Windows Legacy OS forum

General discussion

Huge TMP files in Windows\Temp

by prvk / June 29, 2007 5:12 AM PDT

I have large number of very big TMP files (averaging 300mb) that appear in Win\Temp, with no applications open. They can appear in a very short period of time (a couple of hours), and I have to boot into Safe Mode w/command prompt to delete them. In a short period of time, they can obliterate as much as 30 gb of disk space. Is there a way to determine what program or utility is writing these files? And... if found, is there a way to prevent them from being written?

I'm running XP Pro, version 2002, SP2.

I would really appreciate any help or suggestions at this point. Thanks for reading this plea for help. Happy


Discussion is locked
You are posting a reply to: Huge TMP files in Windows\Temp
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Huge TMP files in Windows\Temp
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Any names to these files?
by MarkFlax Forum moderator / June 29, 2007 5:40 AM PDT

My own C:\Windows\Temp folder has just a few entries that seem to be log entries, eg

MpCmdRun.log is a log for Windows Defender.
WGAErrLog.txt is a log of Windows Genuine Advantage, and
ZLT01a91.TMP where the a91 are random characters are logs of my ZoneAlarm firewall.

Do you have similar logs, and do you use ZoneAlarm and any virus/spyware scanners?


Collapse -
RE: Any names to these files?
by prvk / June 29, 2007 7:52 AM PDT

Hi Mark

<Do you have similar logs, and do you use ZoneAlarm and any virus/spyware scanners?>

I have a few log files and such, but when these big tmp files show up, they all start with PR, such as PR12A.tmp,PR21B.tmp, PR21C.tmp, etc..
I was gone 5 hours this morning, and 19GB worth appeared in the space of 20 minutes, all in the 270-290 mb range.

I am running the latest version of Kaspersky Internet Security Suite, which has a very good firewall, and also CounterSpy V2.

Thanks for your interest in this problem.


Collapse -
Hunting this down
by MarkFlax Forum moderator / June 29, 2007 9:26 PM PDT

Hi Peter.

Everything that's been suggested here is good, especially CCleaner. But CCleaner will only clean out these temp files every time you run CCleaner.

I think you have got to hunt down the process that is producing these. It seems FileMon doesn't work for your system without difficulties, so you will need to do this manually. It might mean hard work.

The way I would do this is a step by step process.

1] I would run my anti-virus and all my anti-spyware utilities in Safe Mode. If there's an infection it is more unlikely to load in Safe Mode. Then back in normal mode I would run to online scans at Housecall, (anti-virus), and Ewido, (anti-spyware). and (You need Internet Explorer for the Ewido scan).

Remove everything they find.

2] I would try and open one of these PR files, preferably the smallest, using Wordpad. Notepad may not do the trick because of the sizes of the files, but Wordpad is Notepad's big brother, and will open anything, Wordpad should be in your Start menu > All Programs > Accessories folder. If not, search for wordpad.exe.

See if any of these files give a clue which process/application/utility is producing these.

3] Review all your System Tray icons, (near the clock), open up each application and check to see if they are producing and saving logs. EG my ZoneAlarm firewall produces logs of intrusion attempts, etc.

4] Check every running process in the Task Manager. will help.

5] Open up the System Configuration utility, (Start > Run, type in msconfig, click OK), and check the Startup tab for anything that looks suspicious. Google will help.

6] The last option is a HiJackThis log, (HJT). But we will look into that if necessary.

Whatever is doing this is running in the background. That means it must be listed somewhere.

Good luck, and let us know how it goes.


Collapse -
Thanks Mark...
by prvk / June 30, 2007 3:27 AM PDT
In reply to: Hunting this down

I see that I have some work to do. I'll get back and post any results that I find. Thanks again Mark, for all your suggestions. Hopefully I won't have to go through ALL of them! <bg>


Collapse -
Re: PR21c.tmp
by Kees Bakker / June 30, 2007 12:11 AM PDT

That was found by google. Unluckily, one of the 2 hits was yours, and the other one was in Polish, but it's obviously exactly your issue. Have a look at

My knowledge of Polish is zero, but I get the impression it has to do with something called looksmart. If that's on your system indeed, better visit our Virus and Security Forum and tell the story there.

