FreeLists / 24hoursupport / [24hoursupport] Re: Wnk.xxxx.tmp

["Ron Allen" <chizotz@xxxxxxxxxxx>]

Hello Paul,

>Recently, I opened my C:\windows\temp file and found more than 6,000 
>Wnk.xxxx.tmp
>files in there which required manual removal in batches no bigger than 100=
 
>files at a
>time. The xxxx stands for four alpha numeric characters which identify
>each 
>Wnk.xxxx.tmp
>file. All are zero length files.
<snip>
>At the Norton site, I find no listing for a virus with the wnk file name. 
>Any of you folks
>dealt with this problem?

I don't believe this is a virus at work. I believe it is rather a poorly=
 behaved program. I may be wrong, of course, but my first guess would not=
 be a virus. Unfortunately, I can find no information on what program might=
 leave files named wnk.xxxx.tmp behind, so the best I can offer is some=
 suggestions. In no order other than how they come out of my fingers:

First, don't get caught up in the SystemWorks problem (which I know nothing=
 at all about, I detest Symantec products and don't use them at all) being=
 related to the tmp file issue; it may be, but then again it may not.

Second, in many cases programmers will name the tmp files their programs=
 create starting with specific characters that may (or may not) give you a=
 clue about what program they belong to. Are you running anything, in the=
 background for example, that is named similarly to wnk?

Third, you say that these files appear while you are on the Internet,=
 especially when using Eudora. Do they appear at any other times? You may=
 be able to identify the program by trial and error, however if they are=
 being created at any time it is most likely a program running in the=
 background. In that case, you'll have to disable them one at a time and=
 observe the folder to see if you can correlate the appearance of the files=
 with a specific program.

Fourth, it may be a Windows component creating the files... I haven't heard=
 of this issue that I recall, and haven't experienced it myself, but it=
 could be. There is nothing in the Microsoft KB about wnk* files.

Fifth, you can try opening one of the files in Notepad. If it is a text=
 file (unlikely, but possible) anything in the file may give you a clue=
 where it came from. But there won't (shouldn't) be anything readable by=
 Notepad in a zero-byte file. You can download a hex editor (try=
 download.com or maybe tucows.com) and open one of the files to see what,=
 if anything, is in the header. A hex reader is a special program, similar=
 to a text editor, than can properly read the data in binary files. Binary=
 files generally contain a header that can contain identifying information,=
 which in most hex editors can be read in plain English along the left side=
 of the screen.

Sixth, have you run scandisk on the drive? Many times tmp files piling up=
 can be an indication of a program trying to read/write a bad sector, or=
 that the FAT table is corrupt. The (poorly written) program writes a tmp=
 file, then attempts to access it and finds it can't; an error occurs, and=
 instead of deleting the file the program responds by creating a new one=
 and trying to access that one. This can go on and on if the error keeps=
 happening. Such errors can be caused by a corrupt FAT table or other disk=
 problem.

Seventh, try searching your registry for wnk. start/run, type in regedit,=
 and press {enter}, then search in the usual way. Sometimes you'll find=
 file associations and other information right there. On the other hand, be=
 careful to not get too excited if you find a reference to wnk; it may be a=
 perfectly valid entry unrelated to the tmp file issue. You'll have to=
 investigate further to find out, and do not make changes to the registry=
 unless you know exactly what you're doing or your system might become=
 unbootable.

Hopefully someone else will have more concrete information or other/better=
 suggestions.

Ron

- Users can unsubscribe from this list by sending email to 
24hoursupport-request@xxxxxxxxxxxxx with 'unsubscribe' in the 
Subject field OR by logging into the Web interface at
http://webpages.charter.net/chizotz/