TC may create strange temp files in %temp% folder

The behaviour described in the bug report is either by design, or would be far too complex/time-consuming to be changed

Moderators: white, Hacker, petermad, Stefan2

Post Reply
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

TC may create strange temp files in %temp% folder

Post by *DrShark »

Since the file of Remote Access Diagnostic Report, which has a lot private info, is required to reproduce the issue, this was initially reported by email. Maybe someone will be able to reproduce the issue with other files.

To reproduce:
1. Create a Remote Access Diagnostic Report, the explanation of how to do this is available on the above linked TechNet page. Your report will be a htm file.
2. Convert this htm file to mht.
3. Open %temp% folder in left panel of TC.
4. Put the mht file either in this %temp% folder or in the folder of opposite (right) TC panel.
5. Refresh left TC panel %temp% folder several times using Ctrl+R hotkey or cm_RereadSource command:
files with names tmp????.tmp (? in the name means a random character) will start to appear in it.

For example, my Remote Access Diagnostic Report mht file is 114270632 bytes big, and TC started to create two tmp????.tmp files with sizes of 80724156 and 31076486 bytes %temp% folder. TC then re-creates those two files in a loop, and dosen't allow to remove them with Del or Shift+Del, but it removes them itself when I close TC.

If this matters, the name of my converted Remote Access Diagnostic Report file is
DIALRE~1.mht
Its header:

Code: Select all

MIME-Version: 1.0
Content-Type: text/html;
	charset="koi8-r"
Content-Transfer-Encoding: base64
Content-Location: file:///C:/Users/<myusername>/AppData/Local/Temp/DIALRE~1.HTM
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6002.18463
I've sent the links to my original mht file, and also a video of the issue, to TC support email, its subject:
[2] TС creates strange temp files and their copies
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
Dalai
Power Member
Power Member
Posts: 9364
Joined: 2005-01-28, 22:17 UTC
Location: Meiningen (Südthüringen)

Re: TC may create strange temp files in %temp% folder

Post by *Dalai »

DrShark wrote:1. Create a Remote Access Diagnostic Report, the explanation of how to do this is available on the above linked TechNet page. Your report will be a htm file.
Would have been much simpler if you'd just posted the full command. With just this info, you have to find out where exactly the RAS Diagnostics context of netsh is. To make this easier for other users, here's the full command (adapt the path as needed):

Code: Select all

netsh ras diagnostics show installation type=file destination="h:\ras_report.htm"
2. Convert this htm file to mht.
How exactly did you do this? I'm quite sure the way it's done has some influence on the resulting MHT file and maybe even on the behavior. IE can create MHTs, but Firefox can do this as well, when the right addon is installed; perhaps there are even more ways.

Please provide the missing pieces, then probably more people will be happy to try to reproduce this.

Regards
Dalai
#101164 Personal licence
Ryzen 5 2600, 16 GiB RAM, ASUS Prime X370-A, Win7 x64

Plugins: Services2, Startups, CertificateInfo, SignatureInfo, LineBreakInfo - Download-Mirror
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Re: TC may create strange temp files in %temp% folder

Post by *DrShark »

Dalai wrote:
2. Convert this htm file to mht.
How exactly did you do this? I'm quite sure the way it's done has some influence on the resulting MHT file and maybe even on the behavior. IE can create MHTs, but Firefox can do this as well, when the right addon is installed; perhaps there are even more ways.
I used "Web Archive 2000" MS Office 2000 Add-in, it has a stand alone utility (Web Archive Packager and Unpackager) for this. My button:

Code: Select all

TOTALCMD#BAR#DATA
"c:\Program Files\Web Archive\webarch.exe"
%c
C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE,6

C:\PROGRA~1\WEBARC~1\
0
-1
applied to selected htm file.
I moved the report htm file to the %temp% folder and there converted in to mht with that button.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
Dalai
Power Member
Power Member
Posts: 9364
Joined: 2005-01-28, 22:17 UTC
Location: Meiningen (Südthüringen)

Post by *Dalai »

Well, I don't have this Office add-in, and I couldn't find a working download for it (don't even know if it's free), so I'm going to try it with a conversion via IE and Firefox.

