Tmp files/folders in C:\Windows\Temp

I was recently looking in C:\Windows\Temp and found many (hundreds) of folders in this directory. These folders each contains a file called "tmp00000000", these files are zero length.

The folders in Windows\Temp are all in the form "tmp00000xxx" or "tmp0000xxxx", where xxx/xxxx appears to be a hexadecimal number, eg. "tmp00000a78". I can see no pattern indicating when they are created other than some seem to be created shortly after a boot but others are not related to a boot.

I have Bullguard installed and get no viruses reported.

Any ideas of what is causing this or how to track down the cause?

Thanks

If they are zero size you can delete them.

https://social.technet.microsoft.com...w7itprogeneral

Yup, I know I can delete them but they keep returning. I need to stop them being created.
Thanks for the response.

There is no way to stop creation of these temporary files they are created by different Windows operations, like installing Updates.

If you say so but I have four other windows computers here and none of them do this. I cleared out the C:\Windows\Temp folder on the machine in question about 2 hours ago and 134 of these tmp folders have been created in that time period!

CMUSER said:

I was recently looking in C:\Windows\Temp and found many (hundreds) of folders in this directory. These folders each contains a file called "tmp00000000", these files are zero length.

The folders in Windows\Temp are all in the form "tmp00000xxx" or "tmp0000xxxx", where xxx/xxxx appears to be a hexadecimal number, eg. "tmp00000a78". I can see no pattern indicating when they are created other than some seem to be created shortly after a boot but others are not related to a boot.

I have Bullguard installed and get no viruses reported.

Any ideas of what is causing this or how to track down the cause?

Thanks

It is necessary to check which programs are running in background or non-Windows services.

CMUSER said:

Any ideas of what is causing this or how to track down the cause?

I know you are using Bullguard but this sounds very similar to an issue with Bitdefender.

Perhaps try running TechNet/Sysinternals' free, portable Process Monitor (ProcMon) running in the background after setting a new filter to look for files being created in C:\Windows\Temp?

1. Download/unzip ProcMon.

2. Create a shortcut to the ProcMon executable and change the shortcut's Properties so a) it starts with a -NoConnect switch and b) it 'Runs as administrator'. (The former stops ProcMon automatically capturing events the moment you run it.)



3. Start ProcMon using the shortcut, accept the UAC prompt then the EULA (the EULA only appears once).

4. Press CTRL+L to bring up the filter dialog and change it as shown below (a) then click on the Add button (b) then on the OK button (c) to close the filter window:




5. De-select each of the Activities icons except for Show File System Activity:





6. Press CTRL+E to start ProcMon's 'capture' process then minimize ProcMon and wait. As temporary files are created in C:\Windows\Temp so the originating process name will be recorded by ProcMon.

Hope this helps...

Thanks RickC. I will give this a try.

Had a look at this with ProcMon and other tools and it appears (not certain, I am primarily a Linux user who rarely delves into Windows) that Bullguard may be involved. Also Bullguard does not like the Brave browser update process, it logs it as a virus. I have opened a ticket with Bullguard for both issues and await their response.

Hmmm, seems that this is all Bullguard related and I get around it by disabling the Brave browser auto update facility/service. Long term I will just stop using Bullguard when the subscription expires and fall back to Windows Defender which seems to to do a OK job on the other 4 PC's.