Question Need help with strange temp folders appearing at random

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
A couple of weeks ago strange MSI***.tmp folders started appearing on root C and D drives. They appear at random at any time, some days 10 appear, some days 20... I can see them in the explorer but if click on them a message says the file is no longer available, so I just open explorer again and the y are gone.
 
Jul 14, 2021
35
3
45
6
A couple of weeks ago strange MSI***.tmp folders started appearing on root C and D drives. They appear at random at any time, some days 10 appear, some days 20... I can see them in the explorer but if click on them a message says the file is no longer available, so I just open explorer again and the y are gone.
The temp files are being used by your system to update things. You'd have to ask the manufacturer what they do. As for the files being unavailable, it's an annoying quirk I face all the time. For whatever reason, File Explorer is not refreshing itself quickly or frequently enough so that the directory reflects what's actually on the drive. So a file that has already been deleted will still appear in the directory. If you force a manual refresh, you'd see that the file is gone.

In other words, the temp files were probably already deleted. Do a manual refresh next time and see if they're actually still there.
 

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
The temp files are being used by your system to update things. You'd have to ask the manufacturer what they do. As for the files being unavailable, it's an annoying quirk I face all the time. For whatever reason, File Explorer is not refreshing itself quickly or frequently enough so that the directory reflects what's actually on the drive. So a file that has already been deleted will still appear in the directory. If you force a manual refresh, you'd see that the file is gone.

In other words, the temp files were probably already deleted. Do a manual refresh next time and see if they're actually still there.
Yes, like you said, it seems they autodelete themself and like I said in op they are gone when I reopen the explorer. The thing is... I dont think my system could be updating anything 10, 15 or 20 times a day, everyday for 2 weeks... Clearly something is wrong. Maybe the system is trying to update something and it keeps failing all the time? But my windows is updated to the last version, no failed updates are notified in the windows update section, no error message anywhere.
 

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
Last edited:

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
If it only runs when process explorer isn't active, it makes me think it doesn't want to be found, and has a way to stop the process when you run Process explorer and probably task manager. I have seen that before.

Makes me think its a virus of some sort.

See if this finds anything - https://www.hitmanpro.com/en-us
Yes it may be a virus, even left it process monitor 16hs running and nothing, as soon as I closed it they appeared. The program you recommended didnt find anything, I also used windows defender, kaspersky and malwarebytes and nothing found and the computer runs fine, no problems at all other than the folders. I have been looking for weeks on google for solution with no luck, it is driving me crazy. Appreciate you trying to help me all the same, if you think of anything else I will try it.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
56,788
4,520
160,690
10,277
run this, it looks at everything set to automatically run on PC. It might see something - https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns - can check files in here with Virus Total.

you could possibly run this and have it track the folder they appear in - https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

run process explorer with admin rights and click the options/virsus total header and run virustotal, it will check everything running as it might have another process running... i don't know how it can tell if a program is running and restart itself if its not... something must be watching?


Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

all it does is stops programs running with startup, doesn't remover anything. Easily reversed.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

strange temp files showing on anything other than C. What programs run of D?
 
Last edited:
Reactions: Mandark

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
I already tried your first 2 suggestion some time ago with no luck. Procmon (Process Monitor 3.98) is the program I mentioned earlier that I left running 16hs, that when I use it no folders are created. When I have some time I will try the clean reboot. I install everything on C drive and use D to store things, movies, anime, roms, music, etc. So I just watch movies or listen to music from D.

The weirdest thing is how totally random it is. For example yesterday I woke up, turn on the pc, went to the bath to wash my face and by the time I was back and without touching the pc at all and in those couple of minutes I already had one of those folders, but other days I do exactly the same thing and maybe hours pass until a folder is created. Some days I go out for hours, get back to the house and I have 5 folders created and some days when I get back no folders are there.
 

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
assuming it is download and installing something. try glasswire to see what is consume bandwidth.
I also thought it may be some kind of update or something so I tried in the past disconnecting internet to see if that stopped it but it didnt work, even without internet they keep appearing. So I dont dont think anything is being downloaded.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
56,788
4,520
160,690
10,277
So I just watch movies or listen to music from D.
what programs do you run to use these?
The temp files show on c & d so it makes me think app runs on c & creates files on d as well, for some reason.
I would perhaps watch a movie, and then see if they show, or listen to music and look.

