Solved

Hard drive fills up with .flt files (Windows\Temp folder)

Posted on 2011-02-22
10
2,132 Views
Last Modified: 2012-05-11
I have an XP PC (Office 2010, a lot of other programs) that has a very strange problem. Lately, Windows\Temp gets filled with .flt files, ranging in size from a couple of KBs to to hundreds of MBs. EndPoint protection, Housecall, various anti-spyware programs don't show anything bad. Deleting the files doesn't do anything, they come back.
An interesting observation is that it seems that some of the smaller files are the group of bitmap images that keep repeating themselves multiple times. A user recognized them as part of either .pdf or .ppt file he got from outside.

Google search points to a Windows Search indexing. I will try to stop it but this is not a solution.
0
Comment
Question by:IT-NYC
  • 6
  • 3
10 Comments
 
LVL 4

Expert Comment

by:Xiurzeph
ID: 34956348
Do you have Flight Simulator or Adobe Illustrator CS5? If so, you may need ti create a scratch drive or partition to store excess data on.
0
 

Author Comment

by:IT-NYC
ID: 34956365
No, don't have those.
Dragon Naturally Speaking, if it can be a suspect.
0
 
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 34956406
What version of SEP do you have? Earlier version of SEP is know if have that bug which fills the Temp folder with temp files.

The latest version does not have that bug anymore, also you could try this by stopping the SEP services and see if you any new flt files in Temp folders

Sudeep
0
 

Author Comment

by:IT-NYC
ID: 34956450
11.0.6005 - fairly new
0
 
LVL 29

Expert Comment

by:Sudeep Sharma
ID: 34956479
You could use ProcMon (Process Monitor) from Microsoft which would tell you in real time which program or registry key is creating, access and modifying on your system. You could use the filters to get the results quickly.

Info:
http://technet.microsoft.com/en-us/sysinternals/bb896645

Download: (1.26MB)
http://download.sysinternals.com/Files/ProcessMonitor.zip

Sudeep
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 

Author Comment

by:IT-NYC
ID: 34956496
I tried it, need help with the filters. I guess I need to filter out the programs that create files and folders in the Windows/Temp folder?
0
 
LVL 29

Accepted Solution

by:
Sudeep Sharma earned 250 total points
ID: 34956545
May be this would help


tmp.JPG
0
 

Author Comment

by:IT-NYC
ID: 34961290
Thanks, trying right now.
0
 

Author Comment

by:IT-NYC
ID: 34966901
Monitoring. Will let you know the the results on Monday.
0
 

Author Comment

by:IT-NYC
ID: 35027948
My coworker is working on it. Here are his notes:
"I managed to open one of the smaller files in a notepad and it had the following text “MacOSx MooVTVOD”. After some research I tried to see which program was responsible for creating these files so I used process monitor and filtered to the directory and “create file”. The processes which seemed to be responsible was either “cidaemon.exe” or “dropbox.exe”. Cidaemon is part of windows indexing so I disabled it from start and turned it off on the C: drive.  However the files continue to generate. This leads me to believe dropbox.exe is creating the files. Also I found out that his linked computer is a mac and that the “MooVTVOD” is a Quicktime/iTunes file type. I have disabled Dropbox.exe.

“By changing the file type and creator of the AAC files encoded by iTunes 4 or downloaded from the iTunes Music Store from M4A/hook and M4P/hook respectively to MooV/TVOD or MPG4/TVOD, the songs can be played in OS 9. MPEG/TVOD files are recognized by QuickTime 6.0.3 and can be played in QuickTime or with a QuickTime based music player such as MPLAY. MooV/TVOD files can be played as above but are also recognized by iTunes 2.0.4.”
"
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
This video discusses moving either the default database or any database to a new volume.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now