none
Windows 8 Driver Registry is eating my Hard Drive Space

    Question

  • Every five minutes a new 512KB file is created called DRIVERS{0736cbed-3bca-11e2-be82-0022191c2ce9}.TMContainer00000000000000000002.regtrans-ms also a file called DRIVERS{0736cbed-3bca-11e2-be82-0022191c2ce9}.TM.blf 64KB is created. It took me forever to figure this out but the files will keep creating themselves until no hard drive space is left.

    How can I fix this? The computer seems to work ok.

    Saturday, December 01, 2012 3:37 PM

Answers

  • Hello,

    This should be fixed in this update and may also clean up the files

    2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
    http://support.microsoft.com/kb/2795944/EN-US

    Check if this update is installed


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Monday, February 18, 2013 9:18 PM

All replies

  • Where (in what folder) are these files being created?

    FYI, I found a number of files with names similar to what you've described in my C:\Windows\System32\config folder, but they're not being created continuously. 

    The seem to be created in blocks of 3, the most recent two sets being on 11/25, then 11/15 before that.  I thought at first maybe they were tied to Windows Updates, but the timing doesn't seem coincidental in that Windows updates have gone in on 11/30, 11/27, 11/23, 11/20, etc. (notably none on 11/25).

     

    A web search turns up .blf as several possible things, but the text "BLF files are used to prevent the Windows registry from becoming corrupt" recurs.  I don't quite know what that means, but since the other files have ".regtrans-ms" in their names, it seems to fit.

    This thread, turned up by Google, seeks to provide some explanation (I cannot vouch for what's written there):

    http://www.winvistatips.com/regtrans-ms-and-blf-files-t173741.html

       

    As to why they're created, and more importantly why they're continually being created on your system, I don't know.  The rough implication is that something's continually writing to your registry.  Apparently that's not a given, as it's not happening on my Windows 8 system.

    I might seek out a tool that would monitor for registry access and see if I could nail down what program is doing all that registry writing.

    By the way, the sum total of all .blf and .regtrans-ms files on my system, which has been running (on and off) for months is 90 megabytes.

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options



    • Edited by Noel Carboni Saturday, December 01, 2012 6:08 PM
    Saturday, December 01, 2012 5:43 PM
  • Its windows/system32/config. Yes, there is something wrong my Windows 8, its not normal to have 40GB of driver registry backups.

    Anyone have a fix besides wiping out Windows 8 and going to a real OS like Windows 7.

    Saturday, December 01, 2012 9:00 PM
  • I've got the exact same issue.  My c:\ is constantly complaining that it is out of disk space.  I deleted MS office last week which cleared up 3 gigs of space but today again I'm at 29megs free.   Looking in TreeSize I found that my c:\windows\system32\config folder is sitting at 16 gigs with these 3 files being created every few minutes.


    • Edited by --bd-- Sunday, December 16, 2012 4:18 AM
    Saturday, December 15, 2012 4:55 PM
  • I'm having the exact same issue.  It seems like it just became an issue for me within the last few weeks or so.  I've gone down GB's on my C:\ drive because of this and I'm not sure exactly what to do.  In the end I'll probably just have to delete the files.

    Monday, December 17, 2012 7:01 AM
  • Since the journal files are created upon registry writes, those of you who are experiencing the accumulation of these files should strive to determine what program/process is continuously writing data to your registry.  Resource Monitor could potentially tell you what process it is, and the downloadeable SysInternals tool ProcMon could potentially help you narrow things down further.  I might also suggest opening some of the files in a hex editor and see if anything recognizable pops out.

    Given the location, it looks like it may be a 3rd party hardware driver doing these excessive writes.  Determining which one could help you find out who to talk to about getting it fixed.  It could be a particular display driver doing it.  Or some other hardware driver supplied by a 3rd party.

    It's a bit too simplistic to think that Microsoft will take responsibility for this.  They're not Apple!  And they rarely take interest in the problems people post here.

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Monday, December 17, 2012 10:21 PM
  • For what it's worth, I have yet to catch an alleged service/process/etc. writing like mad to the registry, but did spot these files, stealing 14GB in my case (and they started exploding in count the day I upgraded to Win8).  This is all very anecdotal, but in case it meshes with something someone else finds....

    Updated:  nVidia driver (released today), Intel SSD Toolbox, latest windows updates

    So far I've removed:  Bing bar, Bing desktop (all predated the upgrade), DirecTV2PC (which had an odd CyberSource service I hadn't noticed before)

    As of this moment the behavior has stopped in my case, but I won't trust it's fixed until I go a few days...FWIW I did move the files (regtrans-ms and blf, ONLY related to the DRIVERS branch) elsewhere and will delete them soon; no ill effects I've noticed from doing so.

