# Huge number of .tmp files



## DKTaber (Oct 26, 2001)

For some reason, my computer is suddenly generating a huge number of .tmp files... daily. For example, I cleaned out all temp files last night, did a days work on the PC today, and checked the temp files again tonight... and there were 477!! They all start with "spa" than a number like "303". Anyone know where these are coming from? 

Running Win98SE. Last program installed was Nero Express (came with a new TDK 52/24/48 CDRW drive).


----------



## pvc9 (Jul 7, 2002)

Delete all of them.

Temp files are not only created when you install a program/software. They're also created when you run a program/software. After you close all the applications clear the Temp folder and that should be fine.

Just curious...what applications do you run frequently?


----------



## DKTaber (Oct 26, 2001)

> _Originally posted by pvc9:_
> *Delete all of them.
> 
> Temp files are not only created when you install a program/software. They're also created when you run a program/software. After you close all the applications clear the Temp folder and that should be fine.
> ...


I'm aware that temp files are created when you run software... which is why at the end of every day I've got 100's of them. I did as you said, deleted everything in the \Windows\Temp folder. It was a BUNCH (606)!

I also (suddenly) have problems when removing extremely large numbers of files; computer crashes hard (as it did when I deleted those 606 files, and again when I went to empty the Recycle Bin); have to power off from the power switch most times; 3-finger salute won't do it. Can't understand why; I have 384MB of RAM, so it can't be a memory problem. Have not had this problem until very recently, and I've had this PC since mid-'99.

The applications I run 99% of the time are all in MS Office 2000 Pro (Excel, Word, Access). Rarely have crashes with any of them.


----------



## gotrootdude (Feb 19, 2003)

When deleting large numbers of files, windows has to make room in the recycle bin for them. To do this, it gets rid of the oldest files in the recycle bin first to make room for the newest. This process is slow and CPU intensive and can sometime make windows seem to lockup, and or cause memory errors. 
When a large number of files is to be deleted, you can temporarily disable the recycle bin which will keep the lockups from happening. 
Just right click on the recycle bin, pick properties, global tab, and check the do not move files to recycle bin option. 

Just thought you'd like to know so you didn't think your computer was messed up somehow by it.


----------



## pvc9 (Jul 7, 2002)

Well...another option is you can delete the folders/files from DOS and that could be a better option. Using the deltree command would delete the entire Temp folder without any problem.


----------



## Deke40 (Jun 27, 2002)

DK-Do you run anything that has to do with mathematical algorithms? If you do, that is what the spa files are. I haven't been to school in over 45 years but that is something that sounds like it would take a lot of calculations of a repeitive nature.


----------



## WhitPhil (Oct 4, 2000)

Look at the creation times on the file properties and see if you can relate it to what you are running.

It could be Spyware/Virus/etc.

Download and run Startuplist and copy/paste the contents of the file it creates, back here for review.


----------



## flavallee (May 12, 2002)

DK:

Besides getting rid of temp files with a .TMP extension, also get rid of temp files in:

C:\TEMP\*.* (If this folder exists)

C:\WINDOWS\TEMP\*.*

Frank's Windows 95/98 Tips


----------



## DKTaber (Oct 26, 2001)

gotrootdude says, "When deleting large numbers of files, windows has to make room in the recycle bin for them."

dkt response: The Recycle Bin was empty before I deleted the 606 files in c:\windows\temp.

pvc9 says, "...another option is you can delete the folders/files from DOS and that could be a better option."

dkt response: Good idea keeps the deleted files from going to the RB.

Deke says, "Do you run anything that has to do with mathematical algorithms?"

dkt response: Not that I'm aware. These files are created during the day when I'm running mostly Excel 2000. Yes, there are a lot of formulae in the workbooks, but usually only normal stuff (sums, averages, percentiles, counts nothing that would use algorithims). Trouble is, the whole computer is nothing but a complex calculator; everything is some sort of mathematical calculation. Some of the temp files start with 'wbk', so I know those are generated by Excel. But there are only a few. Something is producing hordes of 'spa' files (e.g., spa20C2, spa20C3, spa20D2) and a few 'cpr' files (cpr20C5, cpr20D2). The similarity in the names suggests the same program is generating both.

