Every five minutes a new 512KB file is created called DRIVERS{0736cbed-3bca-11e2-be82-0022191c2ce9}.TMContainer00000000000000000002.regtrans-ms also a file called DRIVERS{0736cbed-3bca-11e2-be82-0022191c2ce9}.TM.blf 64KB is created. It took me forever to figure this out but the files will keep creating themselves until no hard drive space is left.

How can I fix this? The computer seems to work ok.

Where (in what folder) are these files being created?

FYI, I found a number of files with names similar to what you've described in my C:\Windows\System32\config folder, but they're not being created continuously. 

The seem to be created in blocks of 3, the most recent two sets being on 11/25, then 11/15 before that.  I thought at first maybe they were tied to Windows Updates, but the timing doesn't seem coincidental in that Windows updates have gone in on 11/30, 11/27, 11/23, 11/20, etc. (notably none on 11/25).

A web search turns up .blf as several possible things, but the text "BLF files are used to prevent the Windows registry from becoming corrupt" recurs.  I don't quite know what that means, but since the other files have ".regtrans-ms" in their names, it seems to fit.

This thread, turned up by Google, seeks to provide some explanation (I cannot vouch for what's written there):

http://www.winvistatips.com/regtrans-ms-and-blf-files-t173741.html

As to why they're created, and more importantly why they're continually being created on your system, I don't know.  The rough implication is that something's continually writing to your registry.  Apparently that's not a given, as it's not happening on my Windows 8 system.

I might seek out a tool that would monitor for registry access and see if I could nail down what program is doing all that registry writing.

By the way, the sum total of all .blf and .regtrans-ms files on my system, which has been running (on and off) for months is 90 megabytes.

Its windows/system32/config. Yes, there is something wrong my Windows 8, its not normal to have 40GB of driver registry backups.

Anyone have a fix besides wiping out Windows 8 and going to a real OS like Windows 7.

I've got the exact same issue.  My c:\ is constantly complaining that it is out of disk space.  I deleted MS office last week which cleared up 3 gigs of space but today again I'm at 29megs free.   Looking in TreeSize I found that my c:\windows\system32\config folder is sitting at 16 gigs with these 3 files being created every few minutes.

I'm having the exact same issue.  It seems like it just became an issue for me within the last few weeks or so.  I've gone down GB's on my C:\ drive because of this and I'm not sure exactly what to do.  In the end I'll probably just have to delete the files.

Since the journal files are created upon registry writes, those of you who are experiencing the accumulation of these files should strive to determine what program/process is continuously writing data to your registry.  Resource Monitor could potentially tell you what process it is, and the downloadeable SysInternals tool ProcMon could potentially help you narrow things down further.  I might also suggest opening some of the files in a hex editor and see if anything recognizable pops out.

Given the location, it looks like it may be a 3rd party hardware driver doing these excessive writes.  Determining which one could help you find out who to talk to about getting it fixed.  It could be a particular display driver doing it.  Or some other hardware driver supplied by a 3rd party.

It's a bit too simplistic to think that Microsoft will take responsibility for this.  They're not Apple!  And they rarely take interest in the problems people post here.

For what it's worth, I have yet to catch an alleged service/process/etc. writing like mad to the registry, but did spot these files, stealing 14GB in my case (and they started exploding in count the day I upgraded to Win8).  This is all very anecdotal, but in case it meshes with something someone else finds....

Updated:  nVidia driver (released today), Intel SSD Toolbox, latest windows updates

So far I've removed:  Bing bar, Bing desktop (all predated the upgrade), DirecTV2PC (which had an odd CyberSource service I hadn't noticed before)

As of this moment the behavior has stopped in my case, but I won't trust it's fixed until I go a few days...FWIW I did move the files (regtrans-ms and blf, ONLY related to the DRIVERS branch) elsewhere and will delete them soon; no ill effects I've noticed from doing so.

Try to use disk clean-up first, sometimes it can fix the problem.

If that didn't work, turn off file history.

