Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Random files under Windows\temp

$
0
0

Hello All,

We have an issue on our web server. there are a lot of random generated files under windows\temp cause disk get full.

files names and extensions are generated randomly. I guess iis does that. in the content of files is javascriptand css codes that used by our web application. 

below is screenshot of Wondows\temp dirrectory. 

Is that a virus that generates these files? 

why these files are generated ? 

We are using Windows server 2008 R2  and iis7.

below is also content from one of these files 

      base.init = function () {
            base.options = o = $.extend(true, {}, $.keyboard.defaultOptions, options);

            // Shift and Alt key toggles, sets is true if a layout has more than one keyset - used for mousewheel message
            base.shiftActive = base.altActive = base.metaActive = base.sets = base.capsLock = false;
            base.lastKeyset = [false, false, false]; // [shift, alt, meta]
            // Class names of the basic key set - meta keysets are handled by the keyname
            base.rows = ['', '-shift', '-alt', '-alt-shift'];
            base.acceptedKeys = [];
            base.mappedKeys = {}; // for remapping manually typed in keys
            $('<!--[if lte IE 8]><script>jQuery("body").addClass("oldie");</script><![endif]--><!--[if IE]><script>jQuery("body").addClass("ie");</script><![endif]-->').appendTo('body').remove();
            base.msie = $('body').hasClass('oldie'); // Old IE flag, used for caret positioning
            base.allie = $('body').hasClass('ie'); // $.browser.msie being removed soon
            base.inPlaceholder = base.$el.attr('placeholder') || '';
            base.watermark = (typeof (document.createElement('input').placeholder) !== 'undefined' && base.inPlaceholder !== ''); // html 5 placeholder/watermark
            base.regex = $.keyboard.comboRegex; // save default regex (in case loading another layout changes it)
            base.decimal = (/^\./.test(o.display.dec)) ? true : false; // determine if US "." or European "," system being used
            // convert mouse repeater rate (characters per second) into a time in milliseconds.
            base.repeatTime = 1000 / (o.repeatRate || 20);

            // Check if caret position is saved when input is hidden or loses focus
            // (*cough* all versions of IE and I think Opera has/had an issue as well
            base.temp = $('<input style=";left:-9999em;top:-9999em;" type="text" value="testing">').appendTo('body').caret(3, 3);
            // Also save caret position of the input if it is locked
            base.checkCaret = (o.lockInput || base.temp.hide().show().caret().start !== 3) ? true : false;
            base.temp.remove();
            base.lastCaret = { start: 0, end: 0 };

            base.temp = ['', 0, 0]; // used when building the keyboard - [keyset element, row, index]

            // Bind events
            $.each('initialized beforeVisible visible change hidden canceled accepted beforeClose'.split(' '), function (i, f) {
                if ($.isFunction(o[f])) {
                    base.$el.bind(f + '.keyboard', o[f]);
                }
            });

            // Close with esc key & clicking outside
            if (o.alwaysOpen) { o.stayOpen = true; }
            $(document).bind('mousedown.keyboard keyup.keyboard touchstart.keyboard', function (e) {
                if (base.opening) { return; }
                base.escClose(e);
                // needed for IE to allow switching between keyboards smoothly
                if (e.target && $(e.target).hasClass('ui-keyboard-input')) {
                    var kb = $(e.target).data('keyboard');
                    if (kb && kb.options.openOn) {
                        kb.focusOn();
                    }
                }
            });

Need your urgent help

Best Regards

Ziyadxan 


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>