Hope this helps.


Collapse -
If you know zero Polish....
by prvk / June 30, 2007 3:21 AM PDT
In reply to: Re: PR21c.tmp

Then I know less than zero. <bg> I even clicked on the one link in that post, and got a "could not find". I emailed the author of FileMon, but haven't heard back from him yet. Surprisingly, over the last 12 hours or so, none of these files appeared. Only in the last few minutes have they arrived. I've taken a small screen cap. I wish I could attach it here somehow, but even if it were possible, it would probably be against the rules. :-/

Thanks again, Kees.


Collapse -
The link works with me.
by Kees Bakker / June 30, 2007 4:03 AM PDT

I'll paste some of the highlights:

C:\WINDOWS\Temp pliki PR3DF.tmp kt

Collapse -
by MarkFlax Forum moderator / June 30, 2007 5:32 AM PDT

You can't post images in these forums, but if you upload them to ImageShack or similar then post the url address for it, you can share the screen [rint here.


Collapse -
Win\Temp TMP file problems
by prvk / July 1, 2007 7:57 AM PDT
In reply to: ImageShack

Hi Mark, hi Kees, and everyone who has helped with this. Here are a link to some screen caps of these files, one of which is an excerpt of the content in a hex editor.

Note the date and version of my email program in the content. It is a very old date, and a much older version of Agent than I am using now.
I have no idea why these files are being genterated. Even after running full scans with Kaspersky, CounterSpy, Housecall and Ewido, I am still getting these files. Do you think a grenade might help? :-/


Collapse -
Hmm, couldn't see the image
by MarkFlax Forum moderator / July 1, 2007 8:01 PM PDT

I'm sorry prvk, but that link you gave only gave me's header, then a blank screen.


Collapse -
New URLs
by prvk / July 2, 2007 12:33 AM PDT

Hi Mark.

I copied the links they provided, which obviously didn't work. Putfile's site isn't exactly an easy one to navigate. Try these new links. There are two pics. One is a hex dump of part of one of the files. Hopefully they will work. These file appear somehow to contain my old emails. How strange. Agent has a user's list. I think I'll post there and see what the Agent gurus think. I'll keep you posted. Thanks again for all your interest in this. Happy


Collapse -
by MarkFlax Forum moderator / July 2, 2007 2:33 AM PDT
In reply to: New URLs

In the image in this link;
see the column on the right? It's an email.

Do you recognise anything there? EG, From, "Hi Bart, Good God 15 tons...."?

If not then there appear to be two possibilities.

1] Your email software is duplicating and saving outgoing and perhaps incoming emails into your temp folder.

2] Your computer is a zombie, sending out spam email.

I fear the 2nd may be true.

Tell us more about what you use to defend the computer from hackers, viruses and spyware.

I would, as soon as possible, get two online scans done, an anti-virus at Housecall,
and an anti-spyware at Ewido,
Let them remove everything they find.

Then update your own anti-virus and anti-spyware definitions, and in Safe Mode re-scan with them, one at a time. In Safe Mode viruses and spyware cannot normally get a hold. Delete everything they find.


Collapse -
Your suggestions, Mark
by prvk / July 2, 2007 3:35 AM PDT
In reply to: Interesting.

>Do you recognise anything there? EG, From, "Hi >Bart, Good God 15 tons...."?
Oh yes! I recognised it as mostly old email, although in one of the files, I saw more recent stuff.

>If not then there appear to be two possibilities.
>2] Your computer is a zombie, sending out spam email.
>I fear the 2nd may be true.
I too, fear this. I just need to find out how to fix the problem.

>Tell us more about what you use to defend the computer from hackers, >viruses and spyware.
I'm using Kaspersky Internet Security Suite 6.0. It dowloads new updates every three hours, and the latest database was at 6:30 this morning. I'm running CounterSpy V2, which updated yesterday.

>I would, as soon as possible, get two online scans done, an >anti-virus at Housecall,
>and an anti-spyware at Ewido,
>Let them remove everything they find.
I've done all this, per your previous suggestion. Not much of anything was found.

