RO????.bac & RO????.tmp.LOG Files ?! ...

[Stephen G. Giannoni]

Where ???? is a 4 digit hexadecimal number, I've discovered hundreds
of these file pairs in my C:\Windows\System32 on each of my networked
systems running Windows XP Home. All the RO????.tmp.LOG files are 0
bytes and the corresponding RO????.bac vary in size up to about 20 mB.
Does anyone know what these are? I took a copy of all burned to CD
then deleted them and everything seems to work OK ....

 

[SG]

Stephen,

I'm working with another user in a different group right now with the same
problem. If we find what they are I'll let you know

All the best,

 

[Stephen G. Giannoni]

I suspect that they might have something to do with System Restore.

After deleting them, I went into System Restore and nearly all the
restore points were gone ...

 

[SG]

Stephen,

The other user stated the file date and times do not correspond to system
restore points, so at this point it's not known if SR has anything to do
with them. Also stated his system was bought new on 5/4/2004 and these files
were dated back to 8/31/2003.

All the best,

 

[Stephen G. Giannoni]

Only a majority of my Restore points were deleted; one or two still
remained.

I think these files might contain a kind of supplementary information,
perhaps when some element(s) of the system undergo a particularly
drastic change, and might not be needed for some routine "minor"
Restore points.

 

[Stephen G. Giannoni]

Another point. These files are easily deleted (unlike critical System
stuff), although there is some evidence of some backup character (2
corresponding files for each 4 digit hexadecimal designation).

 

[Colin Barnhorst]

What would constitute a 'minor' restore point?

 

[Stephen G. Giannoni]

Perhaps a routine "System Check Point" and no software installations
or deletions? Maybe certain Windows updates?

 

[Colin Barnhorst]

System Restore only does one kind of restore point. There are no other undo
points saved.

 

[Michael Solomon \(MS-MVP\)]

The SR deletion must be coincidental unless some malware is coming into play
here. The System Restore file store is located under "System Volume
Information."

 

[Stephen G. Giannoni]

Mighty strong coincidence ! Same action on both my systems BTW.

Just last week I was considering using the System Restore and had an
abundance of points to choose from. After the deletions, only 2.

OK, if the files are not related to System Restore, then WHAT ARE
they?

Keep in mind that all the file names start with RO (Restore
O(something)?) ...

 

[Michael Solomon \(MS-MVP\)]

I don't know what they are, I have no such corresponding file on either of
my two networked systems, not in the location you specified or anywhere
else. Further, the deletion of "tmp" files should have no effect on any
function on your computer.

You might want to make sure you antivirus is up to date and run a virus
scan. Also, you should probably check for any malware on your systems. I
would suggest you download, install and run Ad Aware.

I don't know what those files are nor should they have any effect on System
Restore.

 

[Stephen G. Giannoni]

Thanks Mike; good advice, and done all that stuff as SOP.

BTW, using NAV 2004, Norton Personanal Firewall 2005, and Spyware
Doctor. I suppose that any of these might be storing info in those
files.

However, deleting them definitely removed potential System Restore
points ....

 

[Michael Solomon \(MS-MVP\)]

Well, I honestly don't know what those files are or what might be creating
them.

You might check the event viewer to see if the files correspond to some
issue that might be regularly coming up on your system; note, it could be
some background issues so you might not even be aware. Open Control Panel,
open Administrative Tools, open Event Viewer and look for errors in the
various sections. When you find one, double click, the information
contained within might give a clue as to what's going on.

Also, have you checked the properties of those time files, right click,
select properties, there may be information in the properties that might
give a clue as to the source of those files.

 

[SG]

Stephen,

What name brand system do you have and when did you purchase it?
I'm asking because I want to see if yours and the other poster has the same
machine.

All the best,

 

[Stephen G. Giannoni]

2 Systems, both Dell -

P-4 , about 2 1/2 years
Celeron , about 5 months

BTW - over the past 48 hours or so since I deleted the files from both
systems, lots of varied use, but NO new ones have appeared;
go figure ...

 

[SG]

Stephen,

Do you have a file named BPRest.exe ?

All the best,

 

[SG]

Stephen,

From the other poster....

Quote:
I figured out what the files are!
These files are a result of using Registry Compressor (version 2.0) from
Rose City Software. Every time the program is run, it creates registry
backup files that can be used to restore the registry. I have deleted these
files and all is well. The System32 folder which contained 2GB is now down
to less than 500MB.
End Quote:

All the best,

 

[Stephen G. Giannoni]

No ...

 

[Stephen G. Giannoni]

Well that's it then, 'cause I have and use Registry Compressor
(version 2.0) ...