none
GUID-named files in root directory

    Question

  • A couple of days ago on one of our users' Win7 (x64 german) machines, GUID-named files with a size of 30kb started to appear in c:\ root directory.

    We can't find any reference to GUID elsewhere on the system. The content of the files is not in a really readable format. Seems to be something compiled.

    Any idea where they might come from?

    Friday, March 9, 2012 8:43 AM

Answers

  • Sorry for not answering for a while, but the Supporter didn't get back to me and was on holiday.

    It seems the Problem was fixed by one of the Patches of the March Patchday. Still no idea where it originated and why it only happened on some Computers and on some more heavily than on others.

    Thanks for all the input. Might help me with other cases in the future.

    • Marked as answer by F.Spisla Tuesday, April 10, 2012 6:06 AM
    Tuesday, April 10, 2012 6:06 AM

All replies

  • Most likely Windows Update GUIDs that did not get removed.
    Friday, March 9, 2012 9:26 AM
  • Hi,

    Regarding the issue, I suggest that take a screen shot for this folder and post it here. However, you could try to check whether this is using by any process in Resource Monitor.

    Hope that helps


    William Tan

    TechNet Community Support

    Thursday, March 15, 2012 5:29 AM
  • I will try and have a look at the machine with Resource Monitor, but for the moment here is a screen shot of parts of c:\

    Friday, March 16, 2012 8:18 AM
  • If you open regedit and search for one of these GUIDs. What do you find?
    Friday, March 16, 2012 9:09 AM
  • If you open regedit and search for one of these GUIDs. What do you find?
    Sorry, forgot to mention that, but I already did that already with a couple of the GUIDs and didn't find anything in the registry.
    Friday, March 16, 2012 9:11 AM
  • Strange, what is the extension of the file? Also what kind of permissions / ownership are on the files, specifically look for TrustedInstaller
    Friday, March 16, 2012 11:53 AM
  • The file has no extension. And there's no TrustedInstaller in the rights. SYSTEM and the local Administrators have Full Control, local users have  Read&Execute and Read. Owner is the local Administrators group.
    Friday, March 16, 2012 1:05 PM
  • So have you been able to pinpoint at what time the files are created or can you force it to create those files. Then you could use something like procmon to figure out which process or application is generating these files.
    Friday, March 16, 2012 1:52 PM
  • Problem is, the computer is not at my location... but I'll try to get the local supporter to try and get the information. As you can see from my earlier screenshot of the files, they are not created in a certain pattern. Sometimes it's one or two files per hour, some other time it's five or more...

    Friday, March 16, 2012 2:00 PM
  • If you have you technician run procmon do note that performance on the workstation will be reduced quite a bit. If you have an affected system without a user I would recommend you run procmon on that machine instead. When filtering make sure you include Path begins with "C:\" and exclude Path for other heavily used folders on the C-drive eg. Windows,Program Files, Users
    Friday, March 16, 2012 2:25 PM
  • I also have the same problem.  I have started a thread over in Norton's community here: http://community.norton.com/t5/Norton-Internet-Security-Norton/Unknown-Files-in-ROOT-Directory/td-p/689859.

    Does your files begin with the same 16 bytes as this Žù[”éqèBºÉR°.yût?

    Sunday, April 1, 2012 6:29 PM
  • Sorry for not answering for a while, but the Supporter didn't get back to me and was on holiday.

    It seems the Problem was fixed by one of the Patches of the March Patchday. Still no idea where it originated and why it only happened on some Computers and on some more heavily than on others.

    Thanks for all the input. Might help me with other cases in the future.

    • Marked as answer by F.Spisla Tuesday, April 10, 2012 6:06 AM
    Tuesday, April 10, 2012 6:06 AM
  • I know your issue sorted itself, but this is one of only two places on the entire web I found this issue mentioned. I believe I have found the solution and would like to post it for anyone else who might find this thread.

    I started seeing those exact same files in my root directory and did not find a solution for it for months. They just kept showing up even after I deleted them repeatedly.

    Through troubleshooting another issue and during a virus scan I noticed filenames similar to those from the root directory in another folder on my drive.

    It turns out that Symantec Endpoint Protection Small Business Edition was keeping these little files as part of the Insight functionality. If it can't contact the server with information it wants to upload, it saves it for later. The default folder for these files was filled with over 166,500 of these little 30k files with GUID names that aren't in any registry. In total, it was over 5 gigs of tiny files in a single folder. Even opening the folder caused 10 minutes of window hang while it loaded the directory.

    I suspect that the files in the root directory were somehow misplaced, likely because of the massive size of the default folder.

    This was also causing very high processor use from some of the Symantec processes, which is how I found this solution.

    After deleting the massive folder of 166 thousand files (Which took forever by the way), and disabling the insight upload functions, the files in the root drive have not reappeared.

    I'm also going to post this info on the Norton forum that was linked below.

    • Proposed as answer by DarkJeffie Friday, August 9, 2013 11:34 AM
    Friday, August 9, 2013 11:34 AM