We have one client who is getting several SOA***.tmp files in the root of C:\ The files are 0kb in size and contain no data.
I've turned on file system auditing on C:\ and it did not help. When looking through the file auditing records, it seems almost every time these SOA***.tmp files are created there's an Anti-Virus (Symantec End-Point 12.1) event. However, re-installing, disabling, and uninstalling did not get rid of the SOA***.tmp files.
The files are created (it seems) at random times but always start with SOA, then 3 characters, .tmp The client gets several of these a day. There is no real rhyme or reason as to when they show up that I have found. Any help would be greatly appreciated.
Thanks in advance,
-Phil