>Then update your own anti-virus and anti-spyware definitions, and in >Safe Mode re-scan with them, one at a time. In Safe Mode viruses and >spyware cannot normally get a hold. Delete everything they find.
Again, They are fully updated and functional, have been run in safe mode, and reported nothing.

My email proggy, Forte Agent, which I've been using since 1994, has been bullet-proof all these years, has a users' forum, and I've posted there asking for ideas and suggestions. Eventually, this will be solved, and I'll post accordingly.

Thanks again for all your help. Happy


Collapse -
That all sounds good then
by MarkFlax Forum moderator / July 2, 2007 4:58 AM PDT
In reply to: Your suggestions, Mark

OK, it looks like you've got the anti-malware pretty much tied down.

One other thing you could check. The files in that temp folder has dates created. Goto the Event Viewer, (Start > Run, type in eventvwr.msc and click OK), and check the entries for Application and System. If there are any exclamation marks or errors for the same times as the files are entered, highlight the entry, right click and select Properties.

If any application is defaulting and creating these files, maybe it is reporting an error in the viewer.

Tell me more about Forte Agent. I seem to remember it from the mid 90's, but not much comes to mind. Is this email software running when these files are created? Does the software run all the time?

If it is running when these files appear, that might be a pointer. Is there a setting somewhere in the program that might explain this? eg, backing up files, or similar. What happens if you close Forte Agent down, and only open it when you need to check your emails? Do more files appear at the same time?

I think we are getting close.


Collapse -
Forte Agent
by prvk / July 2, 2007 9:17 AM PDT

Hi Mark.

I'll follow your suggestion and report back. As regards Agent, the files appear with or without Agent being open. I have not received a reply from the Agent users' group yet. I have to go to town now, and probably won't get a chance to reply again until late tonoght or tomorrow. Thanks again, very much. Happy


Collapse -
Link only.
by Kees Bakker / June 29, 2007 6:07 AM PDT
Collapse -
Link to FileMon
by prvk / June 29, 2007 7:41 AM PDT
In reply to: Link only.

Thanks Kees. I've d/l'ed it and will report on it's use. Happy


Collapse -
File Mon
by prvk / June 29, 2007 8:40 AM PDT
In reply to: Link only.

Hi Kees.

File Monitor looks like it would give me some of the info I need, if only it would stop looking up the system. It seems to run for a few minutes, and then lock up solid. I can't even get Task Man to come up. I have to do a hard shut down and reboot. In FM's help file, there's a link to report bugs. I think I'll use it. Happy


Collapse -
Not a Cure...but Way to Control Symptoms.....
by tobeach / June 29, 2007 3:52 PM PDT

You can get CCleaner Slim or Basic (other builds) which cleans out many & varied unnecessary file build ups. These versions are 100% adware/spyware free.
One of it's options is defaulted to "only clean Windows Temp files older than...." You can uncheck this option and it will wipe Windows Temps each time you run it. Normally less than 5 seconds except FIRST run which can take awhile as often 100's of megs need initial cleaning. This "uncheck" is also used when an infection has located itself in Temp files as a base to operate from.
Not a cure but a good product to have & use daily & it's free!!

Additionally, add the download page below to your IE Favorites or Bookmarks list and use it to check for updates about once per month.
In "Options", click on "Settings" and uncheck:
"automatically check for updates" to prevent getting an undesirable (adware toolbar) version from built in updater link.
Link for CCleaner SLIM & Basic:

Help file (descriptions of items to be cleaned) to print out (click left side Cleaner Information):

This will at least be an immediate help and a good long term utility.
Note: CCleaner must be run on EACH DESKTOP (if more than 1 user) since you wouldn't want to accidentally erase info from another user.

Hope this is helpful. Happy

Collapse -
Thread length limit reached.
by MarkFlax Forum moderator / July 2, 2007 8:01 PM PDT

As the thread length limit ha been reached I am just posting here so further replies, if any can, continue from here.

Continuation from;
Forte Agent
Hi Mark.

I'll follow your suggestion and report back. As regards Agent, the files appear with or without Agent being open. I have not received a reply from the Agent users' group yet. I have to go to town now, and probably won't get a chance to reply again until late tonight or tomorrow. Thanks again, very much. Happy "

Collapse -
I've just read an article
by MarkFlax Forum moderator / July 3, 2007 4:55 AM PDT

In the ZDNet Tech Update Today newsletter;

(I'm not sure if you need to register for this newsletter, so I have copied the relevant part below).