WhitPhil says, "Look at the creation times on the file properties and see if you can relate it to what you are running. It could be Spyware/Virus/etc. Download and run Startuplist and copy/paste the contents of the file it creates, back here for review.

dkt response: I'll run Startuplist and post the file here. The cause is unlikely to be spyware or a virus. Norton AV is running in the background 100% of the time, and AV scans are run regularly by the Windows Scheduler. Nothing is ever found. Also have AdSubtract to keep ads off my screen, and it contains a program that looks for and deletes spyware. I run it every day, and it ALWAYS finds at least a couple (doubleclick, hitbox, etc.). Also (just to make sure) I run Lavasoft's Ad Aware, and it finds nothing (because I typically run it AFTER running AdSubtract's spyware finder). I run Norton System Works One Button Checkup 2-3 times a day to find and correct any errors in the Registry, invalid shortcuts, check program integrity, disk integrity, etc. My system is so squeaky clean you could see fly poop on it from 1000 yards!

Will get back to y'all shortly.

flavallee says, " Besides getting rid of temp files with a .TMP extension, also get rid of temp files in: 

C:\TEMP\*.* (If this folder exists) 

C:\WINDOWS\TEMP\*.*

dkt response: I did that yesterday; spa and cpr files continue to be generated.


----------



## DKTaber (Oct 26, 2001)

> _Originally posted by WhitPhil:_
> *Download and run Startuplist and copy/paste the contents of the file it creates, back here for review. *


WhitPhil: Per your request
StartupList report, 3/6/03, 8:04:52 AM
StartupList version: 1.52
Started from : C:\TEMP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\ADSUBTRACT\ADSUB.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
QD FastAndSafe = 
VortexTray = C:\WINDOWS\au30setp.exe 3

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
ccEvtMgr = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 1/3/2003, 10:9:2)

[rename]
nul=C:\WINDOWS\TEMP\~f1d055.tmp
nul=C:\WINDOWS\TEMP\~f1d055.tmp

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;"C:\ProgramFiles\PKWARE\PKZIPC\";%PATH%
LH C:\WINDOWS\AU30DOS.COM
SET BLASTER = A220 I2 D3 T4

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - c:\windows\downloaded program files\googletoolbar_en_1.1.66-deleon.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[CMV5 Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CPNMGR.DLL
CODEBASE = http://www102.coolsavings.com/download/cscmv5X.cab

[ActiveDataObj Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ACTIVEDATA.DLL
CODEBASE = https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[NSUpdateLiteCtrl Class]
InProcServer32 = C:\WINDOWS\SYSTEM\NSUPDATE.DLL
CODEBASE = http://204.177.92.201/quickdl/action/NSupd9x.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37638.3574421296

[symsupportutil]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = https://www-secure.symantec.com/techsupp/activedata/symsupportutil.CAB
OSD = C:\WINDOWS\Downloaded Program Files\OSD34.OSD

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 5,862 bytes
Report generated in 0.113 seconds


----------



## DKTaber (Oct 26, 2001)

BTW, I just noticed that the system is also generating a large number of .gif files with the same 'spa' naming. E.g., spa20C5.gif. AND it was 8:35 am when I checked for them, and the time stamp on those files was.... 8:34 am! I had done nothing but get on and off the Internet. I tried loading and playing one hand of Hearts, one game of FreeSpace, opened one of my favorites on the Internet, opened AdSubtract, ... and checked for more spa files after each. Nada.


----------



## DKTaber (Oct 26, 2001)

After opening and closing a number of programs, and after each, checking for spa* and cpr* files, I think I found the culprit. I opened Netscape Radio, and while it was playing, checked for the files, and 56 new spa and cpr files had been generated!! That's after JUST opening it. To confirm that it was NR that was generating the files, I tried to delete them, but the request was denied because the files were in use (NR was still playing).

The NR program is apparently poorly written and "messy"... i.e., it doesn't clean up after itself. I probably have only two choices: Manually clean up the spa and cpr files periodically, or stop using NR. Too bad; it has no ads and a huge selection of music. I'm loath to stop listening to it.