Regards
Dalai
#101164 Personal licence
Ryzen 5 2600, 16 GiB RAM, ASUS Prime X370-A, Win7 x64

Plugins: Services2, Startups, CertificateInfo, SignatureInfo, LineBreakInfo - Download-Mirror
User avatar
Dalai
Power Member
Power Member
Posts: 9364
Joined: 2005-01-28, 22:17 UTC
Location: Meiningen (Südthüringen)

Post by *Dalai »

Sorry, can't reproduce it. There must be some other factor involved. Can you reproduce it with a clean wincmd.ini? If not, it must be some setting, custom columns, thumbnails and/or TC plugin. When using the default long view, I don't see how temporary files can get created when just the directory contents are refreshed...

Note that my RAS report is MUCH smaller: the HTM file is 356 KB and the MHT is 750 KB (created by Firefox with MAFF addon) and 490 KB (created by IE8 on Win7). The size difference between the two MHT files is due to encoding; Firefox uses quoted-printable while IE uses base64.

Regards
Dalai
#101164 Personal licence
Ryzen 5 2600, 16 GiB RAM, ASUS Prime X370-A, Win7 x64

Plugins: Services2, Startups, CertificateInfo, SignatureInfo, LineBreakInfo - Download-Mirror
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

Dalai wrote:I couldn't find a working download for it
This url should work. The msi file has Cabs.w1.cab file inside which has utility files.
Dalai wrote:don't even know if it's free
It's not very clear. Original utility page on Microsoft Website says that it "works with ... Office 2003, Office XP, Office 2000", and the Setup program says it's an Office 2000 update, so athough it seems to work like the freeware [add-in] it may be the case that it is covered by MS Office license terms.
Dalai wrote:Can you reproduce it with a clean wincmd.ini?
Yes. That's why I decided to report it also here on the forum.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
Dalai
Power Member
Power Member
Posts: 9364
Joined: 2005-01-28, 22:17 UTC
Location: Meiningen (Südthüringen)

Post by *Dalai »

OK, got the Web Archiver thing, extracted it, converted the HTM with it (via a button with %c parameter), and tried again. Nothing happens. Not in TC 8.52a, not in TC 9.0a, neither 32 nor 64 bit. I tried as admin and as a user (because MHTs are associated differently on my machine). I even "parked" my fingers on Ctrl+R to get the maximum refresh rate, still nothing.

As I said: I don't see how temporary files can get created when just the directory they're in gets refreshed. There is at least one piece of the puzzle missing.

Do you have another machine available, perhaps with a different OS? Or a VM? If so, can you reproduce it there? Maybe it's a shell extension, a background program or something.

Regards
Dalai
#101164 Personal licence
Ryzen 5 2600, 16 GiB RAM, ASUS Prime X370-A, Win7 x64

Plugins: Services2, Startups, CertificateInfo, SignatureInfo, LineBreakInfo - Download-Mirror
gdpr deleted 6
Power Member
Power Member
Posts: 872
Joined: 2013-09-04, 14:07 UTC

Post by *gdpr deleted 6 »

What is in those mysterious tmp????.tmp files?

Their content might perhaps contain clues of what is going on and what software component(s) might be involved in causing this...
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

I just got the email reply on the issue and Christian says TC doesn't create these tmp files, Explorer may create them when trying to extract an icon of the file. I checked it and it seems that something like that may happen. When Explorer is opened with a folder of a problem MHT file, these tmp????.tmp files appear in %temp% folder.

It seems that files tmp????.tmp don't appear anymore in %tmp% folder when to set the option "Only standard icons" in TC settings and then to open a folder with problem mht file in any TC panel.

I'll do more tests, but for now the good solutions for TC would be the new options in wincmd.ini to tell TC to not try to extract icons for files with certain extensions or files larger than certain size even with general "All associated" or "All associated + EXE/LNK" set.
Dalai wrote:Sorry, can't reproduce it. There must be some other factor involved.

Note that my RAS report is MUCH smaller: the HTM file is 356 KB
Indeed the size may be a factor.
For me the command
netsh ras diagnostics show installation type=file destination="c:\temp\ras_report.htm"
also makes a small file. AFAIR I made those large reports using Windows Network Diagnostic dialog when had problems with internet connection.
For example, there's a TOC of 1 of my RAS logs:
Отчет о диагностике удаленного доступа
Версия отчета: 1.0
Дата и время: 08.04.2013 1:00:56
Имя пользователя: PCname\Username
Имя компьютера: PCNAME
Каталог Windows: C:\Windows
Версия Windows: 6002.PER.x86

