Video Screencast Help

Users create .tmp files from mails

Created: 31 Oct 2012 • Updated: 31 Oct 2012 | 3 comments

Hello all,

weve updated Symantec Endpoint to version 12.1.1 MP1 a few weeks ago.

Ever sinds we are having a strange  phenomenon, the users (who work on a RDP server) are creating .TMP (no filename) files on different places.

If you open the .TMP files you can see a mail inside, so outlook is making copies of certain mails to disk and names them .tmp??

I haven't found a pattern yet.

Comments 3 CommentsJump to latest comment

ᗺrian's picture

What directory is this being created in?

Can you share a screenshot?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Mithun Sanghavi's picture


This is indeed strange...

Could you let us know from which version did you migrate to Symantec Endpoint Protection to version 12.1.1 MP1?

Is there any other Antivirus on the machine?

Any particular reason, you feel this could be occured due to Symantec Endpoint Protection?

I would suggest you to create a case with Symantec Technical Support,

How to create a new case in MySupport

Phone numbers to contact Tech Support:-
Regional Support Telephone Numbers:
  • United States: 800-342-0652 (407-357-7600 from outside the United States)
  • Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
  • United Kingdom: +44 (0) 870 606 6000
Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Said Paap Twin's picture

The files appear in the users document folder and on the network shares. I have a feeling it has something to do with opening or adding attachments in outlook.

list of files yesterday and today


D:\Network>dir /s ".tmp" | FIND "31-10-2012" | sort

31-10-2012  07:43            19.065 .TMP
31-10-2012  08:25             7.702 .TMP
31-10-2012  09:17             6.836 .TMP
31-10-2012  09:34            12.012 .TMP
31-10-2012  09:54             6.580 .TMP
31-10-2012  09:59            10.144 .TMP
31-10-2012  10:26            14.127 .TMP
31-10-2012  18:34            15.165 .TMP
D:\Network>dir /s ".tmp" | FIND "01-11-2012" | sort
01-11-2012  07:55             8.441 .TMP
01-11-2012  08:20             6.285 .TMP
01-11-2012  08:27             9.519 .TMP
01-11-2012  08:31             6.357 .TMP
There isnt any other virusscanner on the machine.
We feel Symantec Endpoint is having a share because 
1. this started after the upgrade
2. sometimes the files stay away for a couple of days, and after we reboot the server containing the symatnec management console the files start appearing again
i dont have any clou yet to when the files stop being created.
i wil have a look at creating a MySupport ticket, tx!