I had precisely the same issue, and my process has been googling all kinds of things, but what got me the most success was doing a (admin-elevated) registry search for components of the ID in the DRIVERS{xxxxxxx-xxxx-xxxxxx-etc}. I found that the last bit matched up with the MAC address of my machine, and found that the closest matches were pertaining to storage devices that were no longer attached to the system (specifically a SATA-USB adapter and a couple external drives).

I used the (elevated) command "set devmgr_show_nonpresent_devices=1" followed by "devmgmt.msc" to open Device Manager and then showed hidden devices, and deleted every device that wasn't attached (they show up greyed out). So far it's been over an hour without any new regtrans-ms or .blf files created, where before they were being created every 5 minutes or so. Obviously this is an issue on an SSD where the lifetime of the cells is determined by write cycles...

I also deleted any nonpresent devices in the "Devices and Printers" panel. Old printers, other "homegroup" machines, etc.

Hope this helps!

Nevermind, the issue has come back for me too. It's driving me crazy, because there are no events that give me clues. I've even tried looking into the regtrans-ms files themselves (which are just full of NUL characters and some info about the name of the .blf files that are also created), registry DRIVERS.LOG1 and 2 files, the DRIVERS registry file itself, nothing is really giving me a direction. Anybody else have things to check?

This is a big problem to have on an SSD, because all the writes will drastically reduce the lifespan of an SSD.

Finally after hours of searching on google, I could find a bunch of people with same problem.

I am also concerned about my SSD. This is the only file that is being written to every minute (as shown in resource monitor) even when my system is idle for sometime.

Couple of points I noted and verified for last few days (atleast on my system):

1. It happens only on windows 8 (I have dual boot with windows 7 which does not has this problem)

2. Set of 3 files is consistently created after every 3 minutes precisely.

3. Restarting the computer seems to stop the creation of these files temporarily.

4. These files again start getting created at exactly 9:05pm even when I am not close to the system. Hence, I seriously doubt the role of "Windows 7 File Recovery" which I have set up to run at 9 pm daily.

It would be helpful to zero-in on the exact problem if you guys could confirm on any of the above points or any new peculiarities you figured out.

For now I reboot my system immediately after backup has run and delete all but latest Driver registry files. This seems to work. I will disable my "Windows 7 File Recovery" for next few days and see if the problem still occurs. I will update you guys on the outcome.

Hello,

Can you make the setupapi.dev.log (located in c:\windows\inf folder) and the cbs.log( located in the c:\windows\logs\cbs folder) available for download?

By any chance did you tryu Noel's suggestion to use Process Monitor from SysInternals to see what it writing to those logs?

http://technet.microsfot.com/en-us/sysinternals/bb896645





Hello,

Whoops spelled the link wrong

http://technet.microsoft.com/en-us/sysinternals/bb896645

I tried process manager, but the only things showing activity in those files were "System" and explorer.exe... I'll check on the log files.

https://docs.google.com/open?id=0B6a-Ncb6RbiUTlE1YmV2REdCc0k CBS.log

https://docs.google.com/open?id=0B6a-Ncb6RbiUeUJLQW55RTExVXc setupapi.dev.log

Hope you can see something useful there, I didn't have much luck!

Hello,

Can you check if these updates are installed or not?

2770816 Windows Update stops at 13 percent in Windows 8 or Windows Server 2012
http://support.microsoft.com/kb/2770816/EN-US

Hello,

I think this is corruption with Kernel Transaction Manager

From an elevated CMD prompt run

Restart the system and see if that stops the issue from happening.

try installing those two updates again.

Hi Darrell,

I already had the updates installed, but I ran the command to reset the transaction log and will report back if it doesn't resolve the issue for me.

Thanks!

Hello,

OK

Then do this again

fsutil resource setautoreset true c:\

Then

Locate c:\windows\system32\config\txr (file:///c:/windows/system32/config/txr) . Back up those files, and then delete the files in that folder 

See if that resolves the issue

Hi Darrell,

I installed both Windows update mentioned and reset the transaction log but these files still start appearing after "Windows 7 File recovery" is run. Files in "c:\windows\system32\config\txr" could not be deleted as they are "open in System". I have the two files downloadable here:

CBS.log - http://sdrv.ms/X1IUiu

setupapi.dev.log - http://sdrv.ms/UddRTK

Hello,

Try opening an elevated cmd prompt

then running net stop trustedinstaller, then try deleting the files

I removed the hidden items under USB and the drivers file creation seems to have stopped. Now I have component files creating themselves in threes however as a much less frequent time. Waiting for the driver files to come back as well.

