Well that was unsettling! – LMIR0001.tmp.bat.js

First of all, if you are having this problem I want to put your mind at ease. – It does not appear to be anything dangerous. Just a conflict between how your computer is set up vs. the average Windows settings. Here’s the story behind my LMIR0001.tmp.bat.js scare ..

My Windows 7 pro laptop was running slow, as it often does after a week or so of me running several notepads, browser windows , word documents, excel sheets,  graphics programs and files, FTP connections, bat files , dreamweaver, notepad++ , messenger clients, a webserver, etc … (In other words, I use my computer’s resources heavily. It has every right to feel bogged down after a week or so of use.) My computer was clearly in need of a reboot.

Tonight was a particularly slow shutdown experience. Windows only needed to do 3 updates, but they were taking  forever. I went out for a while. When I returned home, I decided I better boot up tonight – just in case it needed to do more updates before being usable at the office tomorrow.

That was when things got worrisome! …

I pressed the power button and got my regular login screen. But when I selected my admin account I was taken to a screen that was almost all black – except for an Adobe Dreamweaver CS5 window. – It was not minimized. It opened the files I was previously working on as usual, but it also opened LMIR0001.tmp.bat.js located at C:\Users\Michelle\AppData\Local\Temp\LMIR0001.tmp.bat.js .

After I closed dreamweaver, my regular Windows 7 desktop loaded … Then Dreamweaver opened again with a second copy of the same file! By this point I was getting pretty worried. I did not think I had a virus. But did dreamweaver release a faulty update? I turned to my favorite search engine for answers.

Between the information contained in search results, knowing what ‘out of the ordinary’ things I have done over the past week, and my own ability to wade through code (and my ability to ask a more advanced programmer friend for help), here is what I concluded:

  • LMIR0001 stands for a Log Me In Rescue.
  • LogMeIn Rescue is a remote connection that allows tech support departments to use your computer while they troubleshoot or debug your problem(s).
  • I must have gotten this file a few days ago when I downloaded and installed Support-LogMeInRescue.exe from http://www.brother-usa.com/remote . ( I was having problems with a Brother HL 2170w printer. )
  • LMIR0001.tmp.bat.js was actually supposed to use Windows scripting host ( Wscript ) to run a javascript batch file.
  • Apparently the reason this didn’t run quite as planned was because I have Dreamweaver set as the default program to open .js files. – This is intentional since as a programmer, I spend more time editing the .js files stored on my computer than running them.

So what do the involved files look like? And what exactly are they supposed to do?

LMIR0001.tmp.bat.js

First, the file that was opened in my Dreamweaver looked something like this:

function DeleteCleanup() {
var fso = new ActiveXObject(“Scripting.FileSystemObject”);
var scriptFile = WScript.ScriptFullName;
while(fso.FileExists(scriptFile)) {try { fso.DeleteFile(scriptFile, true); } catch (e) {}}
var batchFile = “\”C:/Users/MyUsername/AppData/Local/Temp/LMIR0001.tmp.bat\””;
while(fso.FileExists(batchFile)) {
try { fso.DeleteFile(batchFile, true); } catch (e) {}
}
}
try {
var so = new ActiveXObject(“Wscript.Shell”);
so.Run(“\”C:/Users/MyUsername/AppData/Local/Temp/LMIR0001.tmp.bat\””, 0);
DeleteCleanup();
} catch (e) {
}

The above code’s main job is to run LMIR0001.tmp.bat , if it exists.

LMIR0001.tmp.bat

The batch file looks something like this:

@echo off
:RemoveFiles
if not exist “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp\” goto :end
ping -n 2 127.0.0.1 >NUL
del “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp\*.*” /f /q > nul
rmdir “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp\” > nul
goto :RemoveFiles
:end
del “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp.bat”

This file’s jobs appear to be to:

  • Delete the files that were created when you ran ” Support-LogMeInRescue.exe “
  • Delete the directory that was created when you ran ” Support-LogMeInRescue.exe “
  • Delete itself. – After it has successfully ran, there is really no reason for you to keep it.

The first two jobs worked nicely even though I saw the .js file that calls this bat file open in Dreamweaver. … I guess it somehow still ran in the background? … Like it opened in the right place in addition to dreamweaver? Not sure.

The part where it is supposed to delete itself did not work automatically. It did, however, work when I ran the bat file again after it had already deleted the files and directory. I did read on one website that the bat file is only supposed to run once. Perhaps this is why it didn’t get to the “if not exist “C:\Users\Michelle\AppData\Local\Temp\LMIR0001.tmp\” goto :end” part.

What about next time you restart your computer?

I am happy to report that when I restarted my computer again, all was well. LMIR0001.tmp.bat.js was apparently set to run just once, so that it could do its job of cleaning up the files LogMeIn left behind.

