Question Need help with strange temp folders appearing at random

[johnbl]

sounds like microsoft installer.
I would run cmd.exe as an admin then run the command
set
scroll down to the temp and tmp environment variables and confirm they are set to valid directories

in my case both are set to the hidden appdata directory
you can start control panel->system->edit environment variables
to see and edit the settings.

then I would guess I would have to run the icals.exe command to give permissions on each directory entry then remove them.
command would be something like this
start cmd.exe as an admin,
cd c:\
icacls *.tmp /grant everyone:F /t /q

then you should be able to delete them.


after that I would go to windows update and see if it is trying and failing to install something like a .net install. run updates and see if you get more of these temp directories created.

 

[guidodi]

Lol, dont like mysteries either. I posted on tenforums, lets see if someone has any new ideas.

 

[guidodi]

sounds like microsoft installer.
I would run cmd.exe as an admin then run the command
set
scroll down to the temp and tmp environment variables and confirm they are set to valid directories

in my case both are set to the hidden appdata directory
you can start control panel->system->edit environment variables
to see and edit the settings.

then I would guess I would have to run the icals.exe command to give permissions on each directory entry then remove them.
command would be something like this
start cmd.exe as an admin,
cd c:\
icacls *.tmp /grant everyone:F /t /q

then you should be able to delete them.


after that I would go to windows update and see if it is trying and failing to install something like a .net install. run updates and see if you get more of these temp directories created.

You misunderstood. I have no problem with deleting them, on the contrary they autodelete themselves as soon as they are generated. By the time I notice them on the explorer they are not in my system anymore, just have to refresh explorer and they disappear.

What I need to do if find out what is creating them in the first place. If it is microsoft installer what is it trying to install 20 times a day or why dont I get some kind of message saying an update failed. I update regularly and everything is updated to date with no updates failed. I have also tried disconnecting internet and they keep appearing so it is not some update that it is being downloaded.

 

[Colif]

set command might at least tell you if the temp files are set to go to wrong directory/folder

i ran it on mine. Only folder that isn't default there is Onedrive.

 

[guidodi]

I had already checked that some time ago, I have it at hidden appdata directory too.

 

[Colif]

unless John has another way to find whatever is causing them, it might be an unsolved mystery.

I still feel there has to be a way to find out what makes them.
i wonder if this works or it just stops it happening like all other ways - https://community.spiceworks.com/topic/363079-using-event-viewer-to-track-changes-to-files

 

[johnbl]

when you find one file, can you run explorer, right mouse click for properties,
select security tab, advanced and see the owner name?
or does it just show system sid?

i assume the directory is created by msiexec
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec

maybe see if it is running at the time of the problem or block it from running

maybe something in task scheduler is running it

 

[johnbl]

when you find one file, can you run explorer, right mouse click for properties,
select security tab, advanced and see the owner name?
or does it just show system sid?

i assume the directory is created by msiexec
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec

maybe see if it is running at the time of the problem or block it from running

maybe something in task scheduler is running it

funny I just ran my task scheduler and looked at the tasks. only one app was running the installer it was scheduled to run at 2.32 pm every day and the app was dated in 2017. (intel update tool) when I attempted to run it directly it refused to run since it detected a newer version already installed.
I deleted the task.

process monitor from https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
you could run it for a while then filter on the files created on the drive and see what created them.

tried it, started the tool, start cmd
then made a directory foo
deleted the directory
and exited

the log in process monitor shows the creation , the process, its stack and shows the search indexer finding the directory and a lot of activity on the search protocol then the deletion of the directory.
stays on the screen until you clear it.
i would stop the search indexer in a effort to reduce the noise in the log. or do a better filter.

also look at the tools process viewer. it shows info on processes that started and ended during the log period.

 

[guidodi]

File properties, security, etc are all empty, no info is there. Also I already tried Process monitor and other similar apps that log things and whenever I ran those apps no folders are created, as soon as I close them, they appear again.

 

[Colif]

i wonder if it happens in safe mode

1. go to settings/update & security/recovery
   
2. under advanced startup, click restart now button
   
3. this restarts PC in a blue menu
   
4. choose troubleshoot
   
5. choose advanced
   
6. choose startup options
   
7. click the restart button
   
8. choose a safe mode with networking by using number associated with it.
   
9. Pc will restart and load safe mode
   

would maybe tell us if its windows.

 

[guidodi]

Just came to report that after months of trying to fix this, it finally stopped. Dont know why or how, because I didnt do anything or tried anything new... but it has been a few days with no folders created.

 

[Colif]

did you get any windows updates since as it could have been fixed by windows. it might have been a windows bug the entire time. check reliability history as it shows any files downloaded from the Store as well, its another spot you get updates from.

good that its fixed even if its a mystery.

 

[guidodi]

did you get any windows updates since as it could have been fixed by windows. it might have been a windows bug the entire time. check reliability history as it shows any files downloaded from the Store as well, its another spot you get updates from.

good that its fixed even if its a mystery.

No windows update and I have never downloaded anything from m. store as far as I remember. It just stopped all of a sudden.

 

[Colif]

Shrug... guess we wait and see if it comes back.