A folder at C:ProgramDataZXBB158BA0B keeps returning and gradually grows to roughly 63 GB. It contains several very large files—around 10.6 GB each—as well as numbered directories containing many extensionless files. Most of those files are about 1 KB, though some are much larger. I managed to remove the folder once with EMCO Unlock IT, but it later reappeared and started expanding again. The same tool can no longer delete it.
I have tried deleting it as an administrator, taking ownership, checking permissions, using EMCO Unlock IT, and investigating related services. The Web Threat Defense Service (webthreatdefsvc) is running, so I am wondering whether the folder belongs to a security product such as Wolf Security.
What process or application creates this folder? Why does it keep coming back, is it safe to remove, and what is the best permanent way to stop it from consuming disk space?
2 Answers
Use Microsoft Sysinternals Process Monitor to watch that path and identify which process creates or writes to it. Set a path filter for C:ProgramDataZXBB158BA0B, clear the existing events, then let the folder begin changing again. The process name, executable path, and service information should reveal the owner. File activity tools can also help, but Process Monitor is the better starting point for this kind of investigation.
Check the logs, warnings, and notifications for the installed security software, especially anything associated with Wolf Security or the Web Threat Defense Service. The folder permissions you listed look broadly like normal Windows permissions, so permissions alone probably are not the cause. The file names and extensionless numbered files also suggest an application-managed cache, quarantine area, or temporary data store rather than an ordinary user folder.
Before deleting it, identify the owning process and check whether the security product has a cache, logging, quarantine, or disk-usage setting. Removing a folder that an active security service owns could make it immediately return or interfere with protection.
That approach has helped me track down malware and other background processes before. Finding the process that opens or creates the files is more reliable than repeatedly trying to delete the folder.