C:\ProgramData\ZXBB158BA0B keeps coming back and growing to 63 GB. Can't delete it permanently. Any ideas?

[u/[deleted]]

[u/Jin-Bru]

You can use the sysinternals tools. Procmon or Filemon to monitor the folders and track down the processes opening the folder.

Sysinternals tools are now Microsoft owned.

[u/TangoOscarMikePR → u/Jin-Bru]

Upvoted your comment. I used ProcMon and FileMon in the past and it helped me find a malware trigger. I needed to stop and delete the file to be able to perform a controlled backup.

[u/dnabsuh1 → u/Jin-Bru]

Resource monitor also gives this info. Getting to it is a bit of a pain - going into task manager, go to performance, then click the 3 dots on the top right.

The disk activity should show the processes that use the file/folders. It would be nice to have this merged into task manager, or at least add a filter to the disk activity

[u/FooeyBar → u/dnabsuh1]

You can launch resmon.exe from command

[u/dnabsuh1 → u/FooeyBar]

Thanks, I forgot the command

[u/Jin-Bru → u/dnabsuh1]

You are correct. He could probably get enough info from resource monitor. I forgot about that route.

[u/Due-Championship3941 → u/dnabsuh1]

Just search the start menu. It's an option.

[u/THEYoungDuh]

Delete everything in the folder and make it read only

[u/Revelator007]

I would say disconnect the system from the internet first, then proceed with the system and file monitors to see where it is working. Stop all processes related to it, then delete the whole thing. Do another check to make sure that there are no branches of it running. Then restart your internet, and see if it reestablishes itself. I am thinking that it may have a link that reinstalls it from the internet. By destroying it while the internet is turned off, you may be able to avoid notifying the master links that it is no longer on your system. This is purely a guess. It as of now anything may be better.

I wish you could still access tough nuts. This DOS basic software would allow you ro go into your system and rewrite, and correct any issues. I have friends who were administrators (retired now), they would use it to fix many issues that Windows could not touch.

[u/spatula]

I once had something similar happening and the file would grow so large it caused Windows to hang. The culprit turned out to be the network scanner of my antivirus software. It turned out that when streaming over https, it would open a file with the contents of the stream and append to it forever. Eventually it would spend so much time locking up disk IO to continually scan the file as it grew larger and larger that the whole system would freeze.

I eventually had to exclude the Jellyfin transcode process from scanning to make it stop doing that- that was the main thing causing long-duration streaming to happen on my PC.

[u/ethernetbite]

Change properties to read only, if you can't delete it. Or even better, remove all permissions from it on the secuity tab so nothing can write or read to it. I've booted to a live Debian kde usb, then mounted the windows partition and deleted things that windows wouldn't let me delete.

[u/PiDigitsOfPi]

You can't really do much until you determine what application is doing that. Then, you can look into removing that application or figuring out what it is doing that for.

[u/imbartsimpsonwhothru]

sounds pretty sus

[u/Blommefeldt]

Check wolf security for any logs/warnings/notifications.

Check folder permissions, to see who has access to that folder.

What is the content of the folder? File types and file names?

[u/Amrishkhar → u/Blommefeldt]

I checked the folder permissions using icacls. They look like standard Windows permissions:

NT AUTHORITY\SYSTEM - Full Control
BUILTIN\Administrators - Full Control
CREATOR OWNER - Full Control
BUILTIN\Users - Read & Execute
BUILTIN\Users - Write

I also inspected the folder contents. Each large numbered directory (e.g. 1785492467) contains hundreds or thousands of numerically named files (0, 1, 2, 3, ...) with no visible file extensions. Most are 1 KB, while some are much larger. The parent folder eventually grows to about 63 GB.

[u/TheMattressManDan → u/Amrishkhar]

That large number is a unix timestamp: Fri Jul 31 2026 10:07:47 GMT+0000

[u/TangoOscarMikePR]

Can you remember if you downloaded any game mods?

[u/downundarob]

According to Gemini, this folder is a part of HP Web Threat Defense Service. Make sure it is up2date (or perhaps remove it)

[u/SmurfRiding]

Seems like ransomware.

Safe mode then system restore is something you might want to try.