[Trivial Psychic]

So over the past few weeks, I've had Windows giving me warning messages that my C drive is running low on space.  So I'd clear some space and move on.  Unfortunately, on one incident, I cleared up more than 2GB, only to be down to only half a gig free within a few hours.  I suspected a Virus of some kind.  Oddly enough, when it got down to less than 100MB free, the virus would back off and return me to about 350MB free... until a couple of days ago, when it started getting and staying below 100MB free.  Then, last night I tracked the space back to about 2300 files in my Windows/Temp folder, that were called cab_XXXX_X, where the XXXX is a number between 3 and 5 digits.  Four out of every five files were 0KB in size, while the fifth was between 4.5 and 128MB in size.  In fact, 450 worth of them were 128MB.  Combined, they were locking down 59.5GB worth of space.  I did a search on Google which led me to an FAQ entry on Microsoft's website.  That site indicated that the files had something to do with Windows update, but it was creating these files continuously.  It did say however, that I could delete these files without any consequence, so I did.

While that cleared out significant space, my PC is continuing to create these files at 128MB a pop.  I'm assuming that they are being created by some kind of virus or Malware, and I was hoping that someone here might have encountered it before.   I am currently running Avast antivirus, but it detected nothing.  I can continue to delete these files on a daily basis, but I'd still like to know what the source is.

I have encountered space-gobbling software before.  Before my last hardware overhaul, I encountered a piece of software that was masquerading as a updater program for Norton Antivirus.  I had to track down where all of the space was going and manually remove the offending software.

Also, if anyone else is finding their free space being swallowed like that, look for those cab files.  They may be the culprit.

Thanks.

[The E]

You should check C:\Windows\Logs\CBS and delete everything there. This is part of a Windows process and not some malware (more detailed explanation here).

[Bobboau]

If it wasn't for the fact this encouraged people to buy a new computer after two to four years you would think MS would fix this.

[The E]

You'd think Microsoft would be able to have a more useful failure mode for one of their processes than spamming the temp folder.

[Bobboau]

depends on what metric you use to measure usefulness.

[The E]

Log entries? A cleanup function? Error popups? Something along those lines would definitely be better than just continually trying something that hasn't worked before.

[Bobboau]

well, like I said, after about 2 years of this windows starts to fall apart and most people don't even know you can re-install the OS, so they just trow out their PC and buy a new one with a brand new windows license. So by the metric of how much money it makes/costs Microsoft it's perfectly useful.

[Phantom Hoover]

You'd think Microsoft would be able to have a more useful failure mode for one of their processes than spamming the temp folder.

i definitely would not

[jr2]

You should be able to find the culprit using Sysinternals (now owned by Microsoft) - I think they have a suite with all of their more commonly useful tools, you'll need FileMon, ProcessMon, or ProcessExplorer (check all 3, probably FileMon would be easiest).

[Trivial Psychic]

You should check C:\Windows\Logs\CBS and delete everything there. This is part of a Windows process and not some malware (more detailed explanation here).

Knocking most of those CBS files seems to have done the job.  Its not making cabs anymore.  Thanks.

[qwadtep]

If it wasn't for the fact this encouraged people to buy a new computer after two to four years you would think MS would fix this.

MS doesn't care about anything that isn't a data-loss bug.