It is about archiving emails in Outlook, and how Outlook archives emails onto the hard disk. Although Forte Agent is different to Outlook, I just wonder if there is a similar process. Here's the article;


When you ?archive? your Outlook email you probably suppose that your data is now safer than it was. After all, isn?t ?archiving? all about placing something important in a safe place?

Many of us run our business lives on email. So losing a few years worth of email is traumatic.

The sad truth is that archiving your Outlook email makes your data less safe. Here?s why and how to fix it.

Archiving is convenient - for other people
If your company has an Exchange server, and far too many do, your sysadmin may be after you to reduce the size of your mailbox by deleting or archiving old emails. Exchange doesn?t handle large mailboxes well. Many large mailboxes are even worse: recovery can take days.

When you archive email, Outlook deletes the email on the server, which makes your sysadmin happy. But where does it put it? Somewhere safe?

No. It puts your vital email on your hard drive. One crash and POOF! All your old email is gone. Forever. Hard drives crash, usually without warning. I?ve had two hard drives crash in just the last week.

How to check for at-risk archives
It is easy enough to check where your archives are stored. From within Outlook

* Go to File
* Select Archive . . .
* At the bottom of the dialog box it should say ?Archive file:? followed by a location. If that location is on your C: drive, your archives are at risk.

Don?t bogart that mail, my friend, pass it over to me
If your archives are on your local hard drive you should make copies. The easiest ways to copy them are onto a USB flash drive, a second hard drive, a network drive (if you have one) or burn them to a CD or DVD and take them home.

It is possible that your company network backup system is saving your archives. Backups often fail to save data, but check with your sysadmin anyway.

Is Microsoft to blame?
I think so. Microsoft, as usual, is tone deaf to the needs of end-users. How hard would be it be to suggest in the archiving process that people should copy their archives?

Compare Microsoft?s behavior to Apple?s new Time Machine, coming out in the next version of OS X this October. Time Machine explicitly requires that you set it up with a second hard drive.

The first time you attach an external drive to your Mac, Time Machine asks if you?d like to use that drive as your backup. Say yes and Time Machine takes care of everything else. Automatically. In the background. You?ll never have to worry about backing up again.

I guess Microsoft was too busy getting WGA to sort of work to worry about fixing problems that actually matter to customers.

Possibly the same is happening to your emails?


Collapse -
Reading the article...
by prvk / July 3, 2007 10:16 AM PDT

Hi Mark

>Possibly the same is happening to your emails?
I don't think so. First of all, Agent keeps its data in a subfolder within the working directory. They are simple DAT and IDX files which, when I wish to back them up, I just manually copy to another directory. From there, I may write them to a CD or DVD. Secondly, I'm not on a network, and lastly, Agent does not require Windows Registry to run. In fact, I'm running it from an external firewire harddrive. BTW, I just checked Win\Temp, and though there had been no reappearance of the TMP files in the last 24 hours, 10gb worth appeared while I was outside working. They appeared between 4:33pm and 5:09pm, just minutes ago. :-/


Collapse -
That's weird!
by MarkFlax Forum moderator / July 3, 2007 6:55 PM PDT
In reply to: Reading the article...

"They appeared just minutes ago". Very strange m8.

What was running in the Event Viewer then?


Collapse -
Another issue, Mark
by prvk / July 4, 2007 2:11 AM PDT
In reply to: That's weird!

Hi Mark.

Just so you know, I ran CCleaner, and I'm discovering now that I need to re-log into everything I click on. Besides that, which is not really all that big a deal, I have another issue now. Recently, I installed Roxio Easy CD & DVD Creator. What a mistake THAT was! Immmediately, my system slowed down a lot. When I went to remove it with "Add/Remove Programs", it was not listed. Nowhere on the system was there any kind of link for removal, so I removed everything I could manually, and man, did THAT stir up a hornets' nest. There were items that would not delete, and now, on re-boot, it wants to re-install itself, but can't, because the files needed are on the install CD. I've tried to work around this, but have failed. I think at this point, I'm just going to have to bite the bullet, and do a format and re-install of XP. I'm going to hang in with these issues a bit longer to see if I can fix this stuff without going through a re-install, but I don't have much confidence in being successful. :-/

I really appreciate all your time and effort in helping me with all this. If you have any other suggestions, I'd love to hear them.


