Windows 10: AppData/Local/Temp getting filled up with many copies of same folder

I have a PC with a 250GB SSD on C: and a 1TB HD on D:

For some reason, there is a single folder full of .dll files that keeps being copied into C:\Users\[username]\AppData\Local\Temp. Each folder is a hexadecimal name like 6CD07CB3-1546-419F-BDE1-C603C89D104C. Each folder contains exactly the same files, 144 .dll files from api-ms-win-base-util-l1-1-0.dll to Wow64Provider.dll. Each folder is 8.48 MB. Approximately one of these new folders is created every minute on the SSD. Many GB of folders are created every day, and I have to use CCleaner every few days to delete everything. There are times that the copying of folders will suspend for hours at at time, but it always starts back up again.

I have scanned my hard drive numerous times and with many tools, including Windows Defender, Avast, MalwareBytes, and MalwareBytes Anti-Rootkit, and nothing has been found. I reinstalled Windows 10 completely in early March, and the problem did not go away. Extensive Googling for this problem has found nothing that resembles what I am seeing.

The only thing that I can think of that is even vaguely abnormal on my system is that I have a MouseJiggler and I use PrivateInternetAccess VPN. Otherwise everything is very straightforward.

Thanks in advance for your help.

:)

 

Why so many copies of DismHost.exe running

Indeed. As well as filling up my hard disk with over 100,000 files in \Users\myname\appdata\local\temp.

 

C drive keeps filling up with temporary system files....since windows 10 creative update...

The folder that is filling up is c:\users\användaren\appdata\local\temp and from looking closer the file thats taking up all the space and keeps getting bigger is c:\users\användaren\appdata\local\temp\aria-debug-12768.log

 

Hi, I'd suggest trying to reach a point where this is NOT happening, and work back from there to diagnose the cause.

1. Check it doesn't happen in Safe Mode for reference
2. Try a clean boot
Clean Boot - Perform in Windows 10 to Troubleshoot Software Conflicts - Windows 10 Forums

Noted this is where those files are on mine:






If that reveals nothing, then
Sysinternals Procmon will allow you to trace all activity on your PC with extremely detailed filtering of the report.
Thus you may be able to identify what is copying or writing those files. May.

 

I see the same thing on two of my Windows 10 x64 Pro machines, but not on others. Never considered this an issue, since this is the Temp folder anyway. I just delete everything in this folder from time to time.

 

Those are just folders created by generic API calls in programs that are running in the background.'

They're not malicious (typically) and are not unusual at all. They're just for storing temporary data, in this case, libraries for your apps.

That's what the temp folder is for, so it's working as intended.


Now, if you're worried about your SSD (you probably shouldn't be, modern SSD can withstand several terabytes of writes before they show any sign of degradation), you can do as I do, and move the temp directory to RAM. It makes the system faster and has no drawbacks provided you have enough memory to spare.

Plus, if you do it the way I do, only the memory currently being used by the data stored on temp is actually allocated. Further, the memory is released when no longer needed. Something uncommon for most RAM disk software.

Plus your temp directory is cleared when you reboot, so that's one less thing to think about when you do your system maintenance.

To move temp to a RAM disk, install this open source virtual filesystem driver. ImDisk
It's a very fast download and install. No ads, or spyware bundles that you find in other RAMDisks tools.
Plus it's so trustworthy and stable that ASUS distributes it rebranded under it's ROG namebrand, included in the box with their top shelf motherboards.

Now to make setting up temp directory, I'd advise to use this open source tool, as it handles all of the configuration for you.
ImDisk ToolKit

Default settings are fine to install with.

Open startmenu, and there should be a "recently added" entry for "RamDisk Configuration"

If not, just search the startmenu for Ramdisk Config, and open it.

I like to set the size to 1/4th of my system memory. So you might want to try the same.

I preferdrive letter to be "T" for temp, the choice is yours to make.

Check "Allocate Memory Dynamically" (important)

File system should be NTFS, not anything else.

Both boxes checked (important)

Then click "Set TEMP variables" and then click "Set All To:"

Hit ok, then close the dialog that pops up, and close the RamDisk Config utility.


Now for an extra bit of transparency, some (badly coded) programs ignore the TEMP variable and use %USERPROFILE%\AppData\Local\Temp anyway.

To fix that, we can use a symlink! But first you'll need to reboot to close any open handles preventing you from modifying the old temp dir.

Copy and paste this into a bat file so you don't have to take the time to open this thread to continue after a reboot, just run the bat file as admin and you're set!

