sig.tmp files in C:/WINDOWS/Temp folder - what is that?

[Pondus]

send it to Geeks2Go or OldTimer   

[alpha1]

i downloaded it from the link you gave,its the latest version?

[Pondus]

to my knowledge yes

[Tetsuo]

Thanks guys for the info but as per the original post, the problem here is not how we can clear Windows temp folder.

Could any of the Developers please confirm that the sig*.tmp files are related to Avast?

If they are actually Avast's files could you please tell us what they are and why suddenly they are getting created? - apparently all started on 19/10 and they continue to be created.

Thanks and sorry for my English.

[DavidR]

@ Born To Be Wild and Tetsuo
As and when avast creates temp files there are A) in one of the _avast_ folders, commonly c:\windows\temp\_avast_ and B) the file format is like this unp999999.tmp. So there files don't appear to have anything to do with avast.

Given their file formal sigXX.tmp (were XX is an alpha numeric combination), I would say that there is a possibility they are signature updates (but not avast); so what other security software do you have installed ?

[Tetsuo]

what other security software do you have installed ?

Win XP Pro SP3
Avast! Free AV 6.0.1289 (Behaviour/Script Shield removed)
Online Armor Free 5.1.0.1331 (Web Shield disabled)

[DavidR]

I don't know if OA happens to be updating anything or what file type it would use or where it would deposit those, I have never used it.

[Tetsuo]

As reported in one of my previous posts, I tried several things. I disabled/enabled Avast, rebooted my system with Avast disabled/enabled and so on. I always checked those file and their creation date. I'm quite sure they're generated by Avast.

[Tetsuo]

I just asked my brother who uses Avast! Free on Windows XP Pro SP3 to look for sig*.tmp files on the Windows/temp folder. He said that those files are there.

[DavidR]

Whilst they are there I can't see why they would be in that location and not the _avast_ temp folder location even if they are anything to do with avast.

[alpha1]

I just asked my brother who uses Avast! Free on Windows XP Pro SP3 to look for sig*.tmp files on the Windows/temp folder. He said that those files are there.

you could both have other programs in common besides avast,that would cause this.

[FlyingRobot]

Hello folks,

Found this thread while googling the subject.  I'm seeing these sigN.tmp files on an XP Pro desktop and an XP MCE notebook.  Both are up to date, tightly configured, and generally unlikely to be infected.

Currently I'm testing on my notebook with no LAN connection and wireless *disabled* so no network connectivity period.  I delete these sigN.tmp files, restart the machine, and at the earliest opportunity 1) open Windows Temp so I can watch for their creation, 2) Launch SysInternals Procman.exe so I can monitor what processes are up to.  Approximately 7 or so minutes after restart (note: older notebook) these files get created.  I, and presumably others, can reliable capture this using Procman and other tools.

During my initial captures I found it was AvastSvc.exe and cmdagent.exe that were performing operations on these files, with AvastSvc.exe being the first.  Unsure of the interplay between these two, I first tried to eliminate Comodo from the picture by changing Defense+ to disabled, changing Firewall to disabled, and leaving Sandbox on disabled.  That didn't stop cmdagent from running and showing up in the sigN.tmp manipulation log.  I tried a couple more things but it appears that there are some protections against disabling Comodo and I didn't feel like digging into that right now.  So leaving Comodo as just described, I went into Avast and disabled all the shields.  I deleted those sigN.tmp files, restarted, and waited to see what happened.

My latest capture shows only AvastSvc.exe manipulating/creating the sigN.tmp files.  Here is a quick pic of that capture with a "Path contains \sig" filter applied to narrow the results down to the manipulation of just these files: http://oi51.tinypic.com/b7x6qx.jpg.  It is late, I'm tired, and I'm not really sure what is behind this behavior.  Perhaps others will carry the ball farther while I am attempting to dream of other things.

I'll check in tomorrow.

[Asyn]

Ok, I've found them, too.
First entry is from the 18th October.
Seems to be afd.sys (Ancillary Function Driver for WinSock)
http://www.file.net/process/afd.sys.html
No idea, why it's there, though...

[Tetsuo]

Ok, I've found them, too.
First entry is from the 18th October.

Mine is from 19th October.

Seems to be afd.sys (Ancillary Function Driver for WinSock)

Asyn, as far as I can see I think that FlyingRobot is right. I was already quite sure those files were somehow related to Avast! and FlyingRobot just reported that AvastSvc.exe appears to manipulate/create the sigN.tmp files.

EDIT: it seems that sigN.tmp files are created 8 minutes after system boot (or perhaps after Avast! is started).

[Asyn]

Seems to be afd.sys (Ancillary Function Driver for WinSock)

Asyn, as far as I can see I think that FlyingRobot is right. I was already quite sure those files were somehow related to Avast! and FlyingRobot just reported that AvastSvc.exe appears to manipulate/create the sigN.tmp files.

I also think that it is avast related.
I wonder why a temporary copy of afd.sys is created and for what purpose.