    Tuesday, December 18, 2012 12:56 AM
  • I'm seeing the same issue, I have a Windows install of less than two weeks and I have 500MB of regtrans-ms files already. I did open them with an hex editor: many of them are completely empty (0s throughout), some of them have maybe half a kilobyte of sparse (and seamingly meaningless) data among the 512KB of the file. New files seem to be created roughly every 10 minutes. I'll do some more investigating but I have not find many helpful leads so far.
    Friday, December 21, 2012 9:58 PM
  • Try to use disk clean-up first, sometimes it can fix the problem.

    If that didn't work, turn off file history.

    Saturday, December 22, 2012 4:03 AM
  • I had precisely the same issue, and my process has been googling all kinds of things, but what got me the most success was doing a (admin-elevated) registry search for components of the ID in the DRIVERS{xxxxxxx-xxxx-xxxxxx-etc}. I found that the last bit matched up with the MAC address of my machine, and found that the closest matches were pertaining to storage devices that were no longer attached to the system (specifically a SATA-USB adapter and a couple external drives).

    I used the (elevated) command "set devmgr_show_nonpresent_devices=1" followed by "devmgmt.msc" to open Device Manager and then showed hidden devices, and deleted every device that wasn't attached (they show up greyed out). So far it's been over an hour without any new regtrans-ms or .blf files created, where before they were being created every 5 minutes or so. Obviously this is an issue on an SSD where the lifetime of the cells is determined by write cycles...

    I also deleted any nonpresent devices in the "Devices and Printers" panel. Old printers, other "homegroup" machines, etc.

    Hope this helps!

    Wednesday, December 26, 2012 8:54 PM
  • cixelsyddyslexic, what was the actual category name in Device Manager were you deleted all hidden devices? I am not quite brave enough to just delete everything hidden.
    Wednesday, December 26, 2012 9:30 PM
  • The relevant items were under Disk Drives and Universal Serial Bus Controllers. USB Mass Storage devices and so forth.
    Wednesday, December 26, 2012 10:04 PM
  • Search your (elevated, have to go to c:\windows\syswow64\, right click regedit and run as admin) registry for "11e2-be82-0022191c2ce9" (I pulled this from your initial message) and see where you get hits. Yours might be caused by a completely different set of devices than mine, but it's definitely a device driver issue of some type as evidenced by the fact that they are files for the  DEVICES registry subtree.
    Wednesday, December 26, 2012 10:13 PM
  • Nevermind, the issue has come back for me too. It's driving me crazy, because there are no events that give me clues. I've even tried looking into the regtrans-ms files themselves (which are just full of NUL characters and some info about the name of the .blf files that are also created), registry DRIVERS.LOG1 and 2 files, the DRIVERS registry file itself, nothing is really giving me a direction. Anybody else have things to check?

    This is a big problem to have on an SSD, because all the writes will drastically reduce the lifespan of an SSD.

    Saturday, December 29, 2012 7:10 PM
  • Finally after hours of searching on google, I could find a bunch of people with same problem.

    I am also concerned about my SSD. This is the only file that is being written to every minute (as shown in resource monitor) even when my system is idle for sometime.

    Couple of points I noted and verified for last few days (atleast on my system):

    1. It happens only on windows 8 (I have dual boot with windows 7 which does not has this problem)

    2. Set of 3 files is consistently created after every 3 minutes precisely.

    3. Restarting the computer seems to stop the creation of these files temporarily.

    4. These files again start getting created at exactly 9:05pm even when I am not close to the system. Hence, I seriously doubt the role of "Windows 7 File Recovery" which I have set up to run at 9 pm daily.

    It would be helpful to zero-in on the exact problem if you guys could confirm on any of the above points or any new peculiarities you figured out.

    For now I reboot my system immediately after backup has run and delete all but latest Driver registry files. This seems to work. I will disable my "Windows 7 File Recovery" for next few days and see if the problem still occurs. I will update you guys on the outcome.

    Monday, December 31, 2012 4:12 AM
  • Hello,

    Can you make the setupapi.dev.log (located in c:\windows\inf folder) and the cbs.log( located in the c:\windows\logs\cbs folder) available for download?

    By any chance did you tryu Noel's suggestion to use Process Monitor from SysInternals to see what it writing to those logs?

    http://technet.microsfot.com/en-us/sysinternals/bb896645

    

    


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Wednesday, January 02, 2013 5:22 PM
  • Hello,

    Whoops spelled the link wrong

    http://technet.microsoft.com/en-us/sysinternals/bb896645


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Wednesday, January 02, 2013 5:22 PM
  • I tried process manager, but the only things showing activity in those files were "System" and explorer.exe... I'll check on the log files.

    Wednesday, January 02, 2013 5:40 PM
  • https://docs.google.com/open?id=0B6a-Ncb6RbiUTlE1YmV2REdCc0k CBS.log

    https://docs.google.com/open?id=0B6a-Ncb6RbiUeUJLQW55RTExVXc setupapi.dev.log

    Hope you can see something useful there, I didn't have much luck!

    Wednesday, January 02, 2013 5:51 PM
  • Hello,

    Can you check if these updates are installed or not?

