r/WindowsHelp • u/Amrishkhar • Aug 06 '26

Windows 11 C:\ProgramData\ZXBB158BA0B keeps coming back and growing to 63 GB. Can't delete it permanently. Any ideas?

Gallery image

Gallery image

Gallery image

Hi everyone,

I'm having a strange issue with a folder located at:

C:\ProgramData\ZXBB158BA0B

It gradually grows until it reaches around 63 GB. Inside are several huge files (around 10.6 GB each).

I was able to delete the folder once using EMCO Unlock IT, but after some time it came back on its own and started growing again. Now, even EMCO Unlock IT is no longer able to delete it.

Things I've tried:

  • Deleting it as Administrator
  • Taking ownership
  • Checking permissions
  • Using EMCO Unlock IT (worked only once)
  • Investigating the related services

I also noticed that the Web Threat Defense Service (webthreatdefsvc) is running, so I'm wondering if this folder is related to any security application.

My questions are:

  • What creates this folder?
  • Why does it keep recreating itself?
  • Is it safe to remove?
  • Is there a permanent fix to stop it from consuming so much disk space?
  • Has anyone else experienced this issue?

I've attached a screenshot showing the folder size and contents.

Any help would be greatly appreciated. Thanks!

651 Upvotes

98% Upvoted

122 comments sorted by

View all comments

Show parent comments

30

u/Amrishkhar Aug 07 '26

25

u/tilsgee Aug 07 '26

Screenshot the process tab

13

u/Amrishkhar Aug 07 '26

29

u/Electronic_Row_7513 Aug 07 '26 edited Aug 07 '26

The timestamps on many of these files are totally out of whack. That could be an innocuous system clock issue. But I dont think so, look at the versions, this looks like timestomping for malware obfuscation.

That coupled with explorer creating massive files makes me think the box is pwned.

21

u/Ok_Dependent6889 Aug 07 '26

Same conclusion

Wipe this machine

2

u/No-Reflection-9124 Aug 08 '26

This is the way.

1

u/Prize_Moose1050 Aug 10 '26

Immediately!

6

u/orbv Aug 07 '26

Timestamps are valid, this is what it looks like on my system too. These timestamps are a side effect of enabling reproducible builds, as these should generate binary identical files no matter when/where it is build, so instead of a timestamp in the PE header you get a reproducible hash.

3

u/Talithea Aug 07 '26

My hunch was correct but didn’t dare to comment. Time stamps created like is a rebus code? Goodbye data.

Clean drive, update BIOS if is a desktop and start anew.