Huge files (30+GB) creating themselves in c:/windows - Help !

mediaccess · 05 Nov 2015

Hello

For a day or two, my 256GB drive got maxed up. I did a number of things (getting rid of the biberfil.sys) and looked on the net to no avail.

The culrpit are 4 hidden files (3 are 31.9GB !) and are simply named "e" "s" "y" and "0". No extension.
I cannot delete them (file used in another pgm).

I ran malware anti malware, but it did not find anything.

I am in a bit of a problem. It seems my restoration has been disabled. Do I have a virus ?

Thank you

Layback Bear · 05 Nov 2015

Yes you could be infected but lets get some information first if we can.

Fill in your (My System Specs) completely including your security programs and power supply. This tutorial by Brink should help you.

System Info - See Your System Specs

What security programs have you ran looking for a possible infection?

mediaccess · 05 Nov 2015

Hi

Thank you for taking the time. I filled the specs of my machine.

I ran MSE and malware anti malware

Layback Bear · 05 Nov 2015

I presume that biberfil.sys is Hibernation.
Is that correct?

Because you have 32 gigs of ram and your hibernation folder can be big.

If it was my computer I would disable hibernation and reboot.
You could use this tutorial by Brink to help you. Please read completely.

Hibernate - Enable or Disable

Then check and see if you have the same problem.

mediaccess · 05 Nov 2015

I disabled my hibernation (hiberfil.sys) and it is no longer on the C:/

The strange files I am having problem with are named with only one letter (e, s, y and 0), no extension,, are system hidden files in the windows directory. (see picture)

edit : I have only the pagefile.sys on the root folder (it is big, but it is normal).

Layback Bear · 05 Nov 2015

Be careful those are system files. I see they were made today. Until you know exactly what they are and where they are located don't mess with them.

I really don't know what they are. Maybe some other member will know.

Did you reboot after disabling hibernation?

In folder options have you set hidden files so you can see them?

mediaccess · 06 Nov 2015

Layback Bear said:

Be careful those are system files. I see they were made today. Until you know exactly what they are and where they are located don't mess with them.

They are phony system files. I do not have those on any other computer. I'd be happy to be able to delete them. But I cannot.

Layback Bear said:

In folder options have you set hidden files so you can see them?

Yes. That is why I see them.

Layback Bear · 06 Nov 2015

Can you right tick on them and select Properties or Open File Location and just see what they are and where?

As of yet I'm not sure they are phony or not. How did you find them?

I see you have Raid and lots of drives. I know nothing about Raid which I'm thinking might be causing your problem.

mediaccess · 06 Nov 2015

See attached the properties of "y". No extension. Marked as a system file.
The thing is, it created when I powered on the PC. Today, 6 minutes ago.

I'm pretty sure it does not have anything to do with my raids and whatnot. The machine has been rolling without a hitch like this for more than a year.

DavidE · 06 Nov 2015

There are utilities that should help you find what program has the file locked.
I suggest starting with Sysinternals Process Explorer and see if that gives you info that helps.
It's a free MS utility.

Take a look at this article:
How To Delete, Move, or Rename Locked Files in Windows