Code: @ECHO OFF TITLE by rem This next bit checks if running as admin NET SESSION IF NOT %ERRORLEVEL% == 0 ( COLOR 0C CLS ECHO Script must be ran as admin! PAUSE EXIT ) CLS :MENU ECHO. ECHO The old temp directory still exists, ECHO and likely still has old data in it. ECHO. ECHO The symlink will need to replace this ECHO directory. ECHO. ECHO What do you want to do with the old temp? ECHO ================ ECHO. ECHO 1) Rename it to temp_old. ECHO 2) Delete it and everything in it forever. ECHO 3) Merge contents of old temp to new ECHO. ECHO 0) Exit, and do not create the symlink. ECHO. SET /P OPT=Enter option: IF "%OPT%"=="1" GOTO O_RENAME IF "%OPT%"=="2" GOTO O_DELETE IF "%OPT%"=="3" GOTO O_MERGE IF "%OPT%"=="0" EXIT CLS ECHO. ECHO Invalid option... ECHO. GOTO MENU: :O_RENAME PUSHD "%USERPROFILE%\AppData\Local" RENAME "%USERPROFILE%\AppData\Local\temp" "temp_old" GOTO O_SYMLINK :O_DELETE PUSHD "%USERPROFILE%\AppData\Local" RD /S /Q "%USERPROFILE%\AppData\Local\temp" GOTO O_SYMLINK :O_MERGE PUSHD "%USERPROFILE%\AppData\Local" ROBOCOPY "%USERPROFILE%\AppData\Local\temp\*" "%TEMP%\" /E /MOVE /COPYALL GOTO O_DELETE :O_SYMLINK MKLINK /D "%USERPROFILE%\AppData\Local\temp" "%TEMP%" ECHO. ECHO Done.. PAUSE EXIT[/quote]

 

To start with, those dll files are normal Windows system files and will normally be found in Temp folder. However, in your case if they are created every minute and such a many GBs, the solution is not to move Temp to a RAM disk; instead you need to find out what is causing this.

Here some screenshots from my PC which I turned on about 70 minutes ago, just after 6 AM my time. In first 70 minutes of usage, only the highlighted temp files have been created:




In my case I have not emptied the Temp folder in over two weeks (since my last clean install), and have 120 of those DLL files in Temp, total size under 8 MB:




All those found in my Temp folder are from the day Windows 10 was installed:




I do not know what is causing your issue, the files being created every minute. However, I strongly recommend that you do not use the RAM disk workaround before we have found the culprit. Let's hope other geeks with more knowledge about the issue will jump in with ideas.

 

Thank you so much for all your responses. I agree that using the RAM disk workaround is not an appropriate solution.

Kari, the 144 files that are in each of my Temp folders contain all of what you showed above and more.





It does seem like these are all normal files from Windows 10 install. I have been away from my computer for the last three days, leaving it on, and a new copy of all of these .dll files was created still, once every minute, give or take. (Sometimes two per minute, sometimes once every two minutes.) I just deleted over 32GB of temporary files just from the last three days.

I'm going to try the clean boot, and the booting into safe mode, and see what happens.

 

BTW, the date of the files is always the same: 10/30/2015 2:28 AM. But the date of the Temp folder itself is always the date that the folder was created.

 

Very interesting additional piece of information. This seems to only happen when the computer is locked, not in use. When it's unlocked, when I'm using it, the folders don't get copied. Why would that be?

 

Would love to find out if anyone has been able to resolved the issue. I'm experiencing basically the exact same issue as OP.

Left my work computer on over the weekend, came back to find ~24GB of these files. In my case there's also one of these folders created basically ever minute.

Super grateful if anyone's able to help!

 

*Bump* Same problem. Just took 10 hours to delete 240GB of this stuff from my computer.
Someone must have an idea or how to diagnose this.

 

I daily clean out temp files, both with CCleaner and manually. At random times my Win10 Home system randomly inserts insane megabytes of Win10 dll's into the folder [C:\Users\<me>\AppData\Local\Temp], and fails to clear them on reboot.

There is no plausible way that this kind of insane replication of executable code serves any useful purpose, especially given its randomness. So, it's either a very dumb Microsoft caching strategy gone bad, or some kind of outright error, or malware. I'm trying to figure out the pattern for it.

Does anyone out there already know the specific process that is going insane?

 

You need to find out either by specific analysis (e.g. sysinternals procmon (free) - a more technically demanding route- and identify from its captured log what specifically is creating those files, or by elimination (see my previous post).

Don't necessarily expect someone to say 'it's this, and this is what you have to do to stop it' - you'll need to do some analysis.

So there are two possible routes:
a. analytical using procmon.
b. by elimination, in the hope of reaching a situation where it doesn't happen and working back.

 

It is a permissions problem on a cleanup task usually from the windows 10 upgrade. Here is how to stop it.


Run Task scheduler

expand "Task Scheduler Library", then Microsoft, then Windows, then find and click on "Disk Cleanup". Look for "Silent Cleanup Task" on the top pane, you will see that it has failed in the "Last Run" comments. Disable the task and your problem will go away