    2770816 Windows Update stops at 13 percent in Windows 8 or Windows Server 2012
    http://support.microsoft.com/kb/2770816/EN-US

    2779030 MS12-078: Description of the security update for Windows kernel-mode drivers: December 11, 2012
    http://support.microsoft.com/kb/2779030/EN-US

    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Wednesday, January 02, 2013 9:20 PM
  • Hello,

    I think this is corruption with Kernel Transaction Manager

    From an elevated CMD prompt run

    fsutil resource setautoreset true c:\

    Restart the system and see if that stops the issue from happening.

    try installing those two updates again.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Wednesday, January 02, 2013 10:41 PM
  • Hi Darrell,

    I already had the updates installed, but I ran the command to reset the transaction log and will report back if it doesn't resolve the issue for me.

    Thanks!


    EDIT: I take it back, I was apparently missing kb277081, even though the Windows Update control panel was not offering it to me. I have downloaded and installed the x64 version.
    • Edited by cixelsyddyslexic Wednesday, January 02, 2013 11:12 PM More info re:updates
    Wednesday, January 02, 2013 11:03 PM
  • No good, it's at it again already, 12 files created in the last 10 minutes.
    Wednesday, January 02, 2013 11:19 PM
  • Hello,

    OK

    Then do this again

    fsutil resource setautoreset true c:\

    Then

    Locate c:\windows\system32\config\txr (file:///c:/windows/system32/config/txr) . Back up those files, and then delete the files in that folder 

    See if that resolves the issue


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Thursday, January 03, 2013 12:07 AM
  • Hi Darrell,

    I installed both Windows update mentioned and reset the transaction log but these files still start appearing after "Windows 7 File recovery" is run. Files in "c:\windows\system32\config\txr" could not be deleted as they are "open in System". I have the two files downloadable here:

    CBS.log - http://sdrv.ms/X1IUiu

    setupapi.dev.log - http://sdrv.ms/UddRTK


    Thursday, January 03, 2013 1:40 AM
  • I am also showing those files in use. Is there a way to access them otherwise? Would they be freed up in Safe mode?
    Thursday, January 03, 2013 6:16 PM
  • Hello,

    Try opening an elevated cmd prompt

    then running net stop trustedinstaller, then try deleting the files


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Thursday, January 03, 2013 7:31 PM
  • I just want to say it's refreshing and encouraging to see Microsoft's participation here, Darrell.  Thank you.

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Thursday, January 03, 2013 9:47 PM
  • I removed the hidden items under USB and the drivers file creation seems to have stopped. Now I have component files creating themselves in threes however as a much less frequent time. Waiting for the driver files to come back as well.

    COMPONENTS{746ea10a-54b2-11e2-be85-0022191c2ce9}.TM.blf

    COMPONENTS{746ea10a-54b2-11e2-be85-0022191c2ce9}.TMContainer00000000000000000001.regtrans-ms

    COMPONENTS{746ea10a-54b2-11e2-be85-0022191c2ce9}.TMContainer00000000000000000002.regtrans-ms

    Thursday, January 03, 2013 10:03 PM
  • Hello,

    Question how many languages and which ones are installed?

    Noticed language pack references in both logs, so wanting to check to see if there are similarities around having some of those installed.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Thursday, January 03, 2013 11:08 PM
  • Still cannot delete the files in TxR folder. By the way, command says Installer is not started (as in screenshot).

    Also, I never installed any language packs etc. Its the default one. Also visible in screenshot.

    Cannot attach screenshot here. Find it here: http://sdrv.ms/ZhJ5uo


    Friday, January 04, 2013 12:06 AM
  • Hello,

    Have you tried booting to Safe Mode and then deleting the files?

    You can use MSCONFIG.exe to set the boot option to boot into Safe Mode.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Friday, January 04, 2013 5:47 PM
  • Hello,

    I would like to see some nfo files from people encountering this as well.

    can you run msinfo32 and save as an nfo file and make them available?

    I want to see if there is any commonalities to be found, drivers or running software.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Friday, January 04, 2013 11:34 PM
  • https://docs.google.com/open?id=0B6a-Ncb6RbiUalhldnY1OWk0WFk

    |p>

    There is my nfo file. I also showed "The Windows Modules Installer service is not started." and will try safe mode when I get a chance.

    Also, no language packs installed that I am aware of. US English.

    EDIT:

    Tried safe mode and was able to delete 3 of the 6 files in TxR folder. I tried disabling various of the few services that were running but was still unable to delete the remaining files.

    Saturday, January 05, 2013 1:17 AM
  • Tried to delete TxR files in safemode but could only delete 4 out of 7. Those 4 were again created on restarting in normal mode.

