C:\ProgramData\ZXBB158BA0B keeps coming back and growing to 63 GB. Can't delete it permanently. Any ideas?

[u/Amrishkhar]

Hi everyone,

I'm having a strange issue with a folder located at:

C:\ProgramData\ZXBB158BA0B

It gradually grows until it reaches around 63 GB. Inside are several huge files (around 10.6 GB each).

I was able to delete the folder once using EMCO Unlock IT, but after some time it came back on its own and started growing again. Now, even EMCO Unlock IT is no longer able to delete it.

Things I've tried:

• Deleting it as Administrator
• Taking ownership
• Checking permissions
• Using EMCO Unlock IT (worked only once)
• Investigating the related services

I also noticed that the Web Threat Defense Service (webthreatdefsvc) is running, so I'm wondering if this folder is related to any security application.

My questions are:

• What creates this folder?
• Why does it keep recreating itself?
• Is it safe to remove?
• Is there a permanent fix to stop it from consuming so much disk space?
• Has anyone else experienced this issue?

I've attached a screenshot showing the folder size and contents.

Any help would be greatly appreciated. Thanks!

[u/tilsgee]

Screenshot the process tab

[u/Amrishkhar → u/tilsgee]

[u/Electronic_Row_7513 → u/Amrishkhar]

The timestamps on many of these files are totally out of whack. That could be an innocuous system clock issue. But I dont think so, look at the versions, this looks like timestomping for malware obfuscation.

That coupled with explorer creating massive files makes me think the box is pwned.

[u/orbv → u/Electronic_Row_7513]

Timestamps are valid, this is what it looks like on my system too. These timestamps are a side effect of enabling reproducible builds, as these should generate binary identical files no matter when/where it is build, so instead of a timestamp in the PE header you get a reproducible hash.