Something is making ~15GB of .TMP files every few hours

[avery]

They're all start with "~DF".

Thousands and thousands of 350KB files. I have to manually delete them.

 

[Bill2]

Do they go away after a restart? You can usually use Process Explorer to track down exactly what's creating files like this.

 

[avery]

Do they go away after a restart? You can usually use Process Explorer to track down exactly what's creating files like this.

They do not.

 

[Bill2]

As i said try using Process Explorer to track down the creator. Such files can be produced by any number of applications and by windows itself, but normally they would be deleted once that process terminates or upon restart.

If the process creating them were still active, the files would be locked and you would be unable to delete them. If you are able to delete them any time, you can create a task to run CCleaner a couple of times a day. That would be a workaround but try using Process Explorer first.

 

[avery]

As i said try using Process Explorer to track down the creator. Such files can be produced by any number of applications and by windows itself, but normally they would be deleted once that process terminates or upon restart.

If the process creating them were still active, the files would be locked and you would be unable to delete them. If you are able to delete them any time, you can create a task to run CCleaner a couple of times a day. That would be a workaround but try using Process Explorer first.

Can you explain what exactly I should do in Process Explorer?

 

[Bill2]

Run Process Explorer (You can download it here)

Press Ctrl+F to display the find dialog box.

Type the temporary file’s name in the dialog and click Search.

If a program is using that temporary file then the file should be listed along with the process name.

If the process name doesn’t look familiar then you can close the Find dialog and double click the process name in the Process Explorer process list. That will show you the full program path and description.

 

[avery]

Run Process Explorer (You can download it here)

Press Ctrl+F to display the find dialog box.

Type the temporary file’s name in the dialog and click Search.

If a program is using that temporary file then the file should be listed along with the process name.

If the process name doesn’t look familiar then you can close the Find dialog and double click the process name in the Process Explorer process list. That will show you the full program path and description.

Returns 0 matching items.

 

[Bill2]

0 matching items means the file has been deleted. Go into the temp folder and note down the name of an existing temp file. Then do the Process Explorer thing.

 

[avery]

0 matching items means the file has been deleted. Go into the temp folder and note down the name of an existing temp file. Then do the Process Explorer thing.

Either I'm doing this wrong... or something else is.

 

[Bill2]

That can also mean the temp file is not in use. Can you locate the particular temp file on your hdd (you can use windows search)?

Try locating a temp file which does not let you delete it. That file should be in use and should show up through process explorer.

 

[avery]

That can also mean the temp file is not in use. Can you locate the particular temp file on your hdd (you can use windows search)?

Try locating a temp file which does not let you delete it. That file should be in use and should show up through process explorer.

They all are deletable. :/

By the way, every time I delete these files, 100s more are created within seconds.

 

[Bill2]

Try a couple of things:

1) Do a full scan for malware with malwarebytes antimalware. Clean whatever it wants to clean.

2) Go to MSCONFIG and disable all startup items except your antivirus. Reboot, then observe if the problem persists. If it doesnt, you'll need to re-enable the startups one by one to isolate the culprit.

 

[avery]

Try a couple of things:

1) Do a full scan for malware with malwarebytes antimalware. Clean whatever it wants to clean.

2) Go to MSCONFIG and disable all startup items except your antivirus. Reboot, then observe if the problem persists. If it doesnt, you'll need to re-enable the startups one by one to isolate the culprit.

I believe that the culprit is Microsoft Security Essentials.

 

[vpwin7]

Also you should perhaps sort by time created, and acknowledge what is processing during that time. If your computer is idle and these files are still popping out the first thing I would assume is you either have a very very very faulty program, or something possibly worse. Although can't say I ever heard of a virus that just creates tmp files... If it continues while idle I would just start killing off processes until it stops, also take note if new processes appear as you kill some.

 

[fseal]

Use the built int windows resource monitor. Go to the task manager (right click the task bar), on the performance tab click Resource Monitor. No go to the hard drive tab. It will show all programs that are writing to the harddrive.

If the files are being created rapidly, the culprit should go to the top of the list if you sort on file io. I believe you can see what fil is being written to as well so you can try scnning the list.

Unfortuately if the files are being wrriten VERY quickly and only occasionaly it may be hard to catch it in the act. But if it's frequent enough, you should be able to see it happening n that screen.

(ProcessExplorer is a great tool but I believe that the built in tools should be learned and exhausted before moving to using something you have to install if possible. The built in tools are always there on any computer (windows 7 computer) you run into. Knowing how to use them will save a lot of time in various random situations like this.)

 

[avery]

Use the built int windows resource monitor. Go to the task manager (right click the task bar), on the performance tab click Resource Monitor. No go to the hard drive tab. It will show all programs that are writing to the harddrive.

If the files are being created rapidly, the culprit should go to the top of the list if you sort on file io. I believe you can see what fil is being written to as well so you can try scnning the list.

Unfortuately if the files are being wrriten VERY quickly and only occasionaly it may be hard to catch it in the act. But if it's frequent enough, you should be able to see it happening n that screen.

(ProcessExplorer is a great tool but I believe that the built in tools should be learned and exhausted before moving to using something you have to install if possible. The built in tools are always there on any computer (windows 7 computer) you run into. Knowing how to use them will save a lot of time in various random situations like this.)

The highest writer is "System", which is writing 300,000 bytes/sec

 

[cangaceiro]

think I found the process responsible for this, I believe it is the C:\Program Files (x86)\TV IR\TV IR.exe

i hate it!!!

 

[avery]

Unfortunately, I do not have that program installed. :/ Can't find out what's causing this.

 

[Fumz]

Try a couple of things:

1) Do a full scan for malware with malwarebytes antimalware. Clean whatever it wants to clean.

2) Go to MSCONFIG and disable all startup items except your antivirus. Reboot, then observe if the problem persists. If it doesnt, you'll need to re-enable the startups one by one to isolate the culprit.

I believe that the culprit is Microsoft Security Essentials.

Have you disabled that service to see if it's the cause?

 

[cangaceiro]

Unfortunately, I do not have that program installed. :/ Can't find out what's causing this.

sorry, but my problem was identical to his description... good luck!