Содержание
Журналы трассировки и событий

• Трассировка журналов
BAP.LOG
IASSDO_AUX.LOG
IpHlpSvc.LOG
IPNATHLP.LOG
KMDDSP.LOG
NDPTSP.LOG
PPP.LOG
RASAPI32.LOG
RASBACP.LOG
RASCCP.LOG
RASDLG.LOG
RASEAP.LOG
RASGCW.LOG
RASIPCP.LOG
RASIPHLP.LOG
RASIPV6CP.LOG
RASMAN.LOG
RASPAP.LOG
RASPLAP.LOG
RASQEC.LOG
RASTAPI.LOG
svchost_RASCHAP.LOG
svchost_RASTLS.LOG
tapi32.LOG
tapisrv.LOG
Журналы модема
Журналы диспетчера подключений
Журнал безопасности IP
• Журналы событий удаленного доступа
• Журналы событий безопасности

Сведения об установке

• Информационные файлы
• Проверка установки
• Установленные сетевые компоненты
• Проверка реестра

Сведения о конфигурации

• Установленные устройства
• Сведения о процессе
• Служебные программы командной строки
arp.exe -a
ipconfig.exe /all
ipconfig.exe /displaydns
route.exe print
net.exe start
netstat.exe -e
netstat.exe -o
netstat.exe -s
netstat.exe -n
nbtstat.exe -c
nbtstat.exe -n
nbtstat.exe -r
nbtstat.exe -S
netsh.exe dump
• Файлы телефонных книг
• Отчет со сведениями о системе
I'll try to find out how exactly it's possible to make a full log like this.
elgonzo wrote:What is in those mysterious tmp????.tmp files?

Their content might perhaps contain clues of what is going on and what software component(s) might be involved in causing this...
The 80 mb tmp file has following content:

Code: Select all

RABMAEUAKQA6ACAAaAB0AGwAaQBuAGUAKAAwADAAMAAxADAAMAAzADQAKQAsACAAaAB0AGMAYQBs
AGwAKAAwADAAMAAxADAAMAAxADIAKQAsACAAcAAzACgAMAAwADAAMAAwADEAMAAwACkADQAKAFsA
MwAzADkAMgBdACAAMQAxADoANQA5ADoAMgA5ADoAMAA5ADQAOgAgACEAIAAgACAAQQBzAHkAbgBj
[... a lof of content like this ...]
IAAgACAAIAAgACAAIAANAAoAPAAvAHAAcgBlAD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0AbAA+
AA==
The 30 Mb tmp file has something that looks like a parts of html in binary form or so:

Code: Select all

8 3 :   ! !     S y n c D r i v e r R e q u e s t :   ( O i d   S e t S t a t u s M e s s a g e s G a t h e r D i g i t s )   r e t u r n s   w i t h   N D I S   s t a t u s   ( c 0 0 1 2 0 1 6 ) 
 
 [ 2 3 4 8 ]   0 1 : 0 0 : 1 0 : 1 9 2 :           l i n e C l o s e ( 1 1 ) :   l i n e ( 0 0 1 6 0 0 0 0 ) 
 
 [ 2 3 4 8 ]   0 1 : 0 0 : 1 0 : 1 9 4 :   !       S y n c D r i v e r R e q u e s t :   o i d ( C l o s e ) ,   d e v I D ( 8 ) ,   r e q I D ( 3 5 ) ,   h d L i n e ( 0 0 0 0 0 0 0 0 ) 
 
 [ 2 3 4 8 ]   0 1 : 0 0 : 1 0 : 1 9 5 :           D e c o m m i t N e g o t i a t e d T S P I V e r s i o n :   d e v i c e I D ( 8 ) 
 
 < / p r e > < A   N A M E = " P P P . L O G " > < h 4 >   P P P . L O G   [   < A   H R E F = " # T a b l e O f C o n t e n t s " > !>45@60=85< / A >   ]   < / h 4 > < / A > < p r e > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
 
 C : \ W i n d o w s \ t r a c i n g \ P P P . L O G 
 
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
 
 
 
 [ 3 7 7 6 ]   1 1 : 5 3 : 2 8 : 8 7 8 :   & # 6 2 ; C 0   2 1   0 9   F C   0 0   0 C   5 7   B 2   6 E   D 7   0 A   D 2   4 C   E E   0 0   0 0   | . ! . . . . W . n . . . L . . . | 
 
 [ 3 7 7 6 ]   0 4 -

...

