I will infer that the last sentence means "How do I
kill find the process which is creating those files [so I can kill it]?"
Let's assume the permissions of the system's /, /etc and /etc/shadow directories and files are normal, something like:
# ls -ld /
drwxr-xr-x 31 root root 1024 Sep 30 13:26 /
# ls -ld /etc
drwxr-xr-x 76 root sys 215 Oct 28 23:05 /etc
# ls -al /etc/shadow
-r-------- 1 root sys 294 Oct 15 16:09 /etc/shadow
I.e. only root can create files in /etc and can read /etc/shadow, then the process creating the files has to have root privileges in order to read the /etc/shadow file and create the copies (a cross-check on this is whether the copies of /etc/shadow are owned by root).
This is not normal behavior in a Solaris system. My first wild-ass guess (not even a SWAG), based on the regularity of the occurrence, is that there is a root crontab entry or user crontab entry with elevated privileges doing this for some odd reason. Maybe some ad hoc password synchronization. If so, killing it is just commenting out the crontab entry (assuming that you still want to do it after finding out more). My second guess is that this is a zone and the crontab entry doing this is in the global zone. In which case you are, and should be, SOL. My third suggestion is to monitor the /etc directory with dtrace and attempt to catch the process in the act. How to do that is another question.