COMPONENTS{746ea10a-54b2-11e2-be85-0022191c2ce9}.TM.blf

COMPONENTS{746ea10a-54b2-11e2-be85-0022191c2ce9}.TMContainer00000000000000000001.regtrans-ms

COMPONENTS{746ea10a-54b2-11e2-be85-0022191c2ce9}.TMContainer00000000000000000002.regtrans-ms

Hello,

Question how many languages and which ones are installed?

Noticed language pack references in both logs, so wanting to check to see if there are similarities around having some of those installed.

Still cannot delete the files in TxR folder. By the way, command says Installer is not started (as in screenshot).

Also, I never installed any language packs etc. Its the default one. Also visible in screenshot.

Cannot attach screenshot here. Find it here: http://sdrv.ms/ZhJ5uo

Hello,

Have you tried booting to Safe Mode and then deleting the files?

You can use MSCONFIG.exe to set the boot option to boot into Safe Mode.

Hello,

I would like to see some nfo files from people encountering this as well.

can you run msinfo32 and save as an nfo file and make them available?

I want to see if there is any commonalities to be found, drivers or running software.

https://docs.google.com/open?id=0B6a-Ncb6RbiUalhldnY1OWk0WFk

|p>

There is my nfo file. I also showed "The Windows Modules Installer service is not started." and will try safe mode when I get a chance.

Also, no language packs installed that I am aware of. US English.

EDIT:

Tried safe mode and was able to delete 3 of the 6 files in TxR folder. I tried disabling various of the few services that were running but was still unable to delete the remaining files.

Tried to delete TxR files in safemode but could only delete 4 out of 7. Those 4 were again created on restarting in normal mode.

NFO file link - http://sdrv.ms/WdfXNJ

As I mentioned in earlier post, restart stops creation of those files temporarily and turning off "Windows 7 File Recovery" starts it. So I ran "Windows 7 File recovery" along with tracking using Process Monitor. I saw that these files were created by MsMpEng service which I understand as Windows Defender. If its any help I have uploaded the log file of Process Monitor. Its available here: http://sdrv.ms/WjpdA0 (First file gets created at 8:20:23pm by MSMpEng)

cixelsyddyslexic, "Windows 7 File Recovery" is in Windows 8. You can do search Settings(Window key+W) in Windows 8 to find it. It is also there in Control Panel ("View by - large icons"). It is same program that was called "Backup and Restore" in Windows 7.

Also, if you haven't changed windows scheduled maintenance time on your machine, it runs at around 3 am which is close to 0326. You could check Event Viewer and Scheduled Tasks history to see what ran around 3.20-3.30am.

Windows 7 File Recovery is not enabled on my machine, and neither is the scheduled maintenance. The only other thing going around that time is my Mozy online backup, which kind of points me in the direction of VSS issues, but I can't find anything solid.

I don't know if these are new or if I just missed them before, but I am getting Ntfs event 134 in the System log: The transaction resource manager on volume \Device\HarddiskVolumeShadowCopy4 encountered an error during recovery.  The resource manager will continue recovery.

and Ntfs event 136: The default transaction resource manager on volume C: encountered an error while starting and its metadata was reset.  The data contains the error code.

The VSS ones appear to be occurring right around the time the file creation is starting, 3:15-3:30AM.

