100s of 1000s of Temp Files in Win 10 Pro

[Dataproof]

A Client's HP Laptop is creating an incredible amount of temporary files in Windows>Tmp Folder.

We've just deleted about 350,000 of them totalling about 100GB.

The Folder it created is called tmp0000009f and within that are these files:

tmp00000a00 285KB.

1000s of them

How do I stop this?

What would cause this?

We tried scanning for a nasty using BitDefender which was already installed, but the temporary files outpaced BitDefender's ability to scan, it kept scanning the temporary files, and as loads more were added, increasing the time taken to scan

 

[GTP]

Don't scan it while Windows is running. BitDefender has probably been compromised and is not able to work properly.
Boot with a PE (like Gandalf's) and run Emsisoft Emergency Kit from a USB drive.
Alternatively download Kaspersky Rescue and boot it. Or create a Bitefender Rescue USB with Stickifier.
Run a FULL scan with that.

There are numerous offline scanners available.

 

[fencepost]

You might be able to use the Windows Resource Monitor's Disk tab to see what process is doing a ton of IO or even see which process is touching those files or that directory. If nothing is happening while Resource Monitor is running but it starts when it's closed that's an excellent indicator of something malicious.

 

[Diggs]

Have you checked for any database applications run amok on the laptop?

 

[nerd2u]

I've seen antivirus software do this before.

Should be able to drill down through the processes and resource monitor to determine the cause.

Sent from my SM-G870W using Tapatalk

 

[AlexCa]

Or you can try to start Windows in safe-mode. @fencepost idea may allow you to identify the process, so that you can search about it online and know more precisely what's about.

 

[ComputerRepairTech]

...guys, if you don't have https://docs.microsoft.com/en-us/sysinternals/downloads/procmon in your toolkit you need to stop what you are doing and add it.

 

[Markverhyden]

You've mentioned nothing about the time line. How many times have you looked at this machine? How old is it? Windoze is a huge disk hog and will gladly gobble up all space in sight for own use. As has been mentioned have you looked at what apps are there? Processes? Etc.

 

[Dataproof]

Thanks everyone, this where I got to last night:

I'll try some of the replies you've all very kindly made later today.

Last Night's Testing:

Kaspersky Rescue Disk https://support.kaspersky.com/viruses/krd18/common

Showed NO Infections.

and EEmsisoft Emergency Kit https://www.emsisoft.com/en/software/eek/

Showed the temporary files as Infections, but got overwhelmed by the increasing number of tmp files.

I then ran MalwareBytes Trial and it found loads of PUAs but no infections.

We do have Macrium Backup images, so I started exploring those.

17 Oct, same problem 1000s of tmp files.

11 May, 5 folders like tmp00000dd, but only 1 tmp file inside = tmp0000000.

30 April and earlier, only 1 tmp folder = tmp0000003d, but only 1 tmp file inside = tmp0000000.

So I have no idea what's causing this, except perhaps something related to this:

https://answers.microsoft.com/en-us...l/33e5b67d-02c3-4558-bf29-852aa359014f?auth=1

Go to page 3 of that thread:

"Within minutes of asking for help on this forum I accidentally solved my Windows 10 rapid TEMP file creation problem. Here's what happened; while I don't know how or why my 250GB SSD drive was filing up with temp files I had previously Googled for help and found a CNET solution that said to click on Start, type services.msc, scroll to Windows Modules Installer service, dbl. click on that and stop the service. Well the service was already stopped on my system so I left it alone. Then I rebooted but the temp files just kept propagating.

For some reason something told me to go back to services.msc and start the Win Modules Installer service as it was set on Manual. So I did that and the rapid temp file creation stopped immediately without even having to reboot. Now there's 90GB free on the SSD and so and far everything else is working normally. Hope this works for and helps someone else."

 

[Porthos]

I then ran MalwareBytes Trial and it found loads of PUAs but no infections.

Need to go in to settings and turn on scan for rootkits and rescan.

 

[Markverhyden]

I still think it's an undocumented M$ feature. Try running Tweaking's AIO

 

[Galdorf]

Sound like a rootkit you might want to scan with bitdefender rescue cd

 

[Dataproof]

I still think it's an undocumented M$ feature. Try running Tweaking's AIO

I tried that on my own test dell latitude and it didn't go well, Office 2016 has stopped working, and the ethernet adapter no longer works

 

[Dataproof]

Sound like a rootkit you might want to scan with bitdefender rescue cd

I might try that, but after that I think I may just go back to a previous backup or nuke the machine.

 

[Dataproof]

I also posted this problem on Whirlpool Forums, see below:

https://forums.whirlpool.net.au/forum-replies.cfm?t=2763359&p=2#r26

Some interesting screenshots there from Process Monitor.

 

[ComputerRepairTech]

...guys, if you don't have https://docs.microsoft.com/en-us/sysinternals/downloads/procmon in your toolkit you need to stop what you are doing and add it.

I also posted this problem on Whirlpool Forums, see below:

https://forums.whirlpool.net.au/forum-replies.cfm?t=2763359&p=2#r26

Some interesting screenshots there from Process Monitor.

and this is why everyone should have process monitor in their toolkit

 

[ComputerRepairTech]

after reading more looks like you might be having some more issues? dont worry about filtering it that much just unclick the things on the little toolbar and leave the file cabinet enabled and see if you see anything else, exclude the stuff you know is definitely not relevant.