta

New Member
Cleaner will not have "missed" them. It depends on what options you have selected for cleaner.

Sent from my SM-G975F using Windows Forums mobile app
Sorry but I kind of feel you take me for an idiot lol... Of course I made sure all boxes were checked, I even have the enhancer installed and BleachBit to go with it.

I left the files where they are, since I can’t get a definitive answer.

Perhaps CCleaner hasn’t added those files because it would have to choose to delete all .tmp files in SysWOW64, which isn’t a smart move.
 

nmsuk

Windows Forum Admin
Staff member
Premium Supporter
Backup the system and then delete them from safe mode. If all goes well good and if not you have a backup of the system drive.
 

acosta

New Member
Backup the system and then delete them from safe mode. If all goes well good and if not you have a backup of the system drive.
Good idea, but I’d rather lose 650MB space than go through that effort, it’s not worth it.
 

WindowsPro

Well-Known Member
You should not have ANY TMP-files in your syswow64-folder..

I guess that you run your computer with a administrators-account, if not these files would not have ended up in a systemfolder..
(Windows has its own TEMP-folder where tmp-files might show up…)

I guess that the reason that these tmp-files where not removed are that they are executed upon logon, and thus not avaliable to be deleted…
Hold "Shift button" while selecting "restart" and check if you may delete these files in SAFE MODE...
Start CMD as admin By right clicking and selecting "run as admin"
then type:
DEL C:\Windows\SysWOW64\*.tmp
And see if these files are deleted...
If you ger error messages upon startup, it most likely registry entries that the malware has created.. IF so use method 3 in this link:
 

Neemobeer

Windows Forum Team
Staff member
There should not be any .tmp files in the SysWOW64 directory or any of it's sub directories. Examining them with a hex editor would likely give you a clue as to what they are. Grabbing the first 16 binary or hex values typically contain a file "magic numbers" which basically tells you what the file is Digital Forensics Magic Numbers unless you're in the middle of installing something .tmp files are almost always safe to remove.
 
Top