Hello,

Do you have the details of the NTFS event?  Can you post them?

have you run checkdisk on the volume?  That NTFS Event error looks like disk corruption or hardware issues with the disk

Chkdsk comes back clean. Here is the details tab on the latest Ntfs event:

- <System>
  <Provider Name="Ntfs" />
  <EventID Qualifiers="32772">136</EventID>
  <Level>3</Level>
  <Task>2</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2013-01-07T11:19:37.147546200Z" />
  <EventRecordID>4866</EventRecordID>
  <Channel>System</Channel>
  <Computer>ST3GAMMA</Computer>
  <Security />
  </System>
- <EventData>
  <Data />
  <Data>\Device\HarddiskVolumeShadowCopy3</Data>
  <Binary>1C00040002003000020000008800048000000000060019C000000000000000000000000000000000060019C0</Binary>
  </EventData>
  </Event>

 I am having the same disk space problem.  I had no idea what was going on.  I had to delete upwards of 6GB of old music and pictures just to keep up with an ever expanding drive.  Now that I see this thread, I noticed in my TRX directory that I have 81,700 files worth over 40GB all with the word DRIVER, just like these files on this persons computer.  This is insane - my drive is filling up to 40MB of disk space left every day, and I have had to delete tons of data.  Please let me know how to resolve this problem.  I have just deleted these files, whatever they are.

This was a very helpful thread, I was able to free up 40GB of disk space deleting those files, and I could not for the life of me find them myself.  Thank you.

Hello,

We are investigating the issue and are working
on a solution

Hi Darrell,

Any update, or a direction we can also look in ourselves? Or is this an engineering problem at this point?

Darrell, there's another similar thread on the following community site that you might want to review.  Also, I'm a partner and wouldn't mind working with someone there at Microsoft to take a look at my Windows 8 Pro system. 

Windows 8 Pro - C:\Windows\System32 Keeps Growing

I'm getting 3 DRIVER files written to the config folder every 3 minutes.  I've just deleted about 14,000 of the .regtrans-ms files all with the same pattern like this: 

DRIVERS{7867xxxx-6285-11e2-be7d-20cf30e338ab}.TMContainer0000000000000000000n.regtrans-ms

where the xxxx varies and where the "...00n" varies between "...001" and "...002" and which resulted in recovery of about 7GB of space.

Your note made me think of something when you mentioned sizes and counts (7,000,000,000 / 14,000)...

These files are I guess being written as some kind of journalling for registry writes.  Admittedly I haven't found good documentation on just what's being done.

I'm not seeing repeated writes, but I do find 175 .regtrans-ms files on my Windows 8 system when I look, dated back over the past months.  Most are 512KB, with a very few being 5 MB.

Does it REALLY take half a megabyte (or even 5 megabytes sometimes) of data to track one write to the registry?  Generally speaking such a transaction is usually writing as little as one integer into a value under one key whose name is a few dozen characters in length.

The word "bloatware" comes to mind.

Hello,

Sorry I don't have a workaround for this other than deleting the files.  The last version of the file created should not be deleted, all the others can be safely deleted.

Hello,

As I posted before:

We are investigating the issue and are working  on a solution

Hi

Any solutions found on this problem? Btw I found 25k .regtrans-ms files using Treesize, is there anyway to delete them?

I am having the same issue.

I noticed by watching the Resource Monitor that the files are being written by MsMpEng.exe PID 2292 and by System PID 4.

Could this be an issue with Microsoft Antimalware Service?

I think I've fixed the problem on my computer.  I used Process Monitor with filter: Path contains driver.  Whenever a new file was created, I would see registry activity by nvSCPAPISvr.exe.  This process is part of the NVIDIA 3D Vision Driver which I have now uninstalled.  As for deleting the excess files, I ran explorer.exe as Administrator, navigated to C:\Windows\system32\config, and disabled hiding of protected operating system files in Folder Options.  I then searched for drivers*tm*, sorted by modified date, and deleted all but the most recent set of 3.

Here's a programmatic way to clean up if anyone needs (use at your own risk):

string[] files = Directory.GetFiles(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "Sysnative", "config"), "DRIVERS{*}.TM*");
if (files.Length == 0) return;
string keepFilePrefix = Path.GetFileName(files.OrderByDescending(f => new FileInfo(f).CreationTimeUtc).First()).Split('.')[0];
foreach (string file in files) {
    if (Path.GetFileName(file).StartsWith(keepFilePrefix, StringComparison.OrdinalIgnoreCase)) continue;
    File.Delete(file);
}

(Semi) confirmed. I removed the 3d Vision driver from my machine as well, and for the first time I have been able to delete ALL the DRIVERS files (previously there have always been a set of 3 files that were locked and unable to be deleted.).

