AppData/Local/Temp getting filled up with many copies of same folder

I have a PC with a 250GB SSD on C: and a 1TB HD on D:

For some reason, there is a single folder full of .dll files that keeps being copied into C:\Users\[username]\AppData\Local\Temp. Each folder is a hexadecimal name like 6CD07CB3-1546-419F-BDE1-C603C89D104C. Each folder contains exactly the same files, 144 .dll files from api-ms-win-base-util-l1-1-0.dll to Wow64Provider.dll. Each folder is 8.48 MB. Approximately one of these new folders is created every minute on the SSD. Many GB of folders are created every day, and I have to use CCleaner every few days to delete everything. There are times that the copying of folders will suspend for hours at at time, but it always starts back up again.

I have scanned my hard drive numerous times and with many tools, including Windows Defender, Avast, MalwareBytes, and MalwareBytes Anti-Rootkit, and nothing has been found. I reinstalled Windows 10 completely in early March, and the problem did not go away. Extensive Googling for this problem has found nothing that resembles what I am seeing.

The only thing that I can think of that is even vaguely abnormal on my system is that I have a MouseJiggler and I use PrivateInternetAccess VPN. Otherwise everything is very straightforward.

Thanks in advance for your help.

slapdashuser said:

For some reason, there is a single folder full of .dll files that keeps being copied into C:\Users\[username]\AppData\Local\Temp. Each folder is a hexadecimal name like 6CD07CB3-1546-419F-BDE1-C603C89D104C. Each folder contains exactly the same files, 144 .dll files from api-ms-win-base-util-l1-1-0.dll to Wow64Provider.dll. Each folder is 8.48 MB. Approximately one of these new folders is created every minute on the SSD. Many GB of folders are created every day, and I have to use CCleaner every few days to delete everything. There are times that the copying of folders will suspend for hours at at time, but it always starts back up again.

I see the same thing on two of my Windows 10 x64 Pro machines, but not on others. Never considered this an issue, since this is the Temp folder anyway. I just delete everything in this folder from time to time.

Those are just folders created by generic API calls in programs that are running in the background.'

They're not malicious (typically) and are not unusual at all. They're just for storing temporary data, in this case, libraries for your apps.

That's what the temp folder is for, so it's working as intended.


Now, if you're worried about your SSD (you probably shouldn't be, modern SSD can withstand several terabytes of writes before they show any sign of degradation), you can do as I do, and move the temp directory to RAM. It makes the system faster and has no drawbacks provided you have enough memory to spare.

Plus, if you do it the way I do, only the memory currently being used by the data stored on temp is actually allocated. Further, the memory is released when no longer needed. Something uncommon for most RAM disk software.

Plus your temp directory is cleared when you reboot, so that's one less thing to think about when you do your system maintenance.

To move temp to a RAM disk, install this open source virtual filesystem driver. ImDisk
It's a very fast download and install. No ads, or spyware bundles that you find in other RAMDisks tools.
Plus it's so trustworthy and stable that ASUS distributes it rebranded under it's ROG namebrand, included in the box with their top shelf motherboards.

Now to make setting up temp directory, I'd advise to use this open source tool, as it handles all of the configuration for you.
ImDisk ToolKit

Default settings are fine to install with.

Open startmenu, and there should be a "recently added" entry for "RamDisk Configuration"

If not, just search the startmenu for Ramdisk Config, and open it.

I like to set the size to 1/4th of my system memory. So you might want to try the same.

I preferdrive letter to be "T" for temp, the choice is yours to make.

Check "Allocate Memory Dynamically" (important)

File system should be NTFS, not anything else.

Both boxes checked (important)

Then click "Set TEMP variables" and then click "Set All To:"

Hit ok, then close the dialog that pops up, and close the RamDisk Config utility.


Now for an extra bit of transparency, some (badly coded) programs ignore the TEMP variable and use %USERPROFILE%\AppData\Local\Temp anyway.

To fix that, we can use a symlink! But first you'll need to reboot to close any open handles preventing you from modifying the old temp dir.

Copy and paste this into a bat file so you don't have to take the time to open this thread to continue after a reboot, just run the bat file as admin and you're set!

Code:

@ECHO OFF
TITLE by Hydranix
rem This next bit checks if running as admin
NET SESSION
IF NOT %ERRORLEVEL% == 0 (
COLOR 0C
CLS
ECHO Script must be ran as admin!
PAUSE
EXIT
)
CLS
:MENU
ECHO.
ECHO The old temp directory still exists,
ECHO and likely still has old data in it.
ECHO.
ECHO The symlink will need to replace this
ECHO directory.
ECHO.
ECHO What do you want to do with the old temp?
ECHO ================
ECHO.
ECHO 1) Rename it to temp_old.
ECHO 2) Delete it and everything in it forever.
ECHO 3) Merge contents of old temp to new
ECHO.
ECHO 0) Exit, and do not create the symlink.
ECHO.
SET /P OPT=Enter option: 
IF "%OPT%"=="1" GOTO O_RENAME
IF "%OPT%"=="2" GOTO O_DELETE
IF "%OPT%"=="3" GOTO O_MERGE
IF "%OPT%"=="0" EXIT
CLS
ECHO.
ECHO Invalid option...
ECHO.
GOTO MENU:
:O_RENAME
PUSHD "%USERPROFILE%\AppData\Local"
RENAME "%USERPROFILE%\AppData\Local\temp" "temp_old"
GOTO O_SYMLINK
:O_DELETE
PUSHD "%USERPROFILE%\AppData\Local"
RD /S /Q "%USERPROFILE%\AppData\Local\temp"
GOTO O_SYMLINK
:O_MERGE
PUSHD "%USERPROFILE%\AppData\Local"
ROBOCOPY "%USERPROFILE%\AppData\Local\temp\*" "%TEMP%\" /E /MOVE /COPYALL
GOTO O_DELETE
:O_SYMLINK
MKLINK /D "%USERPROFILE%\AppData\Local\temp" "%TEMP%"
ECHO.
ECHO Done..
PAUSE
EXIT

Thank you so much for all your responses. I agree that using the RAM disk workaround is not an appropriate solution.

Kari, the 144 files that are in each of my Temp folders contain all of what you showed above and more.



It does seem like these are all normal files from Windows 10 install. I have been away from my computer for the last three days, leaving it on, and a new copy of all of these .dll files was created still, once every minute, give or take. (Sometimes two per minute, sometimes once every two minutes.) I just deleted over 32GB of temporary files just from the last three days.

I'm going to try the clean boot, and the booting into safe mode, and see what happens.

BTW, the date of the files is always the same: 10/30/2015 2:28 AM. But the date of the Temp folder itself is always the date that the folder was created.

Very interesting additional piece of information. This seems to only happen when the computer is locked, not in use. When it's unlocked, when I'm using it, the folders don't get copied. Why would that be?

Would love to find out if anyone has been able to resolved the issue. I'm experiencing basically the exact same issue as OP.

Left my work computer on over the weekend, came back to find ~24GB of these files. In my case there's also one of these folders created basically ever minute.

Super grateful if anyone's able to help!

*Bump* Same problem. Just took 10 hours to delete 240GB of this stuff from my computer.
Someone must have an idea or how to diagnose this.