AVAST Free Killing Disk Space

[REDACTED]

The latest version of Avast Antivirus Free is creating huge temp files and filling up my primary disk.  Occasionally the temp files are automatically deleted but more often than not I end up with zero disk space.  This problem surfaced after the most recent program update.


The temp path is 'c:\windows\temp\_avast_' and the file names are in the format 'ws0000XXXXX.tmp' where 'XXXXX' are random alphanumeric characters.

[RejZoR]

Hm, this is avast's temporal scan folder. Stuff avast scans often gets unpacked there. Are you doing anything peculiar on your system that might trigger this?

[REDACTED]

I'm not sure if it's of any consequence but I'm running Windows 10 Pro.  Nothing else has changed since the last Avast update and the workstation is idle when this occurs.  I used Windows Resource Monitor and Sysinternals Process Monitor to identify the offending process and files.

[DavidR]

Hm, this is avast's temporal scan folder. Stuff avast scans often gets unpacked there. Are you doing anything peculiar on your system that might trigger this?

@  dcsang
As RejZoR, this folder is where avast unpacks or moves a copy of a file or files that it is going to scan. On successful completion of the scan these temporary files should be removed by avast.

The most common reason for files remaining in the _avast_ folder is having another resident AV or anti-malware program that is effectively blocking avast from scanning and removing the files on completion. This is what RejZoR is getting on about.

[RejZoR]

With "peculiar" I meant usage of multiple security products, compiling of binaries (for games or apps), other stuff that's not exactly common for average users, that kind of things. Because in normal conditions, these temporal files should get automatically removed after they are successfully scanned.

[REDACTED]

DavidR & RejZoR, thank you for the clarification.  I have been using Avast and Malwarebytes for quite some time now and this is the first time I encountered such an issue.  There was no update to the latter so I am inclined to believe that something in the latest Avast release is intolerant of my environment.  I don't like to do this, for obvious reasons, but is there a way to downgrade the program version?

[DavidR]

Assuming that you are using the premium (resident) version of MBAM.

Try adding the C:\WINDOWS\Temp\_avast_ folder to the MBAM exclusions.

[REDACTED]

Your suggestion appeared promising for a while but I'm currently down from 100GB to 1GB.  I really like Avast but it's not practical to restart my workstation every few hours for the purpose of freeing disk space.  I appreciate the suggestions and feedback received here.  I'll give it another try after the next program update.

[Eddy]

If you have the real-time protection of MBam enabled, disable it and see if it makes a difference.

[WhataMack]

Wanted to add to the thread that I'm seeing the same problem.  There are two differences in my situation as compared to the OP's system:

• I'm running Windows 7 Professional 64-bit instead of the OP's Windows 10.
• I'm seeing the disk-filling Avast temp file in "C:\Users\(my name)\AppData\Local\Temp\_avast_"

I've read elsewhere that Mbam might cause this to happen, so I've turned Mbam off a few days ago and no longer have it starting with Windows, but the problem persists.  So, I don't think Mbam is the reason for me.  I'm also not running anything peculiar such as RejZoR mentioned above.  The issue with the disk-filling Avast file has been happening every night for the past week.

I also have Outlook 2007 always running.  When I try to permanently delete the huge temp file, I've only been able to do so by first closing Outlook 2007 and then ending the "OUTLOOK.EXE *32" process.  Once I've done both, I can delete the file.

I also did an Avast boot-time scan yesterday, but had the same disk-full problem this morning.  I never did see any report from Avast after the scan; my system just wound up booting into Windows as it normally does.

So, does anyone have suggestions about next steps?  Thanks in advance for any help.

[Eddy]

WhataMack,

As long as Outlook keeps the file open, avast can't delete it.
One option is (as you said) closing Outlook after which the file can be deleted.
Another option is to delete all temporary files at boot-time.

[WhataMack]

I made some changes last night before my nightly Avast scan, and didn't see the disk-filling problem this morning.  Along with the exclusions I already had set up, which hadn't prevented the problem:

• C:\Users\Dave\AppData\Local\Microsoft\Outlook\*
• C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office\*

I also added:

• C:\Users\*

This last addition seems to have been the one that prevented the disk-filling problem. I also kept Outlook 2007 running, just to keep the testing variables down to a minimum.

So, that seems like at least one solution.  However, I'm not sure if excluding everything in that last directory is really a smart thing to do, from a scanning/security perspective.  Can anyone comment on that?  Thanks again for your help.

[davexnet]

re: c:\users
You're suspicions are right, it's a dumb thing to do.  many programs can and do execute form in there,
including the system temp folder and application specific directories.  The temp folder is likely to be the first place
an infection could be.

[WhataMack]

OK, thanks for that advice.  I'll remove the C:\Users\* exclusion and report back after tonight's scan.

[WhataMack]

Well, here's something interesting.  Yesterday afternoon, not long after I posted the reply above, I noticed the disk was full again.  The only way to delete the file, which was in the same directory as listed above, was to close Outlook 2007 and end the "OUTLOOK.EXE * 32" process as I did before.  Also, I didn't have Outlook running last night and the Avast scan seemed to finish correctly, and didn't create the disk-filling temp file.

So, it really seems like Outlook is some type of culprit in this situation.  I have no idea why, but if anyone has other suggestions (besides uninstalling Outlook) to deal with this?  Thanks again.