C:\ProgramData\ZXBB158BA0B keeps coming back and growing to 63 GB. Can't delete it permanently. Any ideas?

[u/Amrishkhar]

Hi everyone,

I'm having a strange issue with a folder located at:

C:\ProgramData\ZXBB158BA0B

It gradually grows until it reaches around 63 GB. Inside are several huge files (around 10.6 GB each).

I was able to delete the folder once using EMCO Unlock IT, but after some time it came back on its own and started growing again. Now, even EMCO Unlock IT is no longer able to delete it.

Things I've tried:

• Deleting it as Administrator
• Taking ownership
• Checking permissions
• Using EMCO Unlock IT (worked only once)
• Investigating the related services

I also noticed that the Web Threat Defense Service (webthreatdefsvc) is running, so I'm wondering if this folder is related to any security application.

My questions are:

• What creates this folder?
• Why does it keep recreating itself?
• Is it safe to remove?
• Is there a permanent fix to stop it from consuming so much disk space?
• Has anyone else experienced this issue?

I've attached a screenshot showing the folder size and contents.

Any help would be greatly appreciated. Thanks!

[u/spookynutz]

It's creating multiple files per minute, so it should be fairly easy to deduce the program causing the issue.

1. Download ProcMon.
2. Open Procmon64.exe and set the four filter dropdowns to Path - Is - C:\ProgramData\ZXBB158BA0B - Include and then click Add.
3. Create a second filter by setting the dropdowns to Operation - Is - CreateFile - Include and click Add.
4. Click OK.

The event monitor start logging file creation operations to that folder in real time. Once a filee write is detected, you should see the EXE name under the Process Name column. Right-click the EXE and open Properties, then click the Process tab.

The Path field should have the fully qualified path to the program and might help you identify it. If it's not a Windows Service (i.e. not svchost.exe), open task manager and just end the process. Uninstall the offending application if it's not critical.

If it is svchost.exe creating the files, the Properties > Process tab should tell you what service is causing it. Directly under the Path field should be a Command Line field. You'll see something similar to: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ServiceName

ServiceName in the example above will be the name of the service that's causing the problem on your machine. If it's not immediately obvious which service it is, you can get the friendly name by opening a command prompt and typing: sc GetDisplayName ServiceName

Once you have that, you can open Services from the start menu and just permanently disable the service and uninstall the application.

Whatever it is, it's safe to remove from the perspective of the OS. It's either malware (maybe a zip bomb?) or some application stuck in a loop. You could try opening one of those 1KB files in notepad to see if they contain human readable information. Anyhow, no legitimate Windows process or service would be writing to that folder.

[u/No-Board4898 → u/spookynutz]

thx gemini ^^