I am trying to figure out the source of files named TFRA???.TMP written to C:\WINDOWS\TEMP. I can open them in Notepad and they contain the body of incoming email messages (no headers). Does anyone know what creates these files?
C:\WINDOWS\TEMP is not the system temp or tmp directory.
Mercury runs on a dedicated PC with ClamAV and POPFile.
I can not find C:\WINDOWS\TEMP configured as a path in Mercury or POPFile (also searched mercury.ini).
Occasionally the AV product on this machine (Vipre) will quarantine one of them (scheduled scanning only).