Even though we can't find anything I would still consider a clean install and see if that fixes it.

I helped someone else with MSI files that would randomly appear but they were not temp files, it would use 25% of CPU while active. We can't even tell if these are running anything obscure.

I wonder if it would look for HWINFO. I just curious if its doing anything. if you left PC sitting idle with noting else running you could at least log sensors and see if CPU is doing anything when file was created - I assume it shows dates and times if you look at in explorer

Download HWINFO - https://www.hwinfo.com/download/

when you open the app, click the tick box next to show sensors only, and click run
in the next window , along bottom row are a number of buttons.
Click the icon next to the onee with a clock on it, that says "logging start" when you hover mouse over it
this will open file explorer and allow you to crates a log file so its easily found again
create a new log file each time you use PC until this happens.

this isn't really solving anything, just curious if it shows any CPU activity.

What PC have you got anyway? We normally asked that question by now :)
 

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
I use MPC-BE for movies and AIMP for music. I have been trying to link the creation of the folders with any sort of app I run with no luck, I even uninstalled most of the programs I use regularly to see if it stopped and nothing, as far as I can tell it is totally random. Like I described in my post a couple of days ago with me just starting the pc and not touching it and folders were already there. I only have 5 starup programs, tried disabling them all but the folders keep appearing.

Normal CPU usage (1-2% while iddle). Already downloaded the program you mentioned, has been running for a couple of hours now (no folders created as of now)

My pc specs, 2 HDD western digital, 1tb C and 2tb D, i7-12700K, motherboard Asus Prime z690, 32gb DDR4 3200mhz ram, Geforce Gtx1660ti 6GB and windows10 latest update. I upgraded my pc about a month ago, but the problem with the folders started like 3 or 4 months ago so I know it is not related.
 

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
Yes, mb, cpu and ram. I am planning to install windows 11, will do a clean install then.

Here you have the log. Left it running for 6hs and no folders. As soon as I closed the program a folder appeared on C. Not sure what you are looking for but here is the log.
https://www30.zippyshare.com/v/gVph0DsB/file.html


As you can see, the folder is visible on the left side but not on the right. Clicking on file properties doesnt give any info either.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
56,788
4,520
160,690
10,277
log won't show anything if the temp file showed up as soon as you closed it.
I wonder if every program you run creates a file.

this might be a weird side effect of swapping the parts. its possible on the old PC there was a process that caught this temp file. Generally if you swap CPU & MB it helps to reinstall windows. as you can get 3 results:
  1. it works fine
  2. it works but you get weird errors
  3. it doesn't work at all.
I find 2 is most common, although the side effects are often worse than just creating random temp files.
 

guidodi

Distinguished
Oct 26, 2014
36
0
18,530
0
Well it seems I will just have to give up on finding the cause, it will remain a mystery. Computer runs fine so it is not a big problem and when I finally install w11 it will be fixed (i hope....). Thanks a lot for the help anyway.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
56,788
4,520
160,690
10,277
it only runs when nothing is monitoring PC... So I don't know how you find it. i don't know how it starts up again after monitoring programs stop. it

I didn't expect it to not run with HWINFO running, all it does is track sensors. it can't identify anything else.

Not really giving up. Just not sure how to find it. I don't like mysteries and would love to find an answer.

you could ask on https://www.tenforums.com/ - they might have a way I haven't seen yet.
 
sounds like microsoft installer.
I would run cmd.exe as an admin then run the command
set
scroll down to the temp and tmp environment variables and confirm they are set to valid directories

in my case both are set to the hidden appdata directory
you can start control panel->system->edit environment variables
to see and edit the settings.

then I would guess I would have to run the icals.exe command to give permissions on each directory entry then remove them.
command would be something like this
start cmd.exe as an admin,
cd c:\
icacls *.tmp /grant everyone:F /t /q

then you should be able to delete them.


after that I would go to windows update and see if it is trying and failing to install something like a .net install. run updates and see if you get more of these temp directories created.
 
Last edited:

ASK THE COMMUNITY

TRENDING THREADS