Unknown files in system32 folder

[Greg]

There are hundreds of files in the C:\Windows\System32 folder taking up
several gigabytes of space. The files have similar names as follows:
ROE00C.bac - these are several megabytes in size.
ROE00C.tmp.LOG - these are 0 bytes.

Anyone know what they are? Can I delete them?

 

[Will Denny]

Hi

From the file names, they could associated with an installation of some
kind. To be on the safe side, have you virus-checked your system lately
with the latest definitions? Also please try the following programs for
spyware checking:

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://forum.aumha.org/downloads/cwshredder.zip
Spy Sweeper - www.webroot.com

Try SpyWareBlaster to stop intrusions:

http://www.javacoolsoftware.com/spywareblaster.html

Also see the following links:

http://aumha.org/a/parasite.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.microsoft.com/security/articles/spyware.asp

As the files are so large, they may be directly deleted and go into the
recycle bin unless you alter the amount of disk space allowed for the RB.

 

[johnf]

Wht have you installed recently?
Some program is creating a string of back-up files, possibly some
non-approved AV program or similar.

Check back through 'System-Restore' to see if there's nothing "odd" been
installed recently & get rid of it.

 

[Greg]

Additional information: The file dates indicate that these files have been
added since 8/31/2003. The files are added every 5 to 15 days and all 24
files have the same date and time. Each group fo 24 files totals over 30 MB.
The file date and times do not correspond to system restore points. Can't
figure out what they are for. One problem - I bought the computer new on
5/4/2004. Why would the first occurance be 8/31/2003 ????

 

[johnf]

Beats me.

"ROE00C" pulls up absolutely nothing in Google, even if you change 'ROE00C'
to 'ROEooC' or 'ROE00C' (numerical zero), so personally wouldn't hesitate to
rename them all insitu to 'ROE00C-old', to make sure it has no impact on any
odd software, & if not, delete them in a few weeks.

 

[SG]

Greg,

The .bac files are backup files for something you have installed. When
random names appear before the extension it's almost impossible to find
anything in a search. Leaving off the file names and only searching for the
extension gets several hits.Try www.google.com for the phrase ".bac"

Can you open any of the .log files with Notepad to possibly give you a clue
as to what program are creating these?

 

[Greg]

There are hundreds of the .log files and all of them are 0 byte files. When
opened in Notepad, there's nothing there.

 

[SG]

Greg,

Try opening one of the .bac files with Word or WordPad. You will probably
see a bunch of garbled characters but maybe some text to identify what the
program is. BTW there is another message in another group where the user has
the same problem.

All the best,

 

[johnf]

0 bytes = 0 bytes, ie, there's nothing in there!
See my previous post for advice.

 

[SG]

That's the "Log" files John, not the "Bac" files.
See Greg's previous post :>)

All the best,

 

[SG]

Greg,

What system did you buy?
I'm asking because another poster has the exact files as you and I'm trying
to see if this is related to the system and software it came install with or
a 3rd. party software.

All the best,

 

[Greg]

I figured out what the files are!
These files are a result of using Registry Compressor (version 2.0) from
Rose City Software. Every time the program is run, it creates registry
backup files that can be used to restore the registry. I have deleted these
files and all is well. The System32 folder which contained 2GB is now down
to less than 500MB.

 

[SG]

Greg,

Great job bud and thanks for sharing the info. I'll pass this along to the
other poster.

All the best,

 

[johnf]

Woops, missed that one, sorry.
Glad he found the problem - which sort of takes me back to my original reply