How to Fix (Permanently): Hundreds of Cab_XXX Files in C:\Windows\Temp

Infopackets Reader Bob P. writes:

" Dear Dennis,

I am running Windows 10 and I have thousands of cab_xxx files in my c:\windows\temp directory. Many of the files are 135 megabytes each, while some are 0 bytes. They keep generating themselves throughout the day, and I can't seem to stop it! The problem is that I am almost running out of disk space. You've fixed my computer using remote desktop support before so I am more than willing to have you look at it again. Thanks! "

My response:

I connected with Bob using my remote desktop support service and found some very interesting things.

Initially Bob only had 10 megabytes of free disk space on his C drive - barely enough to keep Windows running properly. As a general rule of thumb, you never, ever want to let your C drive get this low on available space, because programs running on the system (including the operating system) are always writing data to the drive. If you run out of space, then the data can't be written properly and files can go corrupt - and that's when things start to break.

Typically the c:\windows\temp directory is used for temporary files during a program installation (for example). Once the program install is finished, the temporary files should be removed from the system. This was not the case for Bob, however. His c:\windows\temp directory was literally filled with cab_xxx files - all having similar byte size and some with 0 byte sizes. I knew this was likely the result of some sort of data corruption or possibly a virus infection.

His directory looked like this:

Directory of C:\Windows\Temp

08/30/2017  07:11 AM    <DIR>          .

08/30/2017  07:11 AM    <DIR>          ..

08/28/2017  11:43 AM       137,969,852 cab_10548_2

08/28/2017  11:40 AM                 0 cab_10548_3

08/28/2017  11:40 AM                 0 cab_10548_4

08/28/2017  11:40 AM                 0 cab_10548_5

08/28/2017  11:40 AM                 0 cab_10548_6

08/28/2017  11:55 AM       137,969,852 cab_2688_2

08/28/2017  11:49 AM                 0 cab_2688_3

08/28/2017  11:49 AM                 0 cab_2688_4

08/28/2017  11:49 AM                 0 cab_2688_5

08/28/2017  11:49 AM                 0 cab_2688_6

08/29/2017  08:10 AM       137,969,852 cab_2388_2

08/29/2017  08:07 AM                 0 cab_2388_3

08/29/2017  08:07 AM                 0 cab_2388_4

08/29/2017  08:07 AM                 0 cab_2388_5

08/29/2017  08:07 AM                 0 cab_2388_6

... etc

If you notice, the files above were being generated every few hours. This is not normal. By deleting the files in this directory, I immediately reclaimed over 100 gigabytes of storage.

A few hours later I went back to Bob's c:\windows\temp directory and found more cab_xxxx files were being generated. More research revealed other users complaining of the same problem. Obviously deleting the temporary files is only a temporary fix - I needed to get to the root cause of the problem.

After more research, I came across a post online with a Powershell script to remove the bogus files from the system and to reset parts of Windows. The solution, however, was rather complex and written for server administrators. A few more posts online illustrated the same issue, however, I could not find a simple 'fix' that regular Windows users could use. Therefore I decided to write my own batch script to take care of the problem.

How to Fix (Permanently): Hundreds of Cab_XXX Files in C:\Windows\Temp

If you are facing the same issue as Bob, where you have hundreds of cab_xxx files c:\windows\temp, you will want to run the script below to permanently fix the problem. This will not only clear up disk space (Bob reclaimed over 150 gigabytes of space!), but should also prevent the issue from reoccurring.

Update: I've had a few users email me about my script. For clarification, the below script achieves the following and works on Windows Vista, 7, 8, and 10:

• Turns off windows update service
• Renames the SoftwareDistribution folder and clears it - this fixes corruption in many *.cab files
• Deletes all files in c:\windows\temp
• Turns off Windows modules installer service
• Deletes all *.cab and *.log files within the c:\windows\logs\cbs folder - this fixes corruption in many *.cab files
• Regenerates the *.cab files in the c:\windows\logs folder
• Turn on Windows module installer service
• Turns on the Windows Update service

1. To begin, click Start, type in "cmd" (no quotes); wait for "CMD.EXE" or "Command Prompt" to appear in the list, then right click and "Run as Administrator".
    
2. Use your mouse to highlight the text below:
   
   net stop wuauserv
   cd %systemroot%
   rename SoftwareDistribution SoftwareDistribution.old
   rmdir /q /s c:\windows\temp
   net stop trustedinstaller
   c:
   cd c:\windows\logs\CBS
   del *.cab
   del *.log
   rem regenerate cab files
   c:\windows\system32\wuauclt.exe /detectnow
   net start wuauserv
   echo this is a dummy line
    
3. Right click the highlighted text above, then select "Copy" from the dialogue menu. Go to the administrative command prompt you opened in Step #1 and right click in the middle of the window, then select "Paste" from the dialogue menu. The text you copied in Step #2 should now be output to the command line. You will want to review the output after the commands have been pasted in the administrative command prompt to ensure that both the Windows Update and TrustedInstaller services quit successfully. This will ensure that the SoftwareDistribution directory and CBS logs / .cab files can be cleared properly, otherwise the issue will certainly reoccur. If the services don't quit properly, you can try re-running the script by pasting it again to the window. If it still doesn't work, you can contact me for additional support described below.

At this point, your hard drive should be cleared of many temporary files AND the problem should be fixed permanently. In Bob's case, this was most definitely the case - I checked a few days later and his c:\windows\temp directory was normal. That said, you will need to keep an eye on the c:\windows\temp directory over the next few days to see if any more cab_xxx files are being generated. If you are still having issues, you can contact me for additional support - described next.

Additional 1-on-1 Support: From Dennis

If all of this is over your head, or if you're still having problems with cab_xxx files appearing in your c:\windows\temp directory, I can help using my remote desktop support service. Simply contact me, briefly describing the issue and I will get back to you as as soon as possible.

Got a Computer Question or Problem? Ask Dennis!

I need more computer questions. If you have a computer question -- or even a computer problem that needs fixing -- please email me with your question so that I can write more articles like this one. I can't promise I'll respond to all the messages I receive (depending on the volume), but I'll do my best.

About the author: Dennis Faas is the owner and operator of Infopackets.com. With over 30 years of computing experience, Dennis' areas of expertise are a broad range and include PC hardware, Microsoft Windows, Linux, network administration, and virtualization. Dennis holds a Bachelors degree in Computer Science (1999) and has authored 6 books on the topics of MS Windows and PC Security. If you like the advice you received on this page, please up-vote / Like this page and share it with friends. For technical support inquiries, Dennis can be reached via Live chat online this site using the Zopim Chat service (currently located at the bottom left of the screen); optionally, you can contact Dennis through the website contact form.