l33t hosting - our bandwidth pimps.  these guys r0x0rz
megatokyo - relax, we understand j00 what the hell is going on here?
who are these people?
please buy stuff or kimiko will cry...
rant and rave, tell everyone what you think.
comming soon - MT fan links and other stuff
fredart studios - the process behind the madness


    Reply to this topicStart new topic

> Sctemp Folder In C:\ Root, What on earth?
MegaPsycho
Posted: Nov 2 2009, 01:21 PM
Quote Post


Forum Drunk
*******

Group: Active Members
Posts: 3238
Member No.: 8785
Joined: 17-December 02



I have encountered yet another problem that is a first for me, and this time, just wow.

On a XP machine, one of my friends complained about how he can't figure out where on earth all his HD space went. His HDD is approximately 140 gigs.

I laughed at first, thinking it was a small disk to begin with, but decided to investigate, thinking it was just something normal taken up by picts/games/music/pron/spyware/whatever.

Well, he has no games on said computer. Actually, I found nothing significant other than 15 gigs of itunes music and 18 gigs of pictures. Looked up how much Windows itself was taking up, only ~5 gigs. To say the least, I was surprised how well kept his computer was.

So I run a thorough scan of his comp for anything and everything over 5 megabytes. Figure there would be redundant copies of music/picts.

And then I find a folder (C:\sctemp) which is full of 100 megabyte files of an extension I have never heard of before, and none are associated with a program.
(Filename example: CF~S0000.T~P )

The folder itself is taking up 97 gigs, which immediatly raised so many red flags in my mind. However any and all searches for that extension and folder on google and wikipedia turned up nothing that was even remotely relevant, except possibly this: http://www.secondcopy.com/kb/article.aspx?id=12630
However, that is not the same extension, and I dont think thats what im dealing with, unless there is something im missing here.

Anyone have an idea what this folder is? I figure deleting the folder is my best option, but id rather not till I can confirm that these are not critical system files or are somehow attached to such.

Any help or clarifications would be a godsend.
PMEmail PosterUsers WebsiteMSN
Top
Flooding Mercury
Posted: Nov 2 2009, 02:27 PM
Quote Post


:D
*******

Group: Active Members
Posts: 2726
Member No.: 12961
Joined: 2-April 03



It looks like a temporary folder...I don't know why the hell it's 97 gigs though. Do you have a normal C:\Temp folder?

Have you run a virus scan?

This post has been edited by Flooding Mercury on Nov 2 2009, 02:29 PM
PMEmail Poster
Top
MegaPsycho
Posted: Nov 2 2009, 03:41 PM
Quote Post


Forum Drunk
*******

Group: Active Members
Posts: 3238
Member No.: 8785
Joined: 17-December 02



He has a virus scanner that auto runs daily on full scan.
Went ahead and did ad-aware scan and defrag for shits and giggles.

There is a temp folder in root of C, but its takes up less than a megabyte.
PMEmail PosterUsers WebsiteMSN
Top
DJ_Izumi
Posted: Nov 2 2009, 05:40 PM
Quote Post


Not As Big A Furfag As Pero^2
*******

Group: Active Members
Posts: 8445
Member No.: 1468
Joined: 19-April 02



Delete it and see what happens? tongue.gif
PMEmail PosterUsers WebsiteAOLMSN
Top
silent killer
Posted: Nov 2 2009, 05:47 PM
Quote Post


l33t One
******

Group: -Members-
Posts: 1117
Member No.: 23875
Joined: 4-February 04



Backup whatever files he wants to keep first.
PMEmail Poster
Top
ZirePhoenix
Posted: Nov 3 2009, 07:23 PM
Quote Post


l33t One
******

Group: -Members-
Posts: 2412
Member No.: 33202
Joined: 15-September 04



Check the file's last modified date. If they haven't been modified or accessed for a long time, it's usually safe to delete them.

Also see if the files are created at predictable intervals.
PMEmail Poster
Top
Skulkraken
Posted: Nov 4 2009, 05:43 AM
Quote Post


Veteran
*****

Group: -Members-
Posts: 957
Member No.: 45348
Joined: 4-October 05



Bingo.

QUOTE (Counter-Forensics paper found through Google)
SecureClean renamed files during its name and metadata scrambling operations. The file names take the form of
"SCxxxxxx.T~P", where the 'x's stand for a six-digit number that seems to increment linearly for every file wiped. Example:
SC000043.T~P These files' MAC times were set at the time of wiping, and the file size set to zero. In addition, to the filesystem
signature noted above, this test identified other operational fingerprints. In Secure Clean's overwriting of Restore Point files, the
names and other metadata of these files were unchanged -- although the corresponding data sectors were overwritten with zeroes.
The MAC times for files in the Restore Point directories did not appear to be altered.

SecureClean also left metadata pointing to a deleted folder in the root directory named “sctemp”, which contained deleted files
with names in the form "AF~Sxxxx.T~P", where xxxx was a four-digit number. Judging by file size and other remaining metadata
records, these files may have been created during the overwriting of unallocated space.
PMEmail Poster
Top
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

Topic Options   Reply to this topicStart new topic