Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Over 60 GB of zip folders in AppData > Local > Temp


  • Please log in to reply
12 replies to this topic

#1 justnukeit

justnukeit

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:53 PM

Posted 15 August 2015 - 05:55 AM

OS: Windows Vista
Type: Desktop PC
 
Hello,
 
So I noticed the other day that my AppData > Local > Temp folder contained probably over 60 GB of crap. Almost all of this crap came in the form of .zip file copies, each one beginning with the preface: "Temp" followed by a number. For example: "Temp1, Temp2, Temp3" all the way up to "Temp 99". An example of such files: 
 
Temp1_SEUS v10.0 Lite.zip
Temp2_SEUS v10.0 Lite.zip
Temp3_SEUS v10.0 Lite.zip
 
I recognized these .zips as coming from a mod I downloaded for the game MineCraft a long time ago, however not all the files are from that game. The only commonality between all the duplicates are that they are all .zip files. It is as if my computer is making a backup copy of EVERY .zip folder on the computer, and storing them in the Local > Temp folder.
 
I deleted all these duplicates just yesterday, and then checked the folder again today. Surprise: 230 more .zip files were created between 9:59 pm and 11:00 pm. In total, 6.67 GB of .zip data was copied - for no apparent reason - to AppData > Local > Temp.
 
So.... what is going on here? Is this a virus? Is it some weird Windows backup feature? From what I understand, the Temp folder should automatically purge itself of most files once they are not in use. I haven't used ANY of those .zip files in months. It seems like each day they all just re-create themselves, adding even more copies to the already-ungodly amount of copies.
 
Note: I am very tempted to just perform a System Restore if this turns out to be complicated problem or virus, so if you think it is definitely a virus, just let me know and I'll nuke the whole darn thing. I just don't want to restore the computer if it turns out this is some silly problem which can be solved by simply unchecking a box.
 
Thank you in advance!


BC AdBot (Login to Remove)

 


#2 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 627 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 15 August 2015 - 10:33 AM

What tool are you using?(Winrar,Winzip..) These compression tools usually use temp folder for temporary location for extraction and other operations.

Do you think all these files are related somehow of the operations you have been doing like extracting? There could also be some background program which uses compression tools.


Member of the Bleeping Computer A.I.I. early response team!


#3 justnukeit

justnukeit
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:53 PM

Posted 15 August 2015 - 06:00 PM

Thread Starter here,

 

Thank you for reply!

 

Tool: I use 7-Zip. I have checked under the 'Folder' options for this program, and have noticed the box was ticked for "Working Folder = System temp folder". I have changed this to use a different temporary folder I've created on my desktop in order to see if it still sends 6 GB worth of crap there now instead. Still can't figure out why it would create copies of every .zip file on this computer since the beginning of time; there is no "Backup" option in 7-Zip's Options menu.

 

Operations: I have not been extracting, compressing, or utilizing any .zip function for probably at least the last month.

 

Background Programs: I don't think I have any compression programs on this machine other than 7-Zip.


Edited by justnukeit, 15 August 2015 - 06:21 PM.


#4 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 627 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 15 August 2015 - 07:48 PM

What naming pattern do they use? Could the minecraft be still running somehow or some launcher/updater?

 

You can run Malwarebytes just to be sure its not malware related:

http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/


Member of the Bleeping Computer A.I.I. early response team!


#5 justnukeit

justnukeit
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:53 PM

Posted 17 August 2015 - 07:10 PM

Thread Starter here

 

Sorry for late reply,

 

@Slurppa: I just used the Minecraft files as an example - there is no real pattern. There are .zip copies of different games, installers, programs, etc. For example, there is a .zip copy of an old game I have called Lords of Magic. There are also .zip copies of a program I installed which hides my taskbar. So I can't see any real pattern other than they are all .zip files.

 

There also seems to be no pattern with where they are being copied from either - some of them come from my Downloads folder, some from the Desktop, others originate in my Users folder, while others come from Program Files folder - no discernible pattern. It is very puzzling to me.

