A folder at C:ProgramDataZXBB158BA0B keeps returning and gradually grows to roughly 63 GB. It contains several numbered subdirectories, each with hundreds or thousands of extensionless files named 0, 1, 2, and so on. Most files are tiny, but some are around 10.6 GB each.
I managed to remove the folder once with EMCO Unlock IT, but it eventually reappeared and started growing again. The same tool can no longer delete it. I've also tried running the deletion as an administrator, taking ownership, checking permissions, and investigating related services.
The Web Threat Defense Service (webthreatdefsvc) is running, so I suspect the folder may belong to a security product, possibly Wolf Security. The folder permissions appear fairly standard: SYSTEM and Administrators have full control, while Users have read, execute, and write access.
What process or application creates this folder? Why does it keep coming back, and is it safe to remove? I'm looking for a permanent way to stop it from consuming disk space without damaging Windows or my security software.
3 Answers
Check the logs, alerts, and notifications for the installed Wolf security components, especially anything related to Web Threat Defense. The service named webthreatdefsvc may be maintaining a cache, quarantine area, or scanning database there. Before deleting anything, confirm the folder's file types and ownership and check whether the security product documents that location. If it is an active cache, removing it may only make it return or could interfere with protection.
Use Microsoft Sysinternals Process Monitor to watch that path and identify which process is creating or writing to it. Set a filter for C:ProgramDataZXBB158BA0B, then let the capture run until the folder changes. The process name, command line, and service information should point to the application responsible. This is more reliable than repeatedly trying to delete the folder.
That approach is worth trying. Process Monitor has also been useful for tracking down files that were being recreated by unwanted software, especially when a normal backup or deletion kept failing.
Don't make the folder read-only or delete it blindly while the associated security service is running. First determine the owning program through Process Monitor, the service configuration, or the security product's own logs. Once confirmed, look for an approved cache-cleanup option, update, repair, or configuration setting that limits retention. If the folder is tied to a security product and is using tens of gigabytes, its vendor support or a reinstall of that component may be the safest permanent fix.
The permissions look like ordinary Windows permissions, with SYSTEM and Administrators having full control. The contents are mostly extensionless, numerically named files arranged in numbered directories, so identifying the process that writes them is probably more useful than changing permissions.