    NFO file link - http://sdrv.ms/WdfXNJ

    As I mentioned in earlier post, restart stops creation of those files temporarily and turning off "Windows 7 File Recovery" starts it. So I ran "Windows 7 File recovery" along with tracking using Process Monitor. I saw that these files were created by MsMpEng service which I understand as Windows Defender. If its any help I have uploaded the log file of Process Monitor. Its available here: http://sdrv.ms/WjpdA0 (First file gets created at 8:20:23pm by MSMpEng)

    Saturday, January 05, 2013 2:30 AM
  • agvat, what is this "Windows 7 File Recovery"? I don't have that as a service or anything on my box.

    Also, after safe mode attempts at deleting TxR files and such, the creation stopped (probably due to the reboot) but started up again at 0326.
    Saturday, January 05, 2013 8:18 PM
  • cixelsyddyslexic, "Windows 7 File Recovery" is in Windows 8. You can do search Settings(Window key+W) in Windows 8 to find it. It is also there in Control Panel ("View by - large icons"). It is same program that was called "Backup and Restore" in Windows 7.

    Also, if you haven't changed windows scheduled maintenance time on your machine, it runs at around 3 am which is close to 0326. You could check Event Viewer and Scheduled Tasks history to see what ran around 3.20-3.30am.

    Saturday, January 05, 2013 11:27 PM
  • Windows 7 File Recovery is not enabled on my machine, and neither is the scheduled maintenance. The only other thing going around that time is my Mozy online backup, which kind of points me in the direction of VSS issues, but I can't find anything solid.

    I don't know if these are new or if I just missed them before, but I am getting Ntfs event 134 in the System log: The transaction resource manager on volume \Device\HarddiskVolumeShadowCopy4 encountered an error during recovery.  The resource manager will continue recovery.

    and Ntfs event 136: The default transaction resource manager on volume C: encountered an error while starting and its metadata was reset.  The data contains the error code.

    The VSS ones appear to be occurring right around the time the file creation is starting, 3:15-3:30AM.

    Monday, January 07, 2013 3:18 AM
  • Hello,

    Do you have the details of the NTFS event?  Can you post them?

    have you run checkdisk on the volume?  That NTFS Event error looks like disk corruption or hardware issues with the disk


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Monday, January 07, 2013 6:30 PM
  • Chkdsk comes back clean. Here is the details tab on the latest Ntfs event:


    - <System>
      <Provider Name="Ntfs" />
      <EventID Qualifiers="32772">136</EventID>
      <Level>3</Level>
      <Task>2</Task>
      <Keywords>0x80000000000000</Keywords>
      <TimeCreated SystemTime="2013-01-07T11:19:37.147546200Z" />
      <EventRecordID>4866</EventRecordID>
      <Channel>System</Channel>
      <Computer>ST3GAMMA</Computer>
      <Security />
      </System>
    - <EventData>
      <Data />
      <Data>\Device\HarddiskVolumeShadowCopy3</Data>
      <Binary>1C00040002003000020000008800048000000000060019C000000000000000000000000000000000060019C0</Binary>
      </EventData>
      </Event>


    Monday, January 07, 2013 6:55 PM
  •  I am having the same disk space problem.  I had no idea what was going on.  I had to delete upwards of 6GB of old music and pictures just to keep up with an ever expanding drive.  Now that I see this thread, I noticed in my TRX directory that I have 81,700 files worth over 40GB all with the word DRIVER, just like these files on this persons computer.  This is insane - my drive is filling up to 40MB of disk space left every day, and I have had to delete tons of data.  Please let me know how to resolve this problem.  I have just deleted these files, whatever they are.

    This was a very helpful thread, I was able to free up 40GB of disk space deleting those files, and I could not for the life of me find them myself.  Thank you.

    Thursday, January 10, 2013 12:05 AM
  • Hello,

    We are investigating the issue and are working
    on a solution


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Friday, January 11, 2013 5:05 PM
  • Hi Darrell,

    Any update, or a direction we can also look in ourselves? Or is this an engineering problem at this point?

    Thursday, January 17, 2013 6:13 PM
  • Yeah. I'd like to know too. Constant writes like this is a real concern when like me its to a SSD.
    Sunday, January 20, 2013 8:02 AM
  • Darrell, there's another similar thread on the following community site that you might want to review.  Also, I'm a partner and wouldn't mind working with someone there at Microsoft to take a look at my Windows 8 Pro system. 

    Windows 8 Pro - C:\Windows\System32 Keeps Growing

    I'm getting 3 DRIVER files written to the config folder every 3 minutes.  I've just deleted about 14,000 of the .regtrans-ms files all with the same pattern like this: 

    DRIVERS{7867xxxx-6285-11e2-be7d-20cf30e338ab}.TMContainer0000000000000000000n.regtrans-ms

    where the xxxx varies and where the "...00n" varies between "...001" and "...002" and which resulted in recovery of about 7GB of space.


    Christopher Smith

    Sunday, January 20, 2013 9:55 PM
  • Your note made me think of something when you mentioned sizes and counts (7,000,000,000 / 14,000)...

    These files are I guess being written as some kind of journalling for registry writes.  Admittedly I haven't found good documentation on just what's being done.

