30GBs of Unkown Files in C:

I've had my Dell laptop for over two years, and the hard drive seemed to be filling up faster than it should. I've made some serious attempts to find the culprit but only today stumbled over the problem. There are more than 260,000 files loose on my C drive... which add up to 30 GBs. Yikes. I'm in the process of deleting them, but it's taking forever, a GB or two at a time. No wonder my laptop was bogging down and took fifteen minutes to shut down and boot up.

I've always been real good about keep the junk to a minimum in my previous computers and cannot figure out what these files are, and why they are piling up every day. Some are 10Mbs and some are 1kb. They seem to represent every day I ever used this laptop dating back to mid-2006. There are dozens for today already. They seem to go in order... today's look like this:

Just since 8:22 pm...
sfo.5i
sfo.5j
sfo.5k
sfo.5l
sfo.5m
sfo.5n
sfo.5o
sfo.5p
sfo.5q
sfo.5r
sfo.5s
sfo.5t
sfo.5u
sfo.5v
sfo.60
sfo.61
sfo.62
sfo.63
sfo.64
sfo.65
(and about fifty more)

What could be generating these files? I run Norton.

Thanks for any help.
Rusty

 

could it be restore files?

vista automatically creates restore points

but im purely guessing

 

diffidently a virus or worm

try these http://www.techspot.com/vb/topic58138.html

 

Aww, thanks for the suggestion - should have mentioned I am running XP on an Inspiron 6000.

You can imagine that my 88GB hard drive is happy to have some breathing space after all those deletes.

Rusty

 

More info - I ran the trend Micro scan (thanks!) and the latest Ad-Aware, and Norton has been running continuously since 2006 - and no virus/malware etc.

I opened up a couple of the files this morning in notepad, and they are text copies of emails - they appear to be every incoming email? They range from 4Mbs to 4k.

And they just pile up all day.

Where oh where are they coming from? My email (Outlook Express) saves them in the usual place in Docs and Settings as Inbox, too.

Thanks for your help with this puzzlement.

Rusty

 

That is weird.

I don't have outlook myself, but check if there is some archive option. Also, check to see where the temp folder is located. If it isn't something like, C:\windows\temp, then redirect it there so they can be detected and deleted via Cleanup or programs like Ccleaner.

 

There may be a virus, or it could be some permissions issue with Outlook Express creating the files but not being able to remove them for some reason.

Check your virus scanner... do you have a real-time email scanner of any sort running? It may be creating those copies for you, and not cleaning up properly. Norton is an unreliable piece of sh..., er, doody, and I tend to recommend against whenever possible Unless you're running the enterprise version, and then it can be tolerable.

You might get some results using FileMon to watch what application is opening which file.

 

Deathstick: My temp files appears to be in the correct place in Windows. Thanks for the suggestion.

Pitabred: I'm off to DL FilMon, and give it a shot. I just deleted 163 files from today... I still cannot believe that it's been piling up email messages since June 2006. It about brought my Dell to its knees - a Dell tech recently did some work on it, and couldn't understand why it loaded so slowly on bootup. Made it R-E-A-L slow to open directories in My Computer/Windows Explorer, too, as you can imagine.

Rusty

 

Try NOD32's online scanner.

http://www.eset.com/onlinescan/

PS Says to run with IE.

 

You said you've been running Norton since 2006? Is there any correlation between when you installed Norton and the first time these files started appearing? Really, check out the real-time email scanning that Norton may be doing. I'd bet you $20 right now that it's the AV scanner screwing up.

 

http://www.google.com/search?hl=en&q=sfo.5n&btnG=Search

Wow, looks you are literally *the only one* with these kinda files?!?!?!!!! Anyway, hope you get sorted it out soon.. and please keep us all posted as u r doing helps a lot for others to learn thank you.

 

Your mention of being the ONE is a strange coincidence, when I opened FilMon a couple minutes ago I instantly felt like NEO, "Uh, so that's the matrix?"

I did see this:
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\D3D9.DLL SUCCESS Length: 1689088
5:50:17 PM msimn.exe:5860 CLOSE C:\WINDOWS\system32\D3D9.DLL SUCCESS
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\DXGI.DLL NOT FOUND Attributes: Error
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\D3D8.DLL SUCCESS Attributes: CA
5:50:17 PM msimn.exe:5860 OPEN C:\WINDOWS\system32\D3D8.DLL SUCCESS Options: Open Access: 00100020
5:50:17 PM msimn.exe:5860 OPEN C:\WINDOWS\system32\ SUCCESS Options: Open Directory Access: 00100000
5:50:17 PM msimn.exe:5860 WRITE C: SUCCESS Offset: 98439168 Length: 4096
5:50:17 PM msimn.exe:5860 WRITE C: SUCCESS Offset: 98906112 Length: 4096
5:50:17 PM msimn.exe:5860 WRITE C: SUCCESS Offset: 99049472 Length: 4096
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\D3D8.DLL SUCCESS Length: 1179648
5:50:17 PM msimn.exe:5860 CLOSE C:\WINDOWS\system32\D3D8.DLL SUCCESS
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\DDRAW.DLL SUCCESS Attributes: A
5:50:17 PM msimn.exe:5860 OPEN C:\WINDOWS\system32\DDRAW.DLL SUCCESS Options: Open Access: 00100020
5:50:17 PM msimn.exe:5860 OPEN C:\WINDOWS\system32\ SUCCESS Options: Open Directory Access: 00100000
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\DDRAW.DLL SUCCESS Length: 266240
5:50:17 PM msimn.exe:5860 CLOSE C:\WINDOWS\system32\DDRAW.DLL SUCCESS
5:50:17 PM msimn.exe:5860 QUERY INFORMATION C:\WINDOWS\system32\OPENGL32.DLL SUCCESS Attributes: A



But what does it all mean, Trinity? lol

Rusty

 

http://www.file.net/process/msimn.exe.html

I dont really know about this, but probably you might want to take out outlook all together (if you have a office disk with you) and get it back in... and in between that, probably you want to rub your system clean with some good AV / ASW tools....

 

Hmm, found 3, one in Outlook, one in i386, and one is in a pile of junk called software distribution. Perhaps that is the culprit?

 

http://scanner.virus.org/

Try uploading those files to this scanning engine. Its upload limit is 5mb and uses a lot of different virus/malware scanners to check each uploaded file for infection.

As for Norton, try disabling it (e.g. removing it from startup) and install a different scanner (I use avast). See if it keeps making files. If it stops, uninstall Norton and keep the new one.