I am working on a computer for a lady. Something is creating random files in her Temp folder. The O/S is Vista. The file structure is as follows:
At this point a random folder is created. Something like 4c0 or 8d8 or 14a0 etc. The names are 3 or 4 characters long.
Underneath these random folders there is another appdata folder.
Under the second appdata folder is a local and a roaming folder.
Under those folders are Microsoft\Windows\
Under Windows are hidden folders such as PrivacIE. Cookies, History, Temporary Internet Files. These files are not always the same, but they are legit Windows-named folders.
To summarize the entire path is:
C:\users\%user%\appdata\local\temp\RANDOM FOLDER\appdata\local\Microsoft\windows\privacie or cookies or history or temporary internet files
C:\users\%user%\appdata\local\temp\RANDOM FOLDER\appdata\roaming\Microsoft\windows\privacie or cookies or history or temporary internet files
I have pulled the drive and scanned it with Norton 360, McAfee 8.8, Malwarebytes, and Superantispyware. Nothing has eliminated the problem. When I got the computer there were 11,500 random folders. It took several hours to delete them. I keep deleting all the contents of the Temp folder. When I reboot, the random folders are created again. I'm having trouble searching for an answer since most of the folders are legit Windows folders.
If I boot to Safe Mode, the folders are not created.
The most suspicious software I found was ReferenceBoss. I believe I have it removed and this problem doesn't fit its MO.
Anyone ever ran into this before?