    I'm not seeing repeated writes, but I do find 175 .regtrans-ms files on my Windows 8 system when I look, dated back over the past months.  Most are 512KB, with a very few being 5 MB.

    Does it REALLY take half a megabyte (or even 5 megabytes sometimes) of data to track one write to the registry?  Generally speaking such a transaction is usually writing as little as one integer into a value under one key whose name is a few dozen characters in length.

    The word "bloatware" comes to mind.

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Sunday, January 20, 2013 11:14 PM
  • Hello,

    Sorry I don't have a workaround for this other than deleting the files.  The last version of the file created should not be deleted, all the others can be safely deleted.


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Tuesday, January 22, 2013 2:52 AM
  • Hello,

    As I posted before:

    We are investigating the issue and are working  on a solution


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Tuesday, January 22, 2013 2:53 AM
  • Hi

    Any solutions found on this problem? Btw I found 25k .regtrans-ms files using Treesize, is there anyway to delete them?

    Wednesday, January 30, 2013 8:28 PM
  • I am having the same issue.

    I noticed by watching the Resource Monitor that the files are being written by MsMpEng.exe PID 2292 and by System PID 4.

    Could this be an issue with Microsoft Antimalware Service?

    Wednesday, January 30, 2013 10:18 PM
  • I think I've fixed the problem on my computer.  I used Process Monitor with filter: Path contains driver.  Whenever a new file was created, I would see registry activity by nvSCPAPISvr.exe.  This process is part of the NVIDIA 3D Vision Driver which I have now uninstalled.  As for deleting the excess files, I ran explorer.exe as Administrator, navigated to C:\Windows\system32\config, and disabled hiding of protected operating system files in Folder Options.  I then searched for drivers*tm*, sorted by modified date, and deleted all but the most recent set of 3.

    Here's a programmatic way to clean up if anyone needs (use at your own risk):

    string[] files = Directory.GetFiles(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "Sysnative", "config"), "DRIVERS{*}.TM*");
    if (files.Length == 0) return;
    string keepFilePrefix = Path.GetFileName(files.OrderByDescending(f => new FileInfo(f).CreationTimeUtc).First()).Split('.')[0];
    foreach (string file in files) {
        if (Path.GetFileName(file).StartsWith(keepFilePrefix, StringComparison.OrdinalIgnoreCase)) continue;
        File.Delete(file);
    }

    Saturday, February 02, 2013 5:18 PM
  • (Semi) confirmed. I removed the 3d Vision driver from my machine as well, and for the first time I have been able to delete ALL the DRIVERS files (previously there have always been a set of 3 files that were locked and unable to be deleted.).

    I'll check later to make sure that this actually fixes the root issue, but this is a great sign!

    Monday, February 04, 2013 5:05 PM
  • I have been plagued with this issue for a while as well, constantly having to delete those files just to ensure that my SSD didn't get completely eaten up.  I just uninstalled the Nvidia 3D Vision Driver and I am hoping that it is indeed the issue causing those files to appear.  I'll report back in a day or two either way.
    Tuesday, February 05, 2013 1:14 AM
  • I can add some evidence now.  Over two days ago, I stopped the "NVIDIA Stereoscopic 3D Driver" service and then Disabled it.  Since then, I've not had the problem.  Nice going, J.D.Purcell!

    Christopher Smith

    Tuesday, February 05, 2013 2:13 AM
  • I am still having SOME files created. I have had a total of 6 since yesterday afternoon (3 yesterday at 1616 and 3 today at 0327). Either way this seems to have improved the issue and lessened the impact of the constant writing to SSD.
    Tuesday, February 05, 2013 5:00 PM
  • Yes, I think removing the 3D driver is just treating a symptom.  I am still getting new files occasionally as well, but just a handful a day rather than hundreds.
    Tuesday, February 05, 2013 6:43 PM
  • I had 53.434 .blf and 100.000+ regtrans-ms files in my config folder, totalling a whopping 60GB. Deleted them all and uninstalled the 3D vision driver. Let's see what happens.
    Tuesday, February 05, 2013 10:14 PM
  • Yes, I think removing the 3D driver is just treating a symptom.  I am still getting new files occasionally as well, but just a handful a day rather than hundreds.

    This is exactly what I am seeing. Since yesterday, I have a total of 9 files, where ordinarily I would otherwise have multiple tens of files by now. Even an improvement helps, though I can't wait to see what Darrell and co come up with for a true fix!
    Tuesday, February 05, 2013 11:40 PM
  • Yes, I think removing the 3D driver is just treating a symptom.  I am still getting new files occasionally as well, but just a handful a day rather than hundreds.

    Same as the others echoing this sentiment, I also have had a major reduction in the creation of these files since removing Nvidia's 3D driver.  I still have a few of these files being created, but nowhere near the amount it was before.

    Good job on at least finding out one of the potential issues with this.

