• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 630
  • Last Modified:

.ttf files accruing in temp directory - OS is locking newest files?

Hello,

I have an interesting issue I wanted to run by the community.  I currently have an issue on one of our 2008 R2 servers where .ttf files will constantly accrue in the local temp directory (C:\Users\"User"\AppData\Local\Temp) until we delete them.  There seems to be some kind of locking by the OS going on, because when I try to delete one of the newer files, I get the following:

"The action cannot be completed because the file is open in System"

Again though, this doesn't happen with the older files, so I have to assume that there is some kind of locking / unlocking going on with the OS.  I've searched the net and most of the recommendations center around de-installing certain Msft patches, but none of that has worked thus far.

Any help is appreciated!
0
blinkme323
Asked:
blinkme323
  • 4
  • 3
  • 2
  • +2
1 Solution
 
bbaoIT ConsultantCommented:
do you have any idea where the TIFF files were from? if not, did you ever try using the following utility to find the related process?

DiskMon for Windows v2.01
https://technet.microsoft.com/en-us/sysinternals/bb896646
0
 
Lionel MMSmall Business IT ConsultantCommented:
Is this a fax/scan server? If so the tiff files could be from sending faxes. If not what does this server do?
0
 
Davis McCarnOwnerCommented:
TTF files are Truetype Fonts and should never be found in temp folders excepting the rare event that a user agreed to install a language.
The odds re you have a variant of a Delf.ttf.trojan which is probably removable with ADWCleaner:  http://www.majorgeeks.com/files/details/adwcleaner.html
You ought to kick all of the users off and, if possible, run it at the console, not via RDP.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
blinkme323Author Commented:
Thank you for the responses thus far.  This server's primary function is as a print server, the interesting thing is the fonts are being installed under the temp directory for one of the service accounts used for some of the print functions (spooler, etc.).  

As for tools that I've tried, I've used both Unlocker and ProcMon to no avail.  I will try out DiskMon though and see if that can uncover anything.
0
 
bbaoIT ConsultantCommented:
sorry initially misread the file extension as TIFF which was for images not fonts.

however, the fonts should not be installed in a TEMP folder which might be cleaned up time to time. is it possible for you to reinstall or redirect the fonts folder?
0
 
Davis McCarnOwnerCommented:
Even as a print server, the TTF files (if needed) ought to be embedded in the spool file(s) rather than in the users temp folders!  If, for some bizarre reason, fonts are being saved as temp files during the print job creation process, they ought to be automatically deleted when the print job is finished.

The Delf.ttf.trojan is a password stealer and the possibility of its presence should not be taken lightly.
0
 
blinkme323Author Commented:
Thanks DavisMcCarn, I'm going to check for that trojan now.
0
 
blinkme323Author Commented:
No go on the trojan (I guess that is a good thing though).  I do notice that when I stop the print spooler, that these stop populating (while printing is still occurring).  So I wonder if it is related to that?
0
 
Davis McCarnOwnerCommented:
Apparently, it must be, which will be a combination of what app you are printing from (i.e. MS Word), Windows fonts, the printers fonts, and the print processor engine (part of the drivers).  The fact that they are not automatically deleted is a flaw in one of them.
Consider looking at what fonts are being used by the app(s) and adding them to the Windoze fonts to see if it doesn't help.
0
 
Dirk KotteSECommented:
possible there are problems with a MS security hotfix:

KB2993651 Behavior changes with this security update
"After you install this security update, fonts that are installed in a location other than the default fonts directory (%windir%\fonts\) cannot be changed when they are loaded into any active session. Attempts to change, replace, or delete these fonts are blocked, and a "File in use" message is displayed."

There are TTF probles within other apps also (here AdobeReader):
http://blogs.adobe.com/dmcmahon/2011/11/08/acrobatreader-tmp-files-left-behind-in-temp-folder-after-printing/
https://forums.adobe.com/thread/1749289

I solved this at my terminalservers with a AR Workaround preventing TTF to .tmp save these days.
0
 
blinkme323Author Commented:
Ended up being an issue with Adobe, thanks for the input!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 4
  • 3
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now