I was hoping that restarting would run the bat files mentioned above just 1 more time so that they could get rid of themselves. It did not work out this way, and that is why I had to run LMIR0001.tmp.bat myself the second time. … I also tried running LMIR0001.tmp.bat in a cmd window. It did not appear to do anything. Guess I will have to delete this file the old fashioned way.

14 Comments

  1. Heather on May 6, 2011 at 12:36 PM

    Thanks for this. You saved me quite a bit of freak-out and worriedness.

    • Michelle on May 12, 2011 at 9:16 AM

      I am so glad to see that I have helped someone! … I know it freaked me out when this message first appeared on my screen. It took a while to figure out exactly what the cause was.

      • Dan on June 8, 2011 at 7:59 AM

        I had the same problem… good to know what it is and why it happened.

  2. Michael on May 31, 2011 at 11:40 AM

    Thanks Michelle! I appreciate you taking the time to log your experience!

  3. UnderCoverGuy on June 3, 2011 at 9:13 AM

    THANK YOU – CUDOS!!!

    You saved me lots of time searching and tons of effort finding a solution as well. I will say that your detail and explanation were spot on. I just used LMI a couple of days ago. Your page gets a bookmark in my Favorites!!!

    Thanks again,
    UCG

  4. Rocket on June 13, 2011 at 8:42 AM

    So, I booted up my PC for work today, and Notepad++ opens up with a file called LMIR0001.tmp.bat.js inside.

    I got all panicked that I had a virus, and found the following page: http://ask.metafilter.com/180845/LMIR0001tmpbatjs

    On there someone mentioned that this file was from Log Me In Rescue. After Googling “log me in rescue tmp bat js”, I found this page.

    Thanks for explaining that this isn’t a virus. I was kinda worried.

  5. Freakingout on July 13, 2011 at 2:46 PM

    Thanks so much for this my company has been on stupid high aleart because of some stupid stuff.. thanks for posting this so compleetly and letting us the masses know about this i had just used lot me in yesterday and came back to the office to see this after trying to VM a box and it vailed… i was freaking out thinking my box got compromised. You are my hero ferris bueler.

  6. Joyce Keller on July 14, 2011 at 7:24 AM

    Thanks, I do the same thing… Dreamweaver opened the .js file automatically. Your post is the only one that explains this properly. Other Google results claim that it is malware and try to sell you thier software to clean it up!

    Have a splendid year, may all your code be happy 🙂

  7. Dodie on August 17, 2011 at 10:04 AM

    Had this file just for a few days. I started when I started my computer. LMIR0001.TEMP.DAT.JS has the signature of dw (dream weaver) it is in file user/your name/temp/ LMIR0001.tmp.bat.js NO TMP.BAT.JS file should be in that file. go to http://www.filehippo.com and download CCLEANER. filehippo is safe. It will delete all those file and more. It will get rid of all the temp files. It fixed it!

  8. Jim on September 20, 2011 at 9:32 PM

    Whew, concise and perfect … I had an almost identical scenario … thanks for saving me hours of freak time!

  9. This is a SCAM!!! on August 4, 2013 at 5:48 PM

    Either This site is part of the scam or Michelle needs to get another job! It’s not part of LOGMEIN.com It’s LogMeInRescue They will send you to LogMeIn123.com where an Indian Tech will log onto your computer and pretend you have a virus then ask for money. You probably Googled a tech support # like Yahoo Customer Care… But you got these IDIOTS…. Where they can login to your computer at anytime… see youtube for funny videos of these d1ckheads in action… By the way if AV software sez you’re OK keep in mind… It’s been compromised and SO HAVE YOU!!!

    http://www.scambook.com/report/view/112833/PC-Care-Expertsnet-Complaint-112833-for-$170.00

    • Michelle on October 3, 2013 at 9:37 PM

      Wow. Rude way to point out a possible typo on my part.

  10. jaybob on August 8, 2015 at 11:32 PM

    I’m no doubt an idiot. I got a pop up that several of my drivers were out of date, and agreed to purchase Slim Cleaner Plus, and let the Indian techies install it. And, as someone pointed out, they wanted more money to clean out files. I refused that, and they quickly vamoosed.
    I do wonder whether or not the remote access allowed a search through personal files, and whether or not a virus or other malware was inserted.
    I was encouraged that the software was safe by its listing in PC Mag. I guess I’ll find out sooner or later how badly I screwed up

    • Michelle on November 6, 2015 at 9:05 AM

      I never heard of Slim Cleaner Plus. What was it for? Maybe I can help you find a better (free) way to take care of your problem. … Sorry for the delayed response. The last few months have been extra hectic (in a good way) at my house.

Leave a Comment