    Friday, February 08, 2013 6:44 AM
  • Is any1 get the solution?
    Sunday, February 17, 2013 6:34 AM
  • We do not have the official solution yet. But disabling the NVIDIA 3D service seems to decrease the creation of those files to acceptable numbers (1-3 set of three files per day). And you can delete all but the latest copies of those driver registry files to recover your lost hard drive space.

    Sunday, February 17, 2013 6:48 AM
  •  i found this http://www.surfacetablethelp.com/2013/02/windows-8-pro-cwindowssystem32config-keeps-growing.html
    i hope this will work
    Sunday, February 17, 2013 7:00 AM
  • the evidence is pretty clear that there is a problem with a driver 

    its helpful to post rig specs which makes it easier to see what is up

    try disk cleanup under accessories/system tools


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Sunday, February 17, 2013 1:29 PM
  • Is any1 get the solution?

    Yes, the solution was found.  It was, as described in response number 1, something writing excessively to the registry, then found by J.D. Purcell to be specifically the nVidia 3D Vision driver.  Removing that driver resulted in the immediate cessation of creation of literally gigabytes of .regtrans-ms file. 

    It will have to be nVidia who fix the root cause inside the driver.

    The creation of these files is not new; they are created by Windows 7 as well (I have accumulated about 200MB of them in 4 years use).  What's new is that someone at nVidia screwed up and caused writing of data into the registry far more often than should be normally done.  You should ask this question of nVidia:  Is there a new driver version that solves this problem?

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Sunday, February 17, 2013 2:51 PM
  • I suggest trying 313.96 beta which is the latest release


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Sunday, February 17, 2013 3:13 PM
  • I tried that 313.96 beta driver twice and got a graphics driver installation failure after which the NVDIA Control Panel icon was showing but the files were missing.  I had to use System Restore on my Windows 8 Pro workstation after the failed driver installation so I'd recommend making sure you have a system restore point available before trying the beta driver.  I'm back to running my NVidia services with the 3D Vision driver disable.

    Christopher Smith

    Sunday, February 17, 2013 3:25 PM
  • Unless you are using a 3D panel for entertainment reasons, remove the driver

    reinstall it and use the custom, and drop the 3D support


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Sunday, February 17, 2013 3:30 PM
  • Is any1 get the solution?

    Yes, the solution was found.  It was, as described in response number 1, something writing excessively to the registry, then found by J.D. Purcell to be specifically the nVidia 3D Vision driver.  Removing that driver resulted in the immediate cessation of creation of literally gigabytes of .regtrans-ms file. 

    It will have to be nVidia who fix the root cause inside the driver.


    I can't confirm that we can put the blame entirely on Nvidia.

    I have the 3D vision driver installed and had accumulated some 14 gigs of regtrans files. I deleted all but the newest 3 files and did NOT uninstall the 3D vision driver.

    A week later i have zero regtrans files - so Windows actually cleaned the remaing 3 ( it actually also cleaned some component files.)


    Sunday, February 17, 2013 4:07 PM
  • Perhaps nVidia fixed the problem already.  What driver version are you running, and how recently did you update it?

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Sunday, February 17, 2013 5:00 PM
  • I'm running 310.70 and have not updated since it generated regtrans files.
    Sunday, February 17, 2013 5:03 PM
  • Is there a chance Windows Update might have delivered an updated component of the display driver?  Maybe it would be useful to scour the list of Windows Updates installed on your system since you last saw a .regtrans-ms file created for evidence of anything that might have fixed it.  I'm a little surprised that something besides yourself would be cleaning up these files.  No one else has turned up evidence of that kind of activity so far.

    There is also a possibility that a condition on your computer may have changed that causes the problem not to recur.  Had you reconfigured anything or made any other changes coincident with the deletion of all those files?

     

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options


    Sunday, February 17, 2013 5:59 PM
  • The graphics drivers on Windows update are only the basic core, none of the advanced fuctionality is provided. For that I suggest using the automatic tool on GeForce.com.

    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews


    Sunday, February 17, 2013 7:10 PM
  • Hello,

    This should be fixed in this update and may also clean up the files

    2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
    http://support.microsoft.com/kb/2795944/EN-US

    Check if this update is installed


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Monday, February 18, 2013 9:18 PM
  • Hello,

    This should be fixed in this update and may also clean up the files

    2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
    http://support.microsoft.com/kb/2795944/EN-US

    Check if this update is installed


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    I have this installed and it didn't fix the problem or delete the files.

    Edit: Actually, KB2795944 failed to install on my machine with a 80070003 error. How do I try and re-install the failed update?

    • Edited by gregotte Tuesday, February 19, 2013 1:26 AM
    Tuesday, February 19, 2013 1:18 AM
  • Windows 8 has been trying to install KB2795944 since it came out on Windows Update, I just noticed it now that I read the post. Windows 8 hides everything from power users. KB2751352 is also failing.

    ERROR Code 80073712

    TRY 1: I ran the below suggestion, and it said my component store has been corrupted. Makes sense since I have deleted 60GB of files that create themselves every minute.

