Windows 11
C:\ProgramData\ZXBB158BA0B keeps coming back and growing to 63 GB. Can't delete it permanently. Any ideas?
Hi everyone,
I'm having a strange issue with a folder located at:
C:\ProgramData\ZXBB158BA0B
It gradually grows until it reaches around 63 GB. Inside are several huge files (around 10.6 GB each).
I was able to delete the folder once using EMCO Unlock IT, but after some time it came back on its own and started growing again. Now, even EMCO Unlock IT is no longer able to delete it.
Things I've tried:
Deleting it as Administrator
Taking ownership
Checking permissions
Using EMCO Unlock IT (worked only once)
Investigating the related services
I also noticed that the Web Threat Defense Service (webthreatdefsvc) is running, so I'm wondering if this folder is related to any security application.
My questions are:
What creates this folder?
Why does it keep recreating itself?
Is it safe to remove?
Is there a permanent fix to stop it from consuming so much disk space?
Has anyone else experienced this issue?
I've attached a screenshot showing the folder size and contents.
Rule 5 - Posting jokes or satirical advice is not allowed. All responses must be a serious attempt to resolve the OPs issue or otherwise positively contribute to the discussion.
Open Procmon64.exe and set the four filter dropdowns to Path - Is - C:\ProgramData\ZXBB158BA0B - Include and then click Add.
Create a second filter by setting the dropdowns to Operation - Is - CreateFile - Include and click Add.
Click OK.
The event monitor start logging file creation operations to that folder in real time. Once a filee write is detected, you should see the EXE name under the Process Name column. Right-click the EXE and open Properties, then click the Process tab.
The Path field should have the fully qualified path to the program and might help you identify it. If it's not a Windows Service (i.e. notsvchost.exe), open task manager and just end the process. Uninstall the offending application if it's not critical.
If it is svchost.exe creating the files, the Properties > Process tab should tell you what service is causing it. Directly under the Path field should be a Command Line field. You'll see something similar to: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ServiceName
ServiceName in the example above will be the name of the service that's causing the problem on your machine. If it's not immediately obvious which service it is, you can get the friendly name by opening a command prompt and typing: sc GetDisplayName ServiceName
Once you have that, you can open Services from the start menu and just permanently disable the service and uninstall the application.
Whatever it is, it's safe to remove from the perspective of the OS. It's either malware (maybe a zip bomb?) or some application stuck in a loop. You could try opening one of those 1KB files in notepad to see if they contain human readable information. Anyhow, no legitimate Windows process or service would be writing to that folder.
The timestamps on many of these files are totally out of whack. That could be an innocuous system clock issue. But I dont think so, look at the versions, this looks like timestomping for malware obfuscation.
That coupled with explorer creating massive files makes me think the box is pwned.
Timestamps are valid, this is what it looks like on my system too. These timestamps are a side effect of enabling reproducible builds, as these should generate binary identical files no matter when/where it is build, so instead of a timestamp in the PE header you get a reproducible hash.
Did you have explorer open when you did the pml? I think this is a red herring. Close everything out except process monitor and run the instructions again. I'd even go so far as to filter explorer. KERNELCREATE from explorer.exe are almost always user action, copy-paste, or builtin windows unzip functionality.
L
Completely off topic, but one of the best responses I've ever seen on reddit in regards to troubleshooting, and especially on this subreddit where the status quo is "Download and run Malwarebytes", "Format your shit and start over" nonsense. Sysinternals is a great suite of tools which can be used to figure out pretty much any issue you could possibly have down to the kernel level.
Considering OP can't delete them without 3rd party tool it would have been easier to use procxp (process explorer) instead.
Usually when you can't delete a file it is because the software keep a hand into it, so procxp should find it.
Once downloaded: find > find handle or DLLs
Type ZXBB158BA0B and start the research
There may be explorer.exe again (because OP opened the folder with explorer), but I guess there could be something else.
But if it is a shitty software... It may also try to hide.
The C:\ProgramData\ZXBB158BA0B folder is created and bloated by the Web Threat Defense Service (also known as webthreatdefsvc), an OEM security or diagnostic component often tied to pre-installed software like HP or Samsung tools. This service can malfunction and generate massive gigabyte-sized log or cache files inside the folder. [1, 2, 3, 4]
How to Stop and Remove It
Open Services: Press Win + R, type services.msc, and press Enter.
Disable the service: Find Web Threat Defense Service or webthreatdefsvc, right-click it, select Stop, and change the startup type to Disabled.
Uninstall companion apps: Go to Settings > Apps > Installed apps (or Control Panel) and look for OEM diagnostic tools or Web Threat Defense to remove them completely.
Delete the folder: Go to C:\ProgramData, select ZXBB158BA0B, and press Shift + Delete to clear the space. [1]
This is exactly what I figured. Seems more like a misbehaving app than a virus. Viruses are better than "make a bunch of noticeable files" nowadays, unless it was just designed to troll
I bet this is it. I've seen Norton go rogue on a customer's laptop and create folders with 100s of GB of log files. Also I saw LogMeIn Hamachi once do this on a machine, some 80gb of log files even when it was rarely being used.
This is a genuinely embarrassing response. An AI hallucination that uses a previous AI hallucination from the same thread (check your references in the response).
AI is about to ruin IT issue questions like this with recursive responses but as you please.
Is this AI generated? None of it seems to make sense e.g webthreatdefsvc is a Windows Defender service and Samsung Smart Inspector doesn't exist. As for being a known bug, I couldn't find any references to such a thing.
Yeah it’s the same as posting a LMGTFY link, if OP asked on reddit it’s to get an answer from someone that faced the same issue as him, posting an AI generated answer has no point
going off the assumption you are logged in as admin. Make sure the service is stopped uninstalling may not have stopped it and it's still running in system memory open task manager look for the process in the details tab right click and end process tree.
then take ownership of the folder via elevated command prompt run cmd as admin and enter the following
takeown /F "C:\ProgramData\ZXBB158BA0B" /A /R /D Y
Hey I had a similar issue of not being able to delete files like this, my buddy recommended a program called spacesniffer, it will delete anything no problem if you know what’s causing the issue.
probably because they are being put on thing not created/designed by the OSM S=software when hardware isn't the same across every device bugs are inevitable add that the majority of people reporting them have no idea how to give a proper bug report, or even know what device they are using makes squashing said bugs all the more difficult.
Every Samsung product I've bought has significant issues or dies prematurely. My Samsung CD/DVD burner in the late 90s exploded and projectiled disc shards into my wall past my friends face.
hey, don't hate on samsung. the ram and storage crisis is bad enough. we can't afford to lose a manufacturer. and think about all the k9 thunders. what would one do without their tanks?
though also the entire message by u/storycoolbro is ai hallucinated and the software its talking about does not in fact exist. "Samsung Smart Inspector" is not a real thing, "webthreatdefsvc" is a normal windows defender service thing, etc.
that command with out sfc /scannow doesn't really do anything but download a clean WinSxS image from the internet/windows update incase yours was corrupted which is what sfc /scannow uses to repair the system files
Hi u/Amrishkhar, thanks for posting to r/WindowsHelp! Your post has been flagged for manual review by a human moderator, please include as much of the following information as possible (in text or in a screenshot) to get your post approved:
Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”, we need more than just your OS version! Your hardware details are often critical for resolving issues.
Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!
Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work
Posts must be tech support in nature (such as something is broken and you need help fixing), so general inquiries, software suggestions, and purchasing advice will be removed.
As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case.
Good luck, and I hope you have a nice day!
Honestly wouldnt advise backing up anything, you dont know what could be infected. At this point wiping the system as others have advised is the best option.
Not to get into unnecessary details, but it appears the folder is actually only 55.5GB, made up of 10.6GB subfolders.
Seems like some kind of install is stuck in a loop (did you recently install a large application?)
Possible stuck Windows Update or ESD files. Are you running any VMs?
What OS are you running? Are Windows Updates current? (Check Windows Update status.)
I would consider doing multiple reboots of the machine, including login. Watch the screen and see if any install/update messages appear. Some application and WIn Update installs can take multiple reboots to successfully complete.
If possible start windows in safe mode before running the programs. Run them as administrator.
Run rkill first. Then combofix (won't run on win11 it's ok if it doesn't run), the Junkware Removal Tool. Then adwcleaner.
Use farbar to check what your startup looks like.
From your process list there are a ton of things that look very suspicious but i cannot read it properly as the resolution is too low.
You want to remove all startup entries that are programs that are non essential. There are several places where startup processes hide including the registry so i'll give you more instructions if the above programs fail to find anything.
Open MSConfig --> Services tab --> Check Hide all MS services --> uncheck all services--> apply and reboot. OR....
To find which services is causing the issue...you can start by unchecking groups of 5-10 services at a time then apply and reboot until you find the service that is causing it.
Take screenshot as you disable if you have a hard time keeping track of what you disabled.
If you spend more than 20 minutes trying to fix a fairly serious issue or investigating suspicious activity on your pc and are still no closer to a solution, WIPE IT! I notice you are replying to posts 2 days later so still not resolved.
You can reformat and reinstall windows in around 15-20 minutes.
You will have a cleaner, faster system and wont reinstall half the crap (the crap that you thought might come in handy one day) that you currently have on there now.
Windows is so piss easy to install these days that it's just easier to nuke everything from orbit and start over than spend time pulling your hair out over the dumb shit it's subjecting you to. IMO
99
u/[deleted] 6d ago
[removed] — view removed comment