I'm virtually certain there's no way to force NR to clean up after itself, but if anyone knows one, I'd be interested.


----------



## WhitPhil (Oct 4, 2000)

You can put the following line in autoexec.bat to delete the files at boot time.
Or, create a BAT file for the desktop, that you can run to do the periodic cleanup.

You don't indicate what folder these files are in, but assuming they are either the root of c:\ or \Windows or \windows\temp, use a variation of the following statements.

*Del C:\Spa*.tmp
Del C:\Windows\Cra*.gif
Del C:\Windows\Cra*.tmp
Del C:\Windows\temp\Spa*.gif
*

** For the \Windows\temp line you can use
*Deltree C:\Windows\temp*

instead, which will delete ALL files and folders within the \Temp directory


----------



## DKTaber (Oct 26, 2001)

> _Originally posted by WhitPhil:_
> *** For the \Windows\temp line you can use
> Deltree C:\Windows\temp
> instead, which will delete ALL files and folders within the \Temp directory *


I did that, and it doesn't just delete the files and folders WITHIN \Temp, it also deletes \Temp. It appears to be replaced by another folder I hadn't noticed before... \WUTemp. Without a \Temp folder, will programs know where to put their .tmp files... or will they know to use WUTemp?

This is also not a complete solution. I leave my PC on 24/7; only reboot when something goes haywire, or I have to because a program requires it. I sometimes go a week before rebooting, and during that time, the temporary files from Netscape Radio will build up -- fast (one 5 minute session left 47 files behind).

However, I'll leave the command there for the time being. Except for the potential problems not having a \Temp folder (I have to see if it causes a problem), it can't do any harm.


----------



## WhitPhil (Oct 4, 2000)

Replace the line by

*Deltree C:\Windows\temp\*

(IE: add a trailing slash)

This will leave the folder itself intact.

And, the WUTemp you found is NOT replacing temp. From it's name, I would think it has something to do with Windows Update.

And, since you are 24/7, you could set up a scheduled task that runs this BAT file periodically, or in the middle of the night.

Also note, that since some installs dump files into the \Temp folder and then require you to do a reboot in order to complete the install (or uninstall), you want to ensure you complete the reboot before allowing the deltree to blow away the files.


----------



## DKTaber (Oct 26, 2001)

Yeah, I think I'll just take the Deltree command out of the autoexec.bat and have it run standalone.

Thanks to everybody for the help.


----------



## The_Egg (Sep 16, 2002)

Ooh, we're not finished yet . . .
Don't know if this is related, but you never know . . .

Enumerating Download Program Files:

NSUpdateLiteCtrl Class] 
InProcServer32 = C:\WINDOWS\SYSTEM\NSUPDATE.DLL 
CODEBASE = http://204.177.92.201/quickdl/action/NSupd9x.cab

This is the Money Tree / All-In-One Telcom parasite
http://doxdesk.com/parasite/MoneyTree.html

Also, I don't like the sound of this one either.
If you know what this is, and it should be there, then fine,
otherwise I'd remove this one as well.

[CMV5 Class] 
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CPNMGR.DLL 
CODEBASE = http://www102.coolsavings.com/download/cscmv5X.cab

Delete via:
IE Options -> Settings -> View Objects . . .

Maybe run Spybot Search & Destroy
just to make sure there's no more spyware components lurking.

Probably not related to yout TMP files problem, but still, it's better to be safe than sorry


----------



## DKTaber (Oct 26, 2001)

> _Originally posted by The_Egg:_
> *Ooh, we're not finished yet . . .
> Don't know if this is related, but you never know . . .
> 
> ...


I've deleted both. Don't have the foggiest what the Money Tree is all about... never heard of it. The second one is CoolSavings.com, where they almost daily send you coupons for $ off of a wide range of consumer products. They are extremely annoying... you get e-mails from them daily, you can't print the coupons unless you set your printer to full color, standard or high resolution, and they're mostly for shampoo and the like; not worth the time. I stopped them over a month ago, and have received nothing since, but the ActiveX control was obviously still on my system.

I have 2 software programs that are supposed to find things like this (AdSubtract and Ad-Aware), but neither mentioned these. I'll try Spybot and see what it finds.


----------

