Huge files (30+GB) creating themselves in c:/windows - Help !

[mediaccess]

Hello

For a day or two, my 256GB drive got maxed up. I did a number of things (getting rid of the biberfil.sys) and looked on the net to no avail.

The culrpit are 4 hidden files (3 are 31.9GB !) and are simply named "e" "s" "y" and "0". No extension.
I cannot delete them (file used in another pgm).

I ran malware anti malware, but it did not find anything.

I am in a bit of a problem. It seems my restoration has been disabled. Do I have a virus ?

Thank you

 

[Layback Bear]

Yes you could be infected but lets get some information first if we can.

Fill in your (My System Specs) completely including your security programs and power supply. This tutorial by Brink should help you.

http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

What security programs have you ran looking for a possible infection?

 

[mediaccess]

Hi

Thank you for taking the time. I filled the specs of my machine.

I ran MSE and malware anti malware

 

[Layback Bear]

I presume that biberfil.sys is Hibernation.
Is that correct?

Because you have 32 gigs of ram and your hibernation folder can be big.

If it was my computer I would disable hibernation and reboot.
You could use this tutorial by Brink to help you. Please read completely.

http://www.sevenforums.com/tutorials/819-hibernate-enable-disable.html

Then check and see if you have the same problem.

 

[mediaccess]

I disabled my hibernation (hiberfil.sys) and it is no longer on the C:/

The strange files I am having problem with are named with only one letter (e, s, y and 0), no extension,, are system hidden files in the windows directory. (see picture)

edit : I have only the pagefile.sys on the root folder (it is big, but it is normal).

 

[Layback Bear]

Be careful those are system files. I see they were made today. Until you know exactly what they are and where they are located don't mess with them.

I really don't know what they are. Maybe some other member will know.

Did you reboot after disabling hibernation?

In folder options have you set hidden files so you can see them?

 

[mediaccess]

Be careful those are system files. I see they were made today. Until you know exactly what they are and where they are located don't mess with them.

They are phony system files. I do not have those on any other computer. I'd be happy to be able to delete them. But I cannot.

In folder options have you set hidden files so you can see them?

Yes. That is why I see them.

 

[Layback Bear]

Can you right tick on them and select Properties or Open File Location and just see what they are and where?

As of yet I'm not sure they are phony or not. How did you find them?

I see you have Raid and lots of drives. I know nothing about Raid which I'm thinking might be causing your problem.

 

[mediaccess]

See attached the properties of "y". No extension. Marked as a system file.
The thing is, it created when I powered on the PC. Today, 6 minutes ago.

I'm pretty sure it does not have anything to do with my raids and whatnot. The machine has been rolling without a hitch like this for more than a year.

 

[DavidE]

There are utilities that should help you find what program has the file locked.
I suggest starting with Sysinternals Process Explorer and see if that gives you info that helps.
It's a free MS utility.

Take a look at this article:
How To Delete, Move, or Rename Locked Files in Windows

 

[mediaccess]

I located one of the files in Process explorer, but when I try to close the handle, it says :"Error opening process : The handle is invalid."

 

[DavidE]

Does the handle show you what Process (program) is using that file ?

 

[mediaccess]

It just says system...

 

[DavidE]

If it was me, I'd be concerned it could be Malware, or it could also be legitimate files for some program / updates.

What i would do:
Boot up in Safe Mode and see if the files are not locked and i could rename them.
They may be too big to delete and wouldn't be kept in the Recycle Bin.
http://www.sevenforums.com/tutorials/69585-safe-mode.html

If i can see them and rename them in Safe Mode, try a Clean Startup and see if there are any issues.
http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

I'd want to try and find out where the files came from.
In the end i would restore a Macrium System Image backup from before the problem started.

 

[mediaccess]

I managed to get rid of one og them. I had 30GB freed, but the files came back at the next startup.

They are actually building up on the boot. Their date of creation matches the time I start the PC...

 

[DavidE]

How did you get rid of one of them ?
Did you boot in safe Mode and delete it ?
If that's the case, does it get re-created if you reboot into Safe Mode, or Clean Startup ?

 

[mediaccess]

I was given a script with FRST64. It managed to delete one 32GB file, but it went back the rboot after.... I am still in the sand.

 

[Layback Bear]

Thank you David for coming to help.

Well something is putting those things back into your system.

A picture of Disk Management might be helpful.

A tutorial by Golden:

http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html

You could try unhooking all drives except the drive with Windows 7 on it.
Delete a file and reboot and see if it stays gone.

**Just to be sure did the thing come back when you did a clean startup??

 

[mediaccess]

Here it is, but I do not see anything special.

I'd rather not unmount my volumes though... I run a lot of drives, and all was working perfectly for more than one year...

Yes the files are remade on the startup. I don't know with what.

Since I succeeded erasing one file, I copied 30GB on c:/ of my own file.
So when the computer start, it maxes out c:/, but then I erase my 30GB file so I can work.
I need to copy it back before closing though...