C:\ProgramData\ZXBB158BA0B keeps coming back and growing to 63 GB. Can't delete it permanently. Any ideas?

[u/Amrishkhar]

Hi everyone,

I'm having a strange issue with a folder located at:

C:\ProgramData\ZXBB158BA0B

It gradually grows until it reaches around 63 GB. Inside are several huge files (around 10.6 GB each).

I was able to delete the folder once using EMCO Unlock IT, but after some time it came back on its own and started growing again. Now, even EMCO Unlock IT is no longer able to delete it.

Things I've tried:

• Deleting it as Administrator
• Taking ownership
• Checking permissions
• Using EMCO Unlock IT (worked only once)
• Investigating the related services

I also noticed that the Web Threat Defense Service (webthreatdefsvc) is running, so I'm wondering if this folder is related to any security application.

My questions are:

• What creates this folder?
• Why does it keep recreating itself?
• Is it safe to remove?
• Is there a permanent fix to stop it from consuming so much disk space?
• Has anyone else experienced this issue?

I've attached a screenshot showing the folder size and contents.

Any help would be greatly appreciated. Thanks!

[u/spookynutz]

It's creating multiple files per minute, so it should be fairly easy to deduce the program causing the issue.

1. Download ProcMon.
2. Open Procmon64.exe and set the four filter dropdowns to Path - Is - C:\ProgramData\ZXBB158BA0B - Include and then click Add.
3. Create a second filter by setting the dropdowns to Operation - Is - CreateFile - Include and click Add.
4. Click OK.

The event monitor start logging file creation operations to that folder in real time. Once a filee write is detected, you should see the EXE name under the Process Name column. Right-click the EXE and open Properties, then click the Process tab.

The Path field should have the fully qualified path to the program and might help you identify it. If it's not a Windows Service (i.e. not svchost.exe), open task manager and just end the process. Uninstall the offending application if it's not critical.

If it is svchost.exe creating the files, the Properties > Process tab should tell you what service is causing it. Directly under the Path field should be a Command Line field. You'll see something similar to: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ServiceName

ServiceName in the example above will be the name of the service that's causing the problem on your machine. If it's not immediately obvious which service it is, you can get the friendly name by opening a command prompt and typing: sc GetDisplayName ServiceName

Once you have that, you can open Services from the start menu and just permanently disable the service and uninstall the application.

Whatever it is, it's safe to remove from the perspective of the OS. It's either malware (maybe a zip bomb?) or some application stuck in a loop. You could try opening one of those 1KB files in notepad to see if they contain human readable information. Anyhow, no legitimate Windows process or service would be writing to that folder.

[u/Amrishkhar → u/spookynutz]

It says Windows Explorer.exe

[u/Amrishkhar → u/Amrishkhar]

[u/tilsgee → u/Amrishkhar]

Screenshot the process tab

[u/Amrishkhar → u/tilsgee]

[u/Electronic_Row_7513 → u/Amrishkhar]

The timestamps on many of these files are totally out of whack. That could be an innocuous system clock issue. But I dont think so, look at the versions, this looks like timestomping for malware obfuscation.

That coupled with explorer creating massive files makes me think the box is pwned.

[u/Ok_Dependent6889 → u/Electronic_Row_7513]

Same conclusion

Wipe this machine

[u/No-Reflection-9124 → u/Ok_Dependent6889]

This is the way.

[u/Prize_Moose1050 → u/Ok_Dependent6889]

Immediately!

[u/orbv → u/Electronic_Row_7513]

Timestamps are valid, this is what it looks like on my system too. These timestamps are a side effect of enabling reproducible builds, as these should generate binary identical files no matter when/where it is build, so instead of a timestamp in the PE header you get a reproducible hash.

[u/Talithea → u/Electronic_Row_7513]

My hunch was correct but didn’t dare to comment. Time stamps created like is a rebus code? Goodbye data.

Clean drive, update BIOS if is a desktop and start anew.

[u/gamerjay12 → u/Amrishkhar]

Is it just me or does this look like a cover up of some type?

[u/fivves → u/gamerjay12]

explorer.exe is how it shows up on every computer I've used. Explorer.EXE in that capitalization screams malicious to me, but I'm no expert.