    DISM.exe /Online /Cleanup-image /Scanhealth

    DISM.exe /Online /Cleanup-image /Restorehealth

    Still corrupted.

    TRY 2: I ran 'Tap or click to open the Windows Update troubleshooter'. It said it fixed the issue however all it did was obliterate my history. Error still occurs.

    Help.

    Tuesday, February 19, 2013 1:46 AM
  • Is there a chance Windows Update might have delivered an updated component of the display driver?  Maybe it would be useful to scour the list of Windows Updates installed on your system since you last saw a .regtrans-ms file created for evidence of anything that might have fixed it.  I'm a little surprised that something besides yourself would be cleaning up these files.  No one else has turned up evidence of that kind of activity so far.

    There is also a possibility that a condition on your computer may have changed that causes the problem not to recur.  Had you reconfigured anything or made any other changes coincident with the deletion of all those files?

    No, and no.

    Windows update do not deliver updates to Nvidia drivers unless you have no driver installed at all.

    No other reconfiguration and the KB2795944 update is not installed either.

    Tuesday, February 19, 2013 1:50 AM
  • I have 8 in a virtual machine, clean, nothing outside of updates, same for xp and up

    all work fine there

    now NVIDIA drivers add to the C:\NVIDIA folder so that will slowly eat storage but with 3 TB disks readily available and now 4 TB disks I consider that to be trivial

    AMD does the same thing with their Radeon drivers

    windows also creates restore points that consume space, every update does it

    if your storage is tight, disk cleanup is available that can get rid of a lot of accumulated rubbish and recover sometimes GBs of space

    now I do watch the host disk for the VMs and it does slowly shrink as expected but I figure I will be fine until year 3400 or so based on current consumption

    check your entire software stack, its the only way you can be sure

    my appwiz tool on my IT site is a good step towards that goal, post results here


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Tuesday, February 19, 2013 2:40 AM
  • Hello,

    This should be fixed in this update and may also clean up the files

    2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
    http://support.microsoft.com/kb/2795944/EN-US

    Check if this update is installed


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    I have this installed and it didn't fix the problem or delete the files.

    Edit: Actually, KB2795944 failed to install on my machine with a 80070003 error. How do I try and re-install the failed update?

    Same here, KB2795944 fails to install. I've tried installing KB2795944 for my Windows 8 x64 manually from the Microsoft Download Center but it fails.

    The real pattern here is no new drivers install anymore, including the latest Nvidia drivers or my new webcam driver - both found by Windows Update. Manually installing any driver from the Device Manager ends up with:

    `Windows found a driver software for your device but encountered an error while attempting to install it.
     One of the installers for this device cannot perform the operation at this time`

    Restarting the PC did not help in any way.

    Wednesday, February 20, 2013 2:01 PM
  • if an update fails, reboot and try it again


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Wednesday, February 20, 2013 2:04 PM
  • if an update fails, reboot and try it again


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Please understand the problem is not 100% on all Windows 8 systems and you cannot help as you do not experience it ... plus you also failed to read the ending `Restarting the PC did not help in any way.`.

    Moreover, I have been having this problem for over 3 months now on my main Windows 8 x64 PC, although a Windows 8 x64 virtual machine, I also have, does not show this registry file spree mainly because it only has one Visual Studio version over the the original Windows 8 x64 installation and Hyper-V does not allow connecting USB device to it that would help trigger the registry file spree.


    Wednesday, February 20, 2013 2:22 PM
  • I am also being affected by this issue, and only just now stumbled on this thread. I had this problem ~2-3 weeks after Win8 was released. Initially tried a fresh re-install, disabled application states, restore points, etc...  For a 48GB SSD, I would run into a /system32/config/ folder 15-29GB in size 2-3 weeks after install. I had worked around this issue by enabling compression on the folder, bringing it from ~19GB to ~<1GB (determined by free disk space compared before and after), and this has mostly resolved the issue for me this past month. It still did not fix the sheer number of writes to my disk. I just got the KB2795944 update today, and will see if the problem gets fixed.
    Thursday, February 21, 2013 1:08 AM
  • 48 GB is far too small in my opinion, you should use one with 10x that capacity.


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Thursday, February 21, 2013 1:45 AM
  • Darrell,

    this exact issue (C:\Windows\System32\config filled up with 18GB worth of "DRIVERSxxxxxxxx" files) actually occurred after running the Windows Update on February the 13th 2013.

    The exact same issue occurred on my friends computer the same day, and I confirmed with him now that he has the same issue with his config folder.

    The 2795944 fix you mentioned as a fix was among those being installed during the 13th on both our systems.

    Me and my friend both have NVIDIA gfx cards and I'm now looking into disabling the 3D driver and cleaning up the files until the final solution is in place.