I'll check later to make sure that this actually fixes the root issue, but this is a great sign!

Yes, I think removing the 3D driver is just treating a symptom.  I am still getting new files occasionally as well, but just a handful a day rather than hundreds.

Yes, I think removing the 3D driver is just treating a symptom.  I am still getting new files occasionally as well, but just a handful a day rather than hundreds.

Same as the others echoing this sentiment, I also have had a major reduction in the creation of these files since removing Nvidia's 3D driver.  I still have a few of these files being created, but nowhere near the amount it was before.

Good job on at least finding out one of the potential issues with this.

We do not have the official solution yet. But disabling the NVIDIA 3D service seems to decrease the creation of those files to acceptable numbers (1-3 set of three files per day). And you can delete all but the latest copies of those driver registry files to recover your lost hard drive space.

the evidence is pretty clear that there is a problem with a driver 

its helpful to post rig specs which makes it easier to see what is up

try disk cleanup under accessories/system tools

Is any1 get the solution?

Yes, the solution was found.  It was, as described in response number 1, something writing excessively to the registry, then found by J.D. Purcell to be specifically the nVidia 3D Vision driver.  Removing that driver resulted in the immediate cessation of creation of literally gigabytes of .regtrans-ms file. 

It will have to be nVidia who fix the root cause inside the driver.

The creation of these files is not new; they are created by Windows 7 as well (I have accumulated about 200MB of them in 4 years use).  What's new is that someone at nVidia screwed up and caused writing of data into the registry far more often than should be normally done.  You should ask this question of nVidia:  Is there a new driver version that solves this problem?

I suggest trying 313.96 beta which is the latest release

Unless you are using a 3D panel for entertainment reasons, remove the driver

reinstall it and use the custom, and drop the 3D support

Is any1 get the solution?

Yes, the solution was found.  It was, as described in response number 1, something writing excessively to the registry, then found by J.D. Purcell to be specifically the nVidia 3D Vision driver.  Removing that driver resulted in the immediate cessation of creation of literally gigabytes of .regtrans-ms file. 

It will have to be nVidia who fix the root cause inside the driver.

Perhaps nVidia fixed the problem already.  What driver version are you running, and how recently did you update it?

Is there a chance Windows Update might have delivered an updated component of the display driver?  Maybe it would be useful to scour the list of Windows Updates installed on your system since you last saw a .regtrans-ms file created for evidence of anything that might have fixed it.  I'm a little surprised that something besides yourself would be cleaning up these files.  No one else has turned up evidence of that kind of activity so far.

There is also a possibility that a condition on your computer may have changed that causes the problem not to recur.  Had you reconfigured anything or made any other changes coincident with the deletion of all those files?

Hello,

This should be fixed in this update and may also clean up the files

2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
http://support.microsoft.com/kb/2795944/EN-US

Check if this update is installed

Hello,

This should be fixed in this update and may also clean up the files

2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
http://support.microsoft.com/kb/2795944/EN-US

Check if this update is installed

Windows 8 has been trying to install KB2795944 since it came out on Windows Update, I just noticed it now that I read the post. Windows 8 hides everything from power users. KB2751352 is also failing.

ERROR Code 80073712

TRY 1: I ran the below suggestion, and it said my component store has been corrupted. Makes sense since I have deleted 60GB of files that create themselves every minute.

DISM.exe /Online /Cleanup-image /Scanhealth

DISM.exe /Online /Cleanup-image /Restorehealth

Still corrupted.

TRY 2: I ran 'Tap or click to open the Windows Update troubleshooter'. It said it fixed the issue however all it did was obliterate my history. Error still occurs.

Help.

Is there a chance Windows Update might have delivered an updated component of the display driver?  Maybe it would be useful to scour the list of Windows Updates installed on your system since you last saw a .regtrans-ms file created for evidence of anything that might have fixed it.  I'm a little surprised that something besides yourself would be cleaning up these files.  No one else has turned up evidence of that kind of activity so far.

There is also a possibility that a condition on your computer may have changed that causes the problem not to recur.  Had you reconfigured anything or made any other changes coincident with the deletion of all those files?

No, and no.

Windows update do not deliver updates to Nvidia drivers unless you have no driver installed at all.

