2

A couple of days ago I noticed I had a folder on my computer with more than 15 files in it. All the files were the exact same size (215 MB). They all had different names (just a bunch of random characters like Abe327(/-38s etc.

I wasn't sure what they were so I decided to try to delete them. But then I noticed they disappeared from the D drive. Then the next day I noticed a new folder, with similar names and file sizes showed up on my C drive.

The timestamps on the first set of files was almost all from a few months ago. Like the timestamps were saying 3:52 AM, 403 AM, etc. all from the same date.

Then the set of files on the C drive that just appeared had yesterday's date on them. But similarly, all the files had timestamps within a 24 hour period. Like they had all just been created.

Now this morning, all of those files are gone, and I didn't delete them. There are now no files like this in either drive.

Any idea what these files were? Why were they so large, and why are they switching drives? Why did they disappear completely now, after the initial files were there for a few months.


If you don't think it would be a dump file or any other leftovers, any clue as to what would create 200mb files on my comp? The folder had many different files, all the exact same size with different file names.

Just not sure what would create a 200mb file. Also, I would love to know some ideas as to why someone would use malware to create such large files on my computer. Don't mean to harp on this question, but I'd just love to get some idea as to what this could have actually been.

7
  • I should add that a week ago, all of my desktop icons suddenly disappeared. I have already used malware finders and nothing showed up. I also have gone in and ensure that I have the "Show Desktop Icons" checkmarked. I also did a hide and unhide on the desktop folder but that didn't do anything. Note: I can still see all the files in the actual desktop folder, just not on the desktop. Could this be related to the random large files I had on my computer?
    – John
    Nov 27, 2012 at 23:22
  • Try better malware programs. There seems an obvious malware problem. One that worked for me is Sophos. It is free and found 2 viruses that other programs missed. sophos.com/en-us
    – Xavierjazz
    Nov 27, 2012 at 23:29
  • Thanks for the tip. This software seems to require I run it on a separate harddrive. Is that really necessary?
    – John
    Nov 27, 2012 at 23:56
  • If you think Malware is your problem, try a Live CD. I've used HiRen for that and it is great. Download it, burn it on a CD and boot from it. It can also be run from a USB drive. hirensbootcd.org/download All the tools are free. There's also a Restored version with programs that are not free. Nov 28, 2012 at 0:16
  • ran it on the same harddrive. I did not see the specification you mention.
    – Xavierjazz
    Nov 28, 2012 at 0:44

2 Answers 2

1

You could try running Sysinternal's Process Monitor during the day, and analyzing the output to pinpoint what is creating and deleting those files.

You will have lots (and by that I mean, LOTS) of data to analyze, but don't be scared. Just play with the filters to get to the point where the files are being created/deleted.

DISCLAIMER: Never ran Processor Monitor for a whole day, but don't think it will be a problem.

3
  • Will this only catch it if it happens again or would this allow me to see the past processes?
    – John
    Nov 27, 2012 at 23:34
  • it won't allow you to search in the past, only anything that occurred after you started it and before you stop the capture.
    – mrTomahawk
    Nov 28, 2012 at 0:20
  • Make sure to tell ProcMon to save the data somewhere on the disk, since there's no way in heck you'll have enough memory for it.
    – user541686
    Nov 28, 2012 at 4:30
0

There's a couple options here:

  • Temp files that Windows created. Unlikely, but an option. Likely deleted after reboot.
  • Could be the DLL for OpenSSL malfunctioning. Those files would have been deleted after a reboot.
  • Leftover files after .NET Framework 3.5 Service Pack 1 installation. Those files would have been deleted after a reboot.
1
  • 1
    Windows' temp files are likely to be created in %TEMP%. Since the problem occurred more than once, don't think it would be any leftovers, especially over 300GB.
    – wtaniguchi
    Nov 28, 2012 at 2:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .