Not sure. What are the extensions of the files?

One of the files  is named 0DD813687F70489FBCE09CC5FB4E93C9_1.tmp
All have the extension .tmp and the hex value changes. The _1 is always on the end.
The hex value is 32 digits so I would speculate it is an MD5 hash of some kind…

Oh, and all the files are created around 1am.

If it is a hash, it doesn’t match the contents of the file – just created a hsh of one of them in many different formats.

Enumwppacks gives me the following installed extras but nothing looks like it should be creating these files…

collutions web  part - cpageviewer_collutions, inc..cab, http://sharepoint/
microsoft.office.dataparts.cab/1033, http://sharepoint/
microsoft.sharepoint.solutions.greatplains.cab/1033, http://sharepoint/
microsoft.sharepoint.webparts.quickquote.cab/1033, http://sharepoint/
nintex.smartlibrary.webcontrols.cab, http://sharepoint/
nintex.smartlibrary.webparts.cab, http://sharepoint/
rswebparts.cab, http://sharepoint/
sitenavigator.cab, http://sharepoint/
smilinggoat.feedreader.cab, http://sharepoint/
syndication generator for windows sharepoint services v2.0_bluedoglimited.com.cab, http://sharepoint/

(yeah – I know http://sharepoint isn’t exactly innovative as a name!)

Apparently, they might be made by the indexer…

msmvps.com/.../72196.aspx

some pre – sp2 issue.

Now I need to find out what SP we are running…

I would shoot this question off to one of the FrontPage MVPs and see if they can help you. Sounds system generated to me.

Now there you go, doing research and finding answers!