why does seamonkey write to ie temp directories

[LMHmedchem]

Hello,

MS Internet Explorer is not installed on my OS, but I have been frustrated by the number of attempts of other software applications to access ie files and folders. Even with ie uninstalled, you can't physically remove the directory or its contents. Many other applications are constantly accessing files in the ie directory. My guess is that this is an attempt by other applications to find a way onto the internet through a program that would typically have unrestricted access. I have blocked this by blocking access to the ie directories.

Oddly enough, seamonkey is one of the applications that tries to access the ie directories and files. In particular the files,
C:\Documents and Settings\user\Local Settings\Temp\History\History.IE5\index.dat
C:\Documents and Settings\user\Local Settings\Temp\History\History.IE5\desktop.ini
C:\Documents and Settings\user\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\user\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini

Can someone say why it is that seamonkey is trying to access these files? Why would seamonkey have anything to do with ie temp files?

LMHmedchem

[therube]

What are you using to see that SeaMonkey is access those files/directories?

Appears that it is going to be "OS" operations that you perform, involving SeaMonkey, that cause hits (at least to) \History\History.IE5\index.dat.

file:/// entries.

So maybe dragged a file (or File Open, I suppose); html, jpg, flv... into SeaMonkey.
That action is recorded by the OS.
(And likewise, the same done outside of "SeaMonkey" too.)

---

TIF

I know my email program, Eudora, hits TIF.
Email drops small "ancillary" files into TIF. jpg, png, bmp (like a business "logo" that displays in the email), perhaps an odd css or htm.

Possible I suppose, that media "opened in SeaMonkey", which is most often really opened in a Plugin (& that plugin is part of whatever the plugin is & is not "SeaMonkey") , might drop something there?

---

%TMP%

"etilqs" files (like etilqs_IJwuKJXNIdzqZaH) are transient files that drop into %TMP% by Mozilla.

---

Might fire up Nirsoft's ProcessActivityView & have it monitor seamonkey.exe for a bit & see what it logs.

[LMHmedchem]

What are you using to see that SeaMonkey is access those files/directories?

I have the directories listed above blocked using CIS Defense+, which is a HIPS. By rule, it blocks execution of non-white listed applications. You can also specify files or folders as "safe" or "blocked". The ie program files directory is blocked attempted access appears in the log file. This is where I see all of the cross talk on the system that is trying to get to ie files.

I also have the relevant temp file directories blocked. It is in the CIS logs that I see seamonkey making access attempts.

Appears that it is going to be "OS" operations that you perform, involving SeaMonkey, that cause hits (at least to) \History\History.IE5\index.dat.

Access begins at seamonkey startup. When I start seamonkey, there are about 5 entries into the CIS log of seamonkey trying to access the index.dat file. The log indicates that it is seamonkey.exe that is attempting the access, so this would not be a system process loging a system event but seamonkey.exe trying to access a file. I suppose that filemon would show the same thing but I haven't checked that.

I am not seeing anything in the logs about,
C:\Documents and Settings\user\Local Settings\Temp\History\History.IE5\desktop.ini

so maybe those entries were from a different application and we should set that aside for now unless I see it again in the logs. There seem to be allot of copies of both index.dat and desktop.ini in different temp locations and i have never understood that.

I should also mention that I have not noticed any adverse affects from these locations being blocked other than entries clogging up my log files.

I will check out ProcessActivityView and see if that shows anything interesting.

LMHmedchem

[therube]

Well SeaMonkey makes system calls through USER32.dll (& others) that involve things like shell32.dll & Explorer.exe & mydocs.dll & ...

And maybe what your HIPS is showing as "seamonkey.exe" is only "seamonkey" by virtue of the calls it is making that then propagate to other processes?

If you block IE (iexplore.exe) from those same directories in the same way that you're wanting to block seamonkey.exe, & then run Internet Explorer, does it too access those areas even though in your HIPS you've said not to?


(And I don't particularly know about such things, rather just saying it as I see it.)


You could also see what Process Monitor shows, but that's a far more involved (at least for me) utility.