 

My gut tells me this is either an obnoxious virus, or there is an error with some program / the operating system. I can't think of many reasons why Vista would just suddenly decide to make backup copies on top of backup copies of ONLY .zip files.

 

I'm not sure if it is relevant, but I use Google Chrome browser, and have used Firefox in the past. I've read that browsers deal with .zip files (when downloading)... so perhaps there is a clue there?

 

So frustrating this problem is. Thank you for your assistance though!

 

P.S. I am giving the Malware Bytes a try. Will post results.

 

Update: Malware scan complete, 0 threats identified. I've also tried scanning with Microsoft Security Essentials - also caught nothing.


Edited by justnukeit, 17 August 2015 - 07:41 PM.


#6 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 627 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 19 August 2015 - 02:12 PM

It could be related to windows backup feature. You can try disabling it

https://support.microsoft.com/en-us/kb/927014 and see if that fixes it.


Member of the Bleeping Computer A.I.I. early response team!


#7 justnukeit

justnukeit
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:53 PM

Posted 23 August 2015 - 06:39 PM

Thread Starter here

 

Update: I noticed that when I changed the 7-Zip option: "Working Folder =System temp folder" to another folder, .zip files seemed to get "backed up" in the new folder I set. I can only assume this means that - in some way - 7-Zip is the problem. I have since uninstalled 7-Zip. Will just have to wait and see if that did the trick!

 

Thank you for your help!



#8 justnukeit

justnukeit
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:53 PM

Posted 29 August 2015 - 09:44 PM

Thread Starter here

 

Update: Nope... problem still persists. Was clean for a few days, now it has started making backup copies again. Wonderful.



#9 hbkmason

hbkmason

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:53 PM

Posted 31 August 2015 - 11:32 PM

That is a very puzzling scenario you gave going on there. I believe that if you are not able to solve the problem, make a backup of all your personal/important files and go to a restore point. If that doesn't work somehow, you could perform a factory reset on your computer. However, you should make these steps your very last if you simply cannot figure out any different way.



#10 HerschelC

HerschelC

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:53 PM

Posted 23 August 2016 - 04:06 PM

Hi - Did you ever determine the cause? I've had the same thing going on for about two months now.  Ever since I downloaded about 400GB of zip files for a project that I'm working on.  Something keeps filling my App Data / Local / Temp folder with these files of the form Temp1_<filename).zip folders that contain the contents of the zip files.  It fills my C drive and I have to go in and delete them all.  Then they will reappear within a couple of days. Extremely annoying.

 

I have Winzip installed and that directory is the temp directory.  What I don't know is what process is using winzip to unzip every zip file on my computer.

I've set indexing not to index contents of .zip files.

I've set Windows Defender to exclude the directory with the zip files and unselected "Scan archive files" in Settings->Advanced. 

Yesterday I disabled Defender, Google Drive, File history, backup, and Indexing.  And the files still appeared!

 

Resource Monitor indicates processes involved are Explorer and System.

 

thanks! 



#11 nzhome

nzhome

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:53 AM

Posted 24 February 2017 - 03:40 AM

wow i have the same problem.

 

I use winrar and 7zip

 

I have 20 GB!!! of this crap in here.

 

Temp1_FinishedWork.zip

Temp2_FinishedWork.zip

Temp3_FinishedWork.zip

 

I am deleting this crap.

 

Someone find a solution please!!!  this is not standard behavior allowed on a windows PC!!!!!!



#12 nzhome

nzhome

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:53 AM

Posted 24 February 2017 - 03:41 AM

40 minutes to SHIFT-delete this data.. 503,092 FILES.. geeez



#13 Guidance

Guidance

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:53 PM

Posted 06 April 2018 - 02:21 AM

Wow...Several years down the line and no solution it seems.

 

I am working on Windows 7 and have the same issue here. I have the feeling that this could come from a bad configured VM Remote Console (with me it started about the time our department needed to start using this). When I removed it, it seemed quiet for some time. However, we also started to use disk encryption with Kaspersky around that time...which we still do....The problem has recently reoccured (causing me to come to this page).






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users