I keep seeing malicious .DOC and .JS files appear in the \AppData\Local\Temp & the \Temporary Internet Files of users. A few questions:

  1. Under what circumstances do DOCs and JS files appear in these locations? Is it just from web browsing?
  2. Is this indicative of a malware infection?

Temporary directories store cached information for fast retrieval. The Temporary Internet Files directory stores cached versions of webpages, including any attached files, such as javascript. Temporary versions of document files may be downloaded if you select "open" rather than "save" upon downloading a file. In either case, depending on the nature of the malicious file, the file could execute from the temporary directory, but having doc/js files in this directory in and of itself is no cause for concern unless those files have been identified as malicious.

  • In this case they've alerted as malicious, is there a way to determine if they've been ran? I'm trying to determine if there presence in this cache is a cause for concern or not. – Asa Hunt Dec 20 '17 at 21:39
  • If they've been identified as malicious, then they should be removed from the cache immediately, and I would also issue a full AV scan if this has not been done already. As to whether or not they've been executed, that is a bit more of a difficult question to answer. Windows event logs may give you some clues regarding the Doc files. JS can be executed from the browser with very little trace, however. – John Dec 21 '17 at 15:00

The only time you should see document files or other downloads in a temp folder is if you are using Internet Explorer. All other browsers store all downloads in the downloads folder.

DOC files appearing in the temp directory from Internet downloads may be indicative of an issue, as generally Edge and IE only store files there if you click the option to run after a download.

ActiveX controls are the biggest vulnerability. JS files do get stored in the respective webrowsers appdata or the temporary directries. Try running CCleaner or another cleaning program or the disk cleanup utility to remove these files.

In short, it's "normal" but could be a security risk. Quick scans always check these directories if that says anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.