Well that was unsettling! – LMIR0001.tmp.bat.js

First of all, if you are having this problem I want to put your mind at ease. – It does not appear to be anything dangerous. Just a conflict between how your computer is set up vs. the average Windows settings. Here’s the story behind my LMIR0001.tmp.bat.js scare ..

My Windows 7 pro laptop was running slow, as it often does after a week or so of me running several notepads, browser windows , word documents, excel sheets,  graphics programs and files, FTP connections, bat files , dreamweaver, notepad++ , messenger clients, a webserver, etc … (In other words, I use my computer’s resources heavily. It has every right to feel bogged down after a week or so of use.) My computer was clearly in need of a reboot.

Tonight was a particularly slow shutdown experience. Windows only needed to do 3 updates, but they were taking  forever. I went out for a while. When I returned home, I decided I better boot up tonight – just in case it needed to do more updates before being usable at the office tomorrow.

That was when things got worrisome! …

I pressed the power button and got my regular login screen. But when I selected my admin account I was taken to a screen that was almost all black – except for an Adobe Dreamweaver CS5 window. – It was not minimized. It opened the files I was previously working on as usual, but it also opened LMIR0001.tmp.bat.js located at C:\Users\Michelle\AppData\Local\Temp\LMIR0001.tmp.bat.js .

After I closed dreamweaver, my regular Windows 7 desktop loaded … Then Dreamweaver opened again with a second copy of the same file! By this point I was getting pretty worried. I did not think I had a virus. But did dreamweaver release a faulty update? I turned to my favorite search engine for answers.

Between the information contained in search results, knowing what ‘out of the ordinary’ things I have done over the past week, and my own ability to wade through code (and my ability to ask a more advanced programmer friend for help), here is what I concluded:

• LMIR0001 stands for a Log Me In Rescue.
• LogMeIn Rescue is a remote connection that allows tech support departments to use your computer while they troubleshoot or debug your problem(s).
• I must have gotten this file a few days ago when I downloaded and installed Support-LogMeInRescue.exe from http://www.brother-usa.com/remote . ( I was having problems with a Brother HL 2170w printer. )
• LMIR0001.tmp.bat.js was actually supposed to use Windows scripting host ( Wscript ) to run a javascript batch file.
• Apparently the reason this didn’t run quite as planned was because I have Dreamweaver set as the default program to open .js files. – This is intentional since as a programmer, I spend more time editing the .js files stored on my computer than running them.

So what do the involved files look like? And what exactly are they supposed to do?

LMIR0001.tmp.bat.js

First, the file that was opened in my Dreamweaver looked something like this:

function DeleteCleanup() {
var fso = new ActiveXObject(“Scripting.FileSystemObject”);
var scriptFile = WScript.ScriptFullName;
while(fso.FileExists(scriptFile)) {try { fso.DeleteFile(scriptFile, true); } catch (e) {}}
var batchFile = “\”C:/Users/MyUsername/AppData/Local/Temp/LMIR0001.tmp.bat\””;
while(fso.FileExists(batchFile)) {
try { fso.DeleteFile(batchFile, true); } catch (e) {}
}
}
try {
var so = new ActiveXObject(“Wscript.Shell”);
so.Run(“\”C:/Users/MyUsername/AppData/Local/Temp/LMIR0001.tmp.bat\””, 0);
DeleteCleanup();
} catch (e) {
}

The above code’s main job is to run LMIR0001.tmp.bat , if it exists.

LMIR0001.tmp.bat

The batch file looks something like this:

@echo off
:RemoveFiles
if not exist “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp\” goto :end
ping -n 2 127.0.0.1 >NUL
del “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp\*.*” /f /q > nul
rmdir “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp\” > nul
goto :RemoveFiles
:end
del “C:\Users\MyUsername\AppData\Local\Temp\LMIR0001.tmp.bat”

This file’s jobs appear to be to:

• Delete the files that were created when you ran ” Support-LogMeInRescue.exe “
• Delete the directory that was created when you ran ” Support-LogMeInRescue.exe “
• Delete itself. – After it has successfully ran, there is really no reason for you to keep it.

The first two jobs worked nicely even though I saw the .js file that calls this bat file open in Dreamweaver. … I guess it somehow still ran in the background? … Like it opened in the right place in addition to dreamweaver? Not sure.

The part where it is supposed to delete itself did not work automatically. It did, however, work when I ran the bat file again after it had already deleted the files and directory. I did read on one website that the bat file is only supposed to run once. Perhaps this is why it didn’t get to the “if not exist “C:\Users\Michelle\AppData\Local\Temp\LMIR0001.tmp\” goto :end” part.

What about next time you restart your computer?

I am happy to report that when I restarted my computer again, all was well. LMIR0001.tmp.bat.js was apparently set to run just once, so that it could do its job of cleaning up the files LogMeIn left behind.

I was hoping that restarting would run the bat files mentioned above just 1 more time so that they could get rid of themselves. It did not work out this way, and that is why I had to run LMIR0001.tmp.bat myself the second time. … I also tried running LMIR0001.tmp.bat in a cmd window. It did not appear to do anything. Guess I will have to delete this file the old fashioned way.