C:\Windows\Temp directory Filling up with 5KB dll files 1

[Bren2]

Hi,

I hope there is someone out there that can help with this query.
I have a server used for hosting a website.
The server operating system is Windows Server 2003.
The website uses IIS. The website is deveopled with Visual Studio 2005 (all aspx pages).

The problem I experienced was that the C: drive ran out of space.

After investigation I found that the directory C:\WINDOWS\Temp was full of dll files, each file is exactly 5KB in size. And there seems to be at least one file created every minute.

I checked the server at 2pm today.
- there were 1,193 files create for today so far.
- for example: 5 files were created at 2pm.

The name of the files are like: fka-m_83.dll, xlvdkvck.dll, aov2azax.dll.
- They always seem to have a name with 8 characters: 12345678.dll.

I ran a batch file to delete all of these files.
This worked & cleared up over 2GB of space.

Any idea how this happens.

It does not appear to be a virus. I ran a virus scan with the latest updates.

Any help greatly appreciated.

I opened one of the dll files in notepad.
Among the text, there were some english words, these are:


"This program cannot be run in DOS mode.
v2.0.50727
<Module> JScript 0 Script1347 System.Xml.Xsl.CompiledQuery
Microsoft.JScript mscorlib GlobalScope CompilerGlobalScopeAttribute"


Thanks,
Bren2

 

[itsp1965]

Don't know your website does, but this sounds somewhat suspicious in nature. Have you checked your IIS logs for any activity that is out of the ordinary? Also I would try running process monitor from Sysinternal so you can see what process is creating those random .dll files.

 

[Bren2]

Thanks for the quick response.
I used process monitor, & added the path to the temporary folder. To watch when a file first appears & what processes touch it.

The files are being accessed by: w3wp.exe, cidaemon.exe, ciscv.exe, cvtres.exe.

It looks like it is first created by w3wp.exe, then the rest of the processes access the file.

I am not sure what any of these processes do?
They seem to be windows processes.

 

[itsp1965]

W3WP.exe is responsible for the IIS application pool, I don't know what the other ones do so you may want to google them to find out their purpose.

 

[karlisi]

Scan your system for a viruses

http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=39437

===
Karlis
ECDL; MCSA

 

[dthede]

I've posted a related question on one of these Forums regarding removing some of the files in ....\WINDOWS\Temp\. The files you see are likely caused by the indexing service. I recently removed some 19,300+ files, and I have experienced the temporary folder filling to the point of exhausting all disk space and having the Small Business Server 2003 crash with 0 disk space remaining. (That became its own massive mess!)

For the sake of satisfying your own curiousity, you might try setting the Indexing ...service to "Disabled," and turning it OFF. Then go to the ...WINDOWS\Temp directory and remove the related files you've referred to in your posting. Restart. Indexing should not then be running if you have set it to "Disabled." Note the absense of more such files in ...\Temp after a few hours.

Next, set Indexing to "Manual" and then Start it. After a few hours if not much sooner, you should notice the temporary files reappearing. The contents may well be different. In my case as described elsewhere, (XP Pro SP2) I had Zero-G installer for some application repeated thousands of times -- once each in a pair of folders under ...\Temp. One pair of folders had zero bytes in it, the other had 13+ MB in it -- and many GB of disk space filled over several days with one new folder pair every minute. It took 15 minutes to just _select_ the tens of thousands of file folders found in \Temp.

In my case, I believe I was in the midst of an install while indexing hit the EXE installation file, and the installation probably didn't go to completion. For a few days the installation kept coming up to re-run upon login, and I kept cancelling its operation to get to work. There was then no documentation anywhere I could find, which described what was happening.

 

[Roadki11]

Any chance this is your problem? Even the file names are the same.

http://dev.ektron.com/forum.aspx?g=posts&t=12874

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[Bren2]

Well spotted... I should have posted back here after discovering the issue.

The issue is as provided by Roadki11 in the link above.

We are using the content management system Ektron.
A component of the functionality in this system (note: in an earlier version of the system) created a dll file in the c: drive.

The solution was to upgrade to the latest version of Ektron.

Thanks for taking the time to respond....