You are running windows I assume?
If so, you have to change your session save path. Check your c:\windows\php.ini for:
session.save.path = /tmp
/tmp is fine for a unix box, but for a Windows machine you should create a directory, and then use this new directory for your sessions. Some people use c:\php\sessions, others use c:\sessions, etc.
The main thing is that I would make sure that the directory is not accessible through the web. Meaning, make sure it is not within your htdocs (assuming you are using apache), or document root folder. That is why C:\php\sessions is handy. Your server can access the files, but joe schmoe on the web can't access others session info through a url...