No other reconfiguration and the KB2795944 update is not installed either.

I have 8 in a virtual machine, clean, nothing outside of updates, same for xp and up

all work fine there

now NVIDIA drivers add to the C:\NVIDIA folder so that will slowly eat storage but with 3 TB disks readily available and now 4 TB disks I consider that to be trivial

AMD does the same thing with their Radeon drivers

windows also creates restore points that consume space, every update does it

if your storage is tight, disk cleanup is available that can get rid of a lot of accumulated rubbish and recover sometimes GBs of space

now I do watch the host disk for the VMs and it does slowly shrink as expected but I figure I will be fine until year 3400 or so based on current consumption

check your entire software stack, its the only way you can be sure

my appwiz tool on my IT site is a good step towards that goal, post results here

Hello,

This should be fixed in this update and may also clean up the files

2795944 Windows 8 and Windows Server 2012 cumulative update: February 2013
http://support.microsoft.com/kb/2795944/EN-US

Check if this update is installed

if an update fails, reboot and try it again

if an update fails, reboot and try it again

48 GB is far too small in my opinion, you should use one with 10x that capacity.

Darrell,

this exact issue (C:\Windows\System32\config filled up with 18GB worth of "DRIVERSxxxxxxxx" files) actually occurred after running the Windows Update on February the 13th 2013.

The exact same issue occurred on my friends computer the same day, and I confirmed with him now that he has the same issue with his config folder.

The 2795944 fix you mentioned as a fix was among those being installed during the 13th on both our systems.

Me and my friend both have NVIDIA gfx cards and I'm now looking into disabling the 3D driver and cleaning up the files until the final solution is in place.

You guys are my hero! I had accumulated over 20 gigs of these "DRIVER" files in the config folder... 

I have a 74 gig raptor drive for main OS with two 1TB disks for storage... I had literally installed everything from this computer except for Office and could not figure out where my disk space was going to.

The DRIVER files moved, and I have reclaimed over 20 gigs of space.

Woohoo!

get a larger disk, these days disks are in the TB range, disks like your raptor were around 10 years ago. 

Darrell,

Please note the problem continues to exist, even in safe mode (basic drivers only) those registry files are being created, clearly showing the problem is coming from inside Windows 8 and not other drivers.

Please note I am still unable to install KB2795944 manually and the Windows Update has never presented it as an option.

Please advise.

Thank you for your support!

P.S. Vegan, please stop spamming the thread and allow the Microsoft teams to figure out this internal operating system problem.

Hello

How is the update failing?  What errors are you getting?

Do you have the Windowsupdate.log and cbs.log available for download?

Victor as I understand it, Microsoft fixed the issue but you like me I cannot install the KB that resolves it, I have another thread going on this same issue. Based on the response, Windows 8 is toast because of this driver issue and now I need to do a clean install. I have not done it yet, but when I do it will be installed as Windows 7 not garbage Windows 8 for grandma.

http://social.technet.microsoft.com/Forums/en-US/w8itprogeneral/thread/69173ae6-249f-4463-ae4c-d644d2a132ab/

I have been investigating the issue of growing disk consumption.

I have all versions of desktop and server Windows in virtual machines and so far all have been well behaved

this suggests a 3rd party program is consuming storage.

Because its not easily reproducible, its likely going to have to use remote desktop to analyse the rig more closely to see what it wrong.

Excess disk use is also a problem for some using Windows Server so its clear that the problem is a software problem as the virtual machines are static (growth is slow driven by Windows updates)

Wow, thank you for this thread! I wasted so much time trying to clear up space not realizing the real issue.  To give back, I will post a Power Shell script I created to delete the files.  Open Power Shell with 'Run As Administrator' rights. Use it at your own risk.

$SysConfigFiles = (Get-ChildItem -Path "C:\windows\System32\config" -Filter * -Hidden)
$SysConfigFiles | Measure-Object # All files in directory
$FilesToDelete = $SysConfigFiles | Where-Object {$_.Name -like "DRIVERS{*"}
$FilesToDelete | Measure-Object # Only Files to delete
$FilesToDelete | Remove-Item -Force