Hard Light Productions Forums

Off-Topic Discussion => General Discussion => Topic started by: Trivial Psychic on November 03, 2016, 10:06:46 pm

Title: Cab Files. They May Be Chocking Your Computer
Post by: Trivial Psychic on November 03, 2016, 10:06:46 pm

So over the past few weeks, I've had Windows giving me warning messages that my C drive is running low on space.  So I'd clear some space and move on.  Unfortunately, on one incident, I cleared up more than 2GB, only to be down to only half a gig free within a few hours.  I suspected a Virus of some kind.  Oddly enough, when it got down to less than 100MB free, the virus would back off and return me to about 350MB free... until a couple of days ago, when it started getting and staying below 100MB free.  Then, last night I tracked the space back to about 2300 files in my Windows/Temp folder, that were called cab_XXXX_X, where the XXXX is a number between 3 and 5 digits.  Four out of every five files were 0KB in size, while the fifth was between 4.5 and 128MB in size.  In fact, 450 worth of them were 128MB.  Combined, they were locking down 59.5GB worth of space.  I did a search on Google which led me to an FAQ entry on Microsoft's website.  That site indicated that the files had something to do with Windows update, but it was creating these files continuously.  It did say however, that I could delete these files without any consequence, so I did.

While that cleared out significant space, my PC is continuing to create these files at 128MB a pop.  I'm assuming that they are being created by some kind of virus or Malware, and I was hoping that someone here might have encountered it before.   I am currently running Avast antivirus, but it detected nothing.  I can continue to delete these files on a daily basis, but I'd still like to know what the source is.

I have encountered space-gobbling software before.  Before my last hardware overhaul, I encountered a piece of software that was masquerading as a updater program for Norton Antivirus.  I had to track down where all of the space was going and manually remove the offending software.

Also, if anyone else is finding their free space being swallowed like that, look for those cab files.  They may be the culprit.

Thanks.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: The E on November 04, 2016, 03:26:31 am

You should check C:\Windows\Logs\CBS and delete everything there. This is part of a Windows process and not some malware (more detailed explanation here (https://felixyon.blogspot.de/2013/03/mysterious-cab-files-fill-up-temp-folder.html)).

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: Bobboau on November 04, 2016, 09:27:21 am

If it wasn't for the fact this encouraged people to buy a new computer after two to four years you would think MS would fix this.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: The E on November 04, 2016, 09:32:14 am

You'd think Microsoft would be able to have a more useful failure mode for one of their processes than spamming the temp folder.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: Bobboau on November 04, 2016, 09:46:37 am

depends on what metric you use to measure usefulness.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: The E on November 04, 2016, 09:48:40 am

Log entries? A cleanup function? Error popups? Something along those lines would definitely be better than just continually trying something that hasn't worked before.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: Bobboau on November 04, 2016, 09:54:47 am

well, like I said, after about 2 years of this windows starts to fall apart and most people don't even know you can re-install the OS, so they just trow out their PC and buy a new one with a brand new windows license. So by the metric of how much money it makes/costs Microsoft it's perfectly useful.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: Phantom Hoover on November 04, 2016, 03:07:04 pm

Quote from: The E on November 04, 2016, 09:32:14 am

You'd think Microsoft would be able to have a more useful failure mode for one of their processes than spamming the temp folder.

i definitely would not

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: jr2 on November 05, 2016, 01:32:33 am

You should be able to find the culprit using Sysinternals (now owned by Microsoft) - I think they have a suite with all of their more commonly useful tools, you'll need FileMon, ProcessMon, or ProcessExplorer (check all 3, probably FileMon would be easiest).

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: Trivial Psychic on November 05, 2016, 08:10:56 pm

Quote from: The E on November 04, 2016, 03:26:31 am

You should check C:\Windows\Logs\CBS and delete everything there. This is part of a Windows process and not some malware (more detailed explanation here (https://felixyon.blogspot.de/2013/03/mysterious-cab-files-fill-up-temp-folder.html)).

Knocking most of those CBS files seems to have done the job.  Its not making cabs anymore.  Thanks.

Title: Re: Cab Files. They May Be Chocking Your Computer
Post by: qwadtep on November 11, 2016, 10:46:54 pm

Quote from: Bobboau on November 04, 2016, 09:27:21 am

If it wasn't for the fact this encouraged people to buy a new computer after two to four years you would think MS would fix this.

MS doesn't care about anything that isn't a data-loss bug.