.ttf files accruing in temp directory - OS is locking newest files?


I have an interesting issue I wanted to run by the community.  I currently have an issue on one of our 2008 R2 servers where .ttf files will constantly accrue in the local temp directory (C:\Users\"User"\AppData\Local\Temp) until we delete them.  There seems to be some kind of locking by the OS going on, because when I try to delete one of the newer files, I get the following:

"The action cannot be completed because the file is open in System"

Again though, this doesn't happen with the older files, so I have to assume that there is some kind of locking / unlocking going on with the OS.  I've searched the net and most of the recommendations center around de-installing certain Msft patches, but none of that has worked thus far.

Any help is appreciated!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

bbaoIT ConsultantCommented:
do you have any idea where the TIFF files were from? if not, did you ever try using the following utility to find the related process?

DiskMon for Windows v2.01
Lionel MMSmall Business IT ConsultantCommented:
Is this a fax/scan server? If so the tiff files could be from sending faxes. If not what does this server do?
Davis McCarnOwnerCommented:
TTF files are Truetype Fonts and should never be found in temp folders excepting the rare event that a user agreed to install a language.
The odds re you have a variant of a Delf.ttf.trojan which is probably removable with ADWCleaner:  http://www.majorgeeks.com/files/details/adwcleaner.html
You ought to kick all of the users off and, if possible, run it at the console, not via RDP.
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

blinkme323Author Commented:
Thank you for the responses thus far.  This server's primary function is as a print server, the interesting thing is the fonts are being installed under the temp directory for one of the service accounts used for some of the print functions (spooler, etc.).  

As for tools that I've tried, I've used both Unlocker and ProcMon to no avail.  I will try out DiskMon though and see if that can uncover anything.
bbaoIT ConsultantCommented:
sorry initially misread the file extension as TIFF which was for images not fonts.

however, the fonts should not be installed in a TEMP folder which might be cleaned up time to time. is it possible for you to reinstall or redirect the fonts folder?
Davis McCarnOwnerCommented:
Even as a print server, the TTF files (if needed) ought to be embedded in the spool file(s) rather than in the users temp folders!  If, for some bizarre reason, fonts are being saved as temp files during the print job creation process, they ought to be automatically deleted when the print job is finished.

The Delf.ttf.trojan is a password stealer and the possibility of its presence should not be taken lightly.
blinkme323Author Commented:
Thanks DavisMcCarn, I'm going to check for that trojan now.
blinkme323Author Commented:
No go on the trojan (I guess that is a good thing though).  I do notice that when I stop the print spooler, that these stop populating (while printing is still occurring).  So I wonder if it is related to that?
Davis McCarnOwnerCommented:
Apparently, it must be, which will be a combination of what app you are printing from (i.e. MS Word), Windows fonts, the printers fonts, and the print processor engine (part of the drivers).  The fact that they are not automatically deleted is a flaw in one of them.
Consider looking at what fonts are being used by the app(s) and adding them to the Windoze fonts to see if it doesn't help.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Dirk KotteSECommented:
possible there are problems with a MS security hotfix:

KB2993651 Behavior changes with this security update
"After you install this security update, fonts that are installed in a location other than the default fonts directory (%windir%\fonts\) cannot be changed when they are loaded into any active session. Attempts to change, replace, or delete these fonts are blocked, and a "File in use" message is displayed."

There are TTF probles within other apps also (here AdobeReader):

I solved this at my terminalservers with a AR Workaround preventing TTF to .tmp save these days.
blinkme323Author Commented:
Ended up being an issue with Adobe, thanks for the input!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.