    Saturday, February 23, 2013 7:17 PM
  • After installing KB2795944, I have had no new files created since 2/20/2013. Looks like that did it!
    Wednesday, February 27, 2013 6:36 PM
  • You guys are my hero! I had accumulated over 20 gigs of these "DRIVER" files in the config folder... 

    I have a 74 gig raptor drive for main OS with two 1TB disks for storage... I had literally installed everything from this computer except for Office and could not figure out where my disk space was going to.

    The DRIVER files moved, and I have reclaimed over 20 gigs of space.

    Woohoo!

    Friday, March 15, 2013 2:48 PM
  • get a larger disk, these days disks are in the TB range, disks like your raptor were around 10 years ago. 


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Friday, March 15, 2013 8:29 PM
  • Darrell,

    Please note the problem continues to exist, even in safe mode (basic drivers only) those registry files are being created, clearly showing the problem is coming from inside Windows 8 and not other drivers.

    Please note I am still unable to install KB2795944 manually and the Windows Update has never presented it as an option.

    Please advise.

    Thank you for your support!

    P.S. Vegan, please stop spamming the thread and allow the Microsoft teams to figure out this internal operating system problem.

    Wednesday, March 20, 2013 8:43 AM
  • Hello

    How is the update failing?  What errors are you getting?

    Do you have the Windowsupdate.log and cbs.log available for download?


    Thanks, Darrell Gorter [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights. VAMT - Volume Activation Management Tool - Download link http://www.microsoft.com/downloads/details.aspx?FamilyID=ec7156d2-2864-49ee-bfcb-777b898ad582&displaylang=en

    Wednesday, March 20, 2013 4:46 PM
  • Victor as I understand it, Microsoft fixed the issue but you like me I cannot install the KB that resolves it, I have another thread going on this same issue. Based on the response, Windows 8 is toast because of this driver issue and now I need to do a clean install. I have not done it yet, but when I do it will be installed as Windows 7 not garbage Windows 8 for grandma.

    http://social.technet.microsoft.com/Forums/en-US/w8itprogeneral/thread/69173ae6-249f-4463-ae4c-d644d2a132ab/


    Wednesday, March 20, 2013 5:04 PM
  • I have been investigating the issue of growing disk consumption.

    I have all versions of desktop and server Windows in virtual machines and so far all have been well behaved

    this suggests a 3rd party program is consuming storage.

    Because its not easily reproducible, its likely going to have to use remote desktop to analyse the rig more closely to see what it wrong.

    Excess disk use is also a problem for some using Windows Server so its clear that the problem is a software problem as the virtual machines are static (growth is slow driven by Windows updates)


    Windows MVP, XP, Vista, 7 and 8. More people have climbed Everest than having 3 MVP's on the wall.

    Hardcore Games, Legendary is the only Way to Play

    Developer | Windows IT | Chess | Economics | Vegan Advocate | PC Reviews

    Wednesday, March 20, 2013 5:29 PM
  • Wow, thank you for this thread! I wasted so much time trying to clear up space not realizing the real issue.  To give back, I will post a Power Shell script I created to delete the files.  Open Power Shell with 'Run As Administrator' rights. Use it at your own risk.

    $SysConfigFiles = (Get-ChildItem -Path "C:\windows\System32\config" -Filter * -Hidden)
    $SysConfigFiles | Measure-Object
    $FilesToDelete = $SysConfigFiles | Where-Object {$_.Name -like "DRIVERS*"}
    $FilesToDelete | Remove-Item -Force



    • Edited by Mike-IT Sunday, August 04, 2013 8:48 AM
    • Proposed as answer by Jeph Wednesday, March 12, 2014 8:56 AM
    • Unproposed as answer by MyWarHistoryDotCom Wednesday, March 12, 2014 3:18 PM
    Thursday, July 04, 2013 7:42 AM
  • Mike-IT,

    THANK YOU!

    Thursday, August 29, 2013 5:48 AM
  • THANK YOU SO MUCH DUDE! IT'S WORKING!
    Sunday, September 22, 2013 6:10 AM
  • one last idea, use the disk cleanup tool and run it monthly to get rid of the trash

    depending on the software stack, it might be an idea to backup and start fresh

    I ran into a problem with a game DRM, StarForce wants the rig in IDE mode so it can install a custom driver for their tool.

    StarForce is only 1 of several known problems.


    Corsair Carbide 300R with window & Corsair TX850V2 70A@12V Asus M5A99FX PRO R2.0 CFX/SLI & AMD Phenom II 965 C3 Black Edition @ 4.0 GHz & G.SKILL RipjawsX DDR3-2133 8 GB GTX 260 SLI 216 core (GT200 Tesla) & Asus PA238QR IPS LED HDMI DP 1080p ST2000DM001 & Windows 8.1 x64 Professional Microsoft Wireless Desktop 2000 & Wacom Bamboo CHT470M LG WH14NS40 14X Blu-Ray Writer BDXL 128GB put your rig specs into your signature like I have, this makes it 100x easier to help out

    Sunday, September 22, 2013 12:28 PM