AO  >B>1@078BL  >BG5B  w i n m s d / m s i n f o 3 2 .                                                     
 
                                                                                                                                           
 
 < / p r e > < / b o d y > < / h t m l >
Last edited by DrShark on 2017-06-21, 19:11 UTC, edited 1 time in total.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
gdpr deleted 6
Power Member
Power Member
Posts: 872
Joined: 2013-09-04, 14:07 UTC

Post by *gdpr deleted 6 »

Yeah, all in all it looks like Explorer extracts more or less the whole MHT archive (or splits its parts) for whatever reason instead of just extracting the icon in memory. Weird...
DrShark wrote:The 80 mb tmp file has following content: [...snip...]
That looks like some Base64-encoded file. Considering the other smaller file you mentioned is Unicode text that looks like an excerpt from your report, i would guess this Base64-encoded file is something like an image or a similar resource used by the page(s) in your MHT archive.
The 30 Mb tmp file has something that looks like a parts of html in binary form or so:
This looks like an excerpt of your diagnostics report.
Just an FYI: The html is not in binary form. It looks more like being UCS-2 Unicode (or perhaps UTF-16), viewed in ASCII/ANSI/UTF-8 mode in TC lister. UCS-2 uses two bytes for each character. Viewing a UCS-2 text in ASCII/ANSI/UTF-8 mode will show each of the two bytes of a UCS-2 character as two individual characters. The blank you see here between the text characters is simply the hi-byte of the UCS-2 character being zero (which the TC lister shows as a blank).
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

elgonzo wrote:Yeah, all in all it looks like Explorer extracts more or less the whole MHT archive (or splits its parts) for whatever reason instead of just extracting the icon in memory. Weird...
It seems to happen because Explorer (and TC when All associated+EXE/LNK method is selected which uses OLE also for mht) is trying to show the file thumbnail as an icon. The same happens for folder with mht inside: when TC show that folder's thumb in Thumbnails mode, same tmp files appears in %temp% folder. But for folders it normally happens only once because TC caches the thumbnail of that folder and next time it loads it from cache. The icons arn't cached by TC, so each time the panel is refreshed, TC re-requests the icons for mht using OLE2 which leads to new and new temp files in %temp% folder after each refresh.
DrShark wrote:the good solutions for TC would be the new options in wincmd.ini to tell TC to not try to extract icons for files with certain extensions or files larger than certain size even with general ... "All associated + EXE/LNK" set.
Maybe the new option to cache the icons extracted using OLE2 method (could be applied to configured file sizes or extensions or even filenames) would be a better solution.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
ghisler(Author)
Site Admin
Site Admin
Posts: 48021
Joined: 2003-02-04, 09:46 UTC
Location: Switzerland
Contact:

Post by *ghisler(Author) »

Try assigning a custom icon to mht via Files - associate - edit type.
Author of Total Commander
https://www.ghisler.com
User avatar
DrShark
Power Member
Power Member
Posts: 1872
Joined: 2006-11-03, 22:26 UTC
Location: Kyiv, 68/262
Contact:

Post by *DrShark »

ghisler(Author) wrote:Try assigning a custom icon to mht via Files - associate - edit type.
That helped!
I had mht associated with Opera this way:

Code: Select all

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid"="Opera.HTML"
And the Opera.HTML key had following value for the icon:

Code: Select all

[HKEY_CLASSES_ROOT\Opera.HTML\DefaultIcon]
@=""%1""
Now I changed the icon to

Code: Select all

[HKEY_CLASSES_ROOT\Opera.HTML\DefaultIcon]
@=""c:\\Program Files\\Internet Explorer\\iexplore.exe",5"
and both TC and Explorer don't create these tmp????.tmp files anymore (to apply this for Explorer it was required to log user off and on again).
Thanks to all who helped to find the reason and solve the issue.
Donate for Ukraine to help stop Russian invasion!
Ukraine's National Bank special bank account:
UA843000010000000047330992708
User avatar
Dalai
Power Member
Power Member
Posts: 9364
Joined: 2005-01-28, 22:17 UTC
Location: Meiningen (Südthüringen)

Post by *Dalai »

So basically the system was commanded to extract the icon for the MHT file from the file itself? Which type of software does such a stupid thing? I've never seen something like this.

PS: If HTML and MHT files are associated with Opera on your system, I wouldn't use IE icon for them ;).

Regards
Dalai
#101164 Personal licence
Ryzen 5 2600, 16 GiB RAM, ASUS Prime X370-A, Win7 x64

Plugins: Services2, Startups, CertificateInfo, SignatureInfo, LineBreakInfo - Download-Mirror
Post Reply