Collapse -
Getting messy
by MarkFlax Forum moderator / July 4, 2007 4:54 AM PDT
In reply to: Another issue, Mark

This is all getting a bit messy now isn't it.

1] CCleaner.

In CCleaner you can see the list of cookies held on your system. I don't know if you know what cookies are, but they are little text files that help remember log-on details amongst other things. CCleaner will delete them all, but you can tell it to save any that you want. Under Options > Cookies, the ones you have are listed on the left. Move those you want to keep, (eg CNET, etc), to the right.

2] Add/Remove Programs. It looks like your Add/Remove Programs dialog isn't working.

Check if CCleaner has it listed in it's own Add/Remove programs. If not, look at this link;
Not your problem precisely but it may help.

3] Roxio.

It seems Roxio is trying to finish the install. What would happen if you let it, then tested it, and if you want to remove it either try the Control Panel's Add/Remove Programs or CCleaner's option.

If you don't want to try that, hunt down any Roxio entries in the registry for "Run, RunOnce, RunServices, RunServicesOnce". These control what programs attempt to load at startup. This article may help;

A re-install may be better in the long run if you are comfortable with that. Just a note though. If you do decide to reinstall, prepare a CD with firewall and an anti-virus installation files on it, so that when you have done the reinstall you can install those before you connect to the internet


Collapse -
Got rid of Roxio (I thnk) :-/
by prvk / July 4, 2007 7:20 AM PDT
In reply to: Getting messy

Hi Mark.

After getting tired of dealing with all the install attempts by Roxio, I thought... why not let it reinstall, and look a little harder for a proper way to uninstall it? Well, after viewing and ok'ing a few permission pop-ups, guess what *I* saw? Not only were there 'Install' and 'Repair' options, there was also 'Remove'. I think I, after a few reboots to complete the uninstall, may actually be Roxio-free. Happy


Collapse -
Ahh good.
by MarkFlax Forum moderator / July 4, 2007 7:25 PM PDT

That's one less worry then. Nice work


Collapse -
Another issue???
by prvk / July 6, 2007 1:31 AM PDT
In reply to: Ahh good.

Hi Mark.

Great! Now that things were starting to look up, my CD recorder now can't see my CD/DVD-RW drive. In Windows explorer, it shows up and I can use it normally, but my recording software can't. I d/l'ed a newer version, and it can't see it either. This is really becoming exasperating! :-/


Collapse -
One step forward, two step's back?
by MarkFlax Forum moderator / July 6, 2007 2:10 AM PDT
In reply to: Another issue???

Which burning software did you use, and which version?

If it is Roxio 6, have a look at this forum;
See if that helps. {Note, where Win-Pause is mentioned, that means press the Windows key and the Pause key together}.

If this was me, I would have uninstalled the CD Burning software, rebooted the computer, then installed the newer version. I'm not sure if that's how you did it.

If still no joy, try CDBurnerXP Pro from a free utility.


Collapse -
Recorc Now
by prvk / July 6, 2007 3:06 AM PDT

Hi Mark.
I'm using Record Now v6.5. When I installed it, it wanted to remove the older version, which I ok'ed. After installing, the system was rebooted, but still no recognition of my CD drive. I'll look into the links you provided, and if nothing else, I'll use the utility you pointed to. I'll keep y'all posted. Thanks again. Happy


Popular Forums
Computer Help 49,613 discussions
Computer Newbies 10,349 discussions
Laptops 19,436 discussions
Security 30,426 discussions
TVs & Home Theaters 20,308 discussions
Windows 10 360 discussions
Phones 15,802 discussions
Windows 7 7,351 discussions
Networking & Wireless 14,641 discussions

CNET Holiday Gift Guide

Looking for great gifts under $100?

Trendy tech gifts don't require a hefty price tag. Choose from these CNET-recommended useful and high-quality gadgets.