I have a user who has some of his temp files being created in the root directory of the C: drive on his Vista notebook.
System Properties > Advanced > Environment Variables > User Variables for USER NAME > TEMP (and TMP) both show "%USERPROFILE%\AppData\Local\Temp"
Under System Variables, they both point to "c:\windows\temp"
If I go to a cmd prompt and type "echo %USERPROFILE%" I get "c:\Users\USER NAME". Typing "echo %TEMP%" gives "c:\Users\USERNA~1\AppData\Local\Temp" as does "echo %TMP%".
I don't see any problems in other environment variables.
Obviously, this user somehow set his root directory to be writeable.
Any explanation why these files are going there and what to do about it?