2

Last week I noticed my C drive had only ~19Gb of free space out of 500Gb, I found that there were hundreds (thousands actually) of MSIxxx.tmp files of 12119kb in size, taking ~290Gb...

I ended up deleting them and nothing wrong happened and C drive was back to normal free space. Today I checked to make sure these files were indeed gone, but I found that they're coming back... There are 11 of these files being created every 15 minutes I've searched around, but did not find anything similar to this...

ESET endpoint AV ver 9.0.2046.0 is installed in my PC and has not reported anything back, I have scanned using free version of Malwarebytes and did not find any issues, this is a screenShot of the 'installer' folder...

So, I'm not sure if this is some sort of bloatware going on or there is something really huge being downloaded for Windows update... any ideas?

Thanks

Edit:

  • The MSI*.tmp files do not appear while in Safe mode
  • Windows version is: Windows 10 Pro N
  • When the files are popping up in the 'installer' folder, there is a file that appears then disappears when all 11 files are created; I copied this file to another location before it disappeared, name is inprogressinstallinfo.ipi, per the contents of this file, it appears to be related to ESET Inspect connector program...

Edit2: Stopped the EraAgentSvc service (ESET Management Agent), and it stops producing these files... It may got corrupt somehow... Uninstalled and reinstalled it, it is not producing these files anymore... Case closed!

Cheers!!

3
  • 1
    What is your exact Windows version?
    – harrymc
    May 30, 2022 at 19:14
  • 1
    There is something on your system creating the files. If you boot to Safe Mode, do the files appear, do this after you clear the folder so you can be certain the files are returning or not, and update your question. A folder is used as a cache by anything using a windows installer executable.
    – Ramhound
    May 30, 2022 at 19:20
  • Now we know that Safe Mode does not create the files. You will need to use Autoruns to boot into a minimal configuration. Only start what is absolutely required for your system to boot.
    – Ramhound
    May 30, 2022 at 22:18

1 Answer 1

-1

You know that 10 is a "service" now and you don't own it?

It's probably downloading the upgrades to itself. The backdoors/telemetry are hard-coded into windows. (So wont appear as malicious to "antivirus" programs)

MSI was alway "microsoft installer" back in the day. Sounds like it's "torrenting" (downloading fractions of the total file) to assemble and then update.

5
  • Yes, it makes sense, I had thought this, but when I first noticed the presence of these files, they were +12K accounting for ~290Gb... not sure what update would take that amount of space... Right now there are 792 files taking up +9Gb, and continue to appear every 15 minutes... I still need to identify what is causing this, it does not affect PC's performance at all, but eventually it will fill out the hard drive.. May 31, 2022 at 15:55
  • I don't know how bloated a win10 install is. A clean, stripped install of 7 is a nudge under 19GB. I don't know what the istall media size is...historically they were limited to ~4GB to fit on a DVD but I suppose that restriction doesn't apply any more. It could be downloading every version of itself (home, pro, ultimate etc) to distribute out using your connection (which windows does...) But that still seems an inordinate amount.
    – mitts
    Jun 1, 2022 at 6:41
  • ...Personally I'd scrap the windows, but if you want to keep it then I'd search up "blocking microsoft telemetry"
    – mitts
    Jun 1, 2022 at 7:02
  • Dumping Win is not an option... I blocked MS telemetry using TaskScheduler and Registry methods, then did 'sfc /scannow' on cmd (running as admin), this reported that it did found corrupt files and had repaired them; then ran 'DISM /Online /Cleanup-Image /RestoreHealth' this did not report anything out of order... I then re-started and opened the win..\installer folder and by the next 15min mark, it continued to populate the 11 msi*.tmp files, but, of 12101kb instead of the 12119kb that were before... I'll let it run like that a few days and see if it is indeed an update being "torrented"... Jun 1, 2022 at 21:13
  • I'm guessing dism is an MS tool. It's unlikely they provide the mechanism to disable a system that is in their own interest... Task scheduler is probably next-to-useless. Registry sounds like it has half a chance of working. I've never done it myself, only read about it. I couldn't tolerate software that did that kind of crap. The fact that the files are still showing up, shows that the process is still running.
    – mitts
    Jun 2, 2022 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .