Question Need help with strange temp folders appearing at random

[guidodi]

A couple of weeks ago strange MSI***.tmp folders started appearing on root C and D drives. They appear at random at any time, some days 10 appear, some days 20... I can see them in the explorer but if click on them a message says the file is no longer available, so I just open explorer again and the y are gone.

 

[rgd1101]

tmp mean temporary. do you have msi motherboard or anything from MSI?

 

[guidodi]

tmp mean temporary. do you have msi motherboard or anything from MSI?

Yes, I know they are temp forlder. Asus motherboard, msi is from microsoft installer temp folder, like when you update your windows.

 

[SamNYC]

A couple of weeks ago strange MSI***.tmp folders started appearing on root C and D drives. They appear at random at any time, some days 10 appear, some days 20... I can see them in the explorer but if click on them a message says the file is no longer available, so I just open explorer again and the y are gone.

The temp files are being used by your system to update things. You'd have to ask the manufacturer what they do. As for the files being unavailable, it's an annoying quirk I face all the time. For whatever reason, File Explorer is not refreshing itself quickly or frequently enough so that the directory reflects what's actually on the drive. So a file that has already been deleted will still appear in the directory. If you force a manual refresh, you'd see that the file is gone.

In other words, the temp files were probably already deleted. Do a manual refresh next time and see if they're actually still there.

 

[guidodi]

The temp files are being used by your system to update things. You'd have to ask the manufacturer what they do. As for the files being unavailable, it's an annoying quirk I face all the time. For whatever reason, File Explorer is not refreshing itself quickly or frequently enough so that the directory reflects what's actually on the drive. So a file that has already been deleted will still appear in the directory. If you force a manual refresh, you'd see that the file is gone.

In other words, the temp files were probably already deleted. Do a manual refresh next time and see if they're actually still there.

Yes, like you said, it seems they autodelete themself and like I said in op they are gone when I reopen the explorer. The thing is... I dont think my system could be updating anything 10, 15 or 20 times a day, everyday for 2 weeks... Clearly something is wrong. Maybe the system is trying to update something and it keeps failing all the time? But my windows is updated to the last version, no failed updates are notified in the windows update section, no error message anywhere.

 

[rgd1101]

malware scan the system
what app is running in the background?

 

[Deleted member 14196]

You’ve got some Msi installer running. Check for malware

 

[guidodi]

You’ve got some Msi installer running. Check for malware

Already scanned pc with Kaspersky Antivirus and Malware Bytes, nothing found. I Didnt install any new programs either.

 

[Colif]

Do you have Microsoft Office?

a few solutions on this page - https://answers.microsoft.com/en-us...e/43a4b864-3b9a-4a36-ba33-a6f7ddb90b26?page=2

 

[guidodi]

Do you have Microsoft Office?

a few solutions on this page - https://answers.microsoft.com/en-us...e/43a4b864-3b9a-4a36-ba33-a6f7ddb90b26?page=2

Dont have office. Already read that post but it doesnt really apply to my case. Like I said, folders autodelete and when I refresh or reopen explorer they are no longer there. I need some way to find out what is creating them so I can gei it to stop.

 

[Colif]

See some of the answers here to identify what made it - https://serverfault.com/questions/20668/how-to-find-out-what-created-a-file

 

[guidodi]

See some of the answers here to identify what made it - https://serverfault.com/questions/20668/how-to-find-out-what-created-a-file

Tried using Process Monitor, left it running several hours on several days, and while it was running temp folder would not appear. As soon as I close process monitor they appear again...



I have 3 right now and that is the message I get if I click on the folders, saying the were already deleted.

 

[Colif]

If it only runs when process explorer isn't active, it makes me think it doesn't want to be found, and has a way to stop the process when you run Process explorer and probably task manager. I have seen that before.

Makes me think its a virus of some sort.

See if this finds anything - https://www.hitmanpro.com/en-us

 

[guidodi]

If it only runs when process explorer isn't active, it makes me think it doesn't want to be found, and has a way to stop the process when you run Process explorer and probably task manager. I have seen that before.

Makes me think its a virus of some sort.

See if this finds anything - https://www.hitmanpro.com/en-us

Yes it may be a virus, even left it process monitor 16hs running and nothing, as soon as I closed it they appeared. The program you recommended didnt find anything, I also used windows defender, kaspersky and malwarebytes and nothing found and the computer runs fine, no problems at all other than the folders. I have been looking for weeks on google for solution with no luck, it is driving me crazy. Appreciate you trying to help me all the same, if you think of anything else I will try it.

 

[Colif]

run this, it looks at everything set to automatically run on PC. It might see something - https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns - can check files in here with Virus Total.

you could possibly run this and have it track the folder they appear in - https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

run process explorer with admin rights and click the options/virsus total header and run virustotal, it will check everything running as it might have another process running... i don't know how it can tell if a program is running and restart itself if its not... something must be watching?


Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

all it does is stops programs running with startup, doesn't remover anything. Easily reversed.

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

strange temp files showing on anything other than C. What programs run of D?

 

[guidodi]

I already tried your first 2 suggestion some time ago with no luck. Procmon (Process Monitor 3.98) is the program I mentioned earlier that I left running 16hs, that when I use it no folders are created. When I have some time I will try the clean reboot. I install everything on C drive and use D to store things, movies, anime, roms, music, etc. So I just watch movies or listen to music from D.

The weirdest thing is how totally random it is. For example yesterday I woke up, turn on the pc, went to the bath to wash my face and by the time I was back and without touching the pc at all and in those couple of minutes I already had one of those folders, but other days I do exactly the same thing and maybe hours pass until a folder is created. Some days I go out for hours, get back to the house and I have 5 folders created and some days when I get back no folders are there.

 

[rgd1101]

assuming it is download and installing something. try glasswire to see what is consume bandwidth.

 

[guidodi]

assuming it is download and installing something. try glasswire to see what is consume bandwidth.

I also thought it may be some kind of update or something so I tried in the past disconnecting internet to see if that stopped it but it didnt work, even without internet they keep appearing. So I dont dont think anything is being downloaded.

 

[Colif]

So I just watch movies or listen to music from D.

what programs do you run to use these?
The temp files show on c & d so it makes me think app runs on c & creates files on d as well, for some reason.
I would perhaps watch a movie, and then see if they show, or listen to music and look.

Even though we can't find anything I would still consider a clean install and see if that fixes it.

I helped someone else with MSI files that would randomly appear but they were not temp files, it would use 25% of CPU while active. We can't even tell if these are running anything obscure.

I wonder if it would look for HWINFO. I just curious if its doing anything. if you left PC sitting idle with noting else running you could at least log sensors and see if CPU is doing anything when file was created - I assume it shows dates and times if you look at in explorer

Download HWINFO - https://www.hwinfo.com/download/

when you open the app, click the tick box next to show sensors only, and click run
in the next window , along bottom row are a number of buttons.
Click the icon next to the onee with a clock on it, that says "logging start" when you hover mouse over it
this will open file explorer and allow you to crates a log file so its easily found again
create a new log file each time you use PC until this happens.

this isn't really solving anything, just curious if it shows any CPU activity.

What PC have you got anyway? We normally asked that question by now

 

[guidodi]

I use MPC-BE for movies and AIMP for music. I have been trying to link the creation of the folders with any sort of app I run with no luck, I even uninstalled most of the programs I use regularly to see if it stopped and nothing, as far as I can tell it is totally random. Like I described in my post a couple of days ago with me just starting the pc and not touching it and folders were already there. I only have 5 starup programs, tried disabling them all but the folders keep appearing.

Normal CPU usage (1-2% while iddle). Already downloaded the program you mentioned, has been running for a couple of hours now (no folders created as of now)

My pc specs, 2 HDD western digital, 1tb C and 2tb D, i7-12700K, motherboard Asus Prime z690, 32gb DDR4 3200mhz ram, Geforce Gtx1660ti 6GB and windows10 latest update. I upgraded my pc about a month ago, but the problem with the folders started like 3 or 4 months ago so I know it is not related.

 

[Colif]

What was upgraded a month ago?
If you swapped MB & CPU at time, I would suggest a clean install if you haven't done it since.

 

[guidodi]

Yes, mb, cpu and ram. I am planning to install windows 11, will do a clean install then.

Here you have the log. Left it running for 6hs and no folders. As soon as I closed the program a folder appeared on C. Not sure what you are looking for but here is the log.
https://www30.zippyshare.com/v/gVph0DsB/file.html


As you can see, the folder is visible on the left side but not on the right. Clicking on file properties doesnt give any info either.

 

[Colif]

log won't show anything if the temp file showed up as soon as you closed it.
I wonder if every program you run creates a file.

this might be a weird side effect of swapping the parts. its possible on the old PC there was a process that caught this temp file. Generally if you swap CPU & MB it helps to reinstall windows. as you can get 3 results:

1. it works fine
2. it works but you get weird errors
3. it doesn't work at all.

I find 2 is most common, although the side effects are often worse than just creating random temp files.

 

[guidodi]

Well it seems I will just have to give up on finding the cause, it will remain a mystery. Computer runs fine so it is not a big problem and when I finally install w11 it will be fixed (i hope....). Thanks a lot for the help anyway.

 

[Colif]

it only runs when nothing is monitoring PC... So I don't know how you find it. i don't know how it starts up again after monitoring programs stop. it

I didn't expect it to not run with HWINFO running, all it does is track sensors. it can't identify anything else.

Not really giving up. Just not sure how to find it. I don't like mysteries and would love to find an answer.

you could ask on https://www.tenforums.com/ - they might have a way I haven't seen yet.