Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

All of my USB sticks now have contain a file named syncguid.dat. They began to appear when I bought a new HP Mini Note and I assume they are created by some of the bundleware that came with it.

But now I'm concerned that it could be malware. I couldn't find much using Google even when I added "HP" and "Mini Note" to the search terms.

(There seems to be no other questions of this type on Superuser.com but the FAQ doesn't say anything against it so let's give it a try)

UPDATE

It is a JSON file with the following format (x represents a hexadecimal digit)

{"id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","synced":false}

share|improve this question
no worries, this is on topic :) – studiohack♦ Apr 9 '11 at 6:52
have you tried uploading it to something like virustotal to rule out the file is a virus? – Journeyman Geek Apr 9 '11 at 8:02
@The Journeyman Geek: VirusTotal found nothing. Since it's just a little JSON text file that makes plenty of sense that it can't be infected but doesn't rule out malware using it to mark USB sticks somehow. (Or non malware...) – hippietrail Apr 9 '11 at 16:54

4 Answers

up vote 3 down vote accepted

It might be possible to find out what is writing to the drive with procmon - start it up, plug in a drive without that file (optionally) remove the registry and network related filters, and search for syncguid.dat

share|improve this answer
Aha I finally got around to testing procmon and indeed it identified HP Quicksync to be accessing it, which is indeed bundleware on my HP Mini. It supposedly "synchronizes and migrates email, contacts, calendars, files, folders, browser bookmarks, and more between computers and a new generation of mobile storage devices." – hippietrail Apr 13 '11 at 16:51
up vote 3 down vote

I believe this is a function of GOMlab's GOM Encoder video encoder. It uses the .dat file to keep track of what has been synchronized with removable media devices (like iPods etc).

share|improve this answer
Hmm I think I did install something from GOM to play a video from somebody else's phone. I'll check for that when I get back to my home computer tonight. Thanks. – hippietrail Apr 9 '11 at 8:53
up vote 1 down vote

A program called "Syncables Desktop" creates this file on every volume it finds. I guess it uses this file to keep track of volumes to sync the files on them. (GUID = Globally Unique ID)

Syncables Desktop was preinstalled on my DELL Inspiron. As long as the Syncables background task is running, it will re-create the file when you delete it. I opened task manager and killed all tasks with "syncables" in their path (syncables.exe, OTiSyncApp.exe and an instance of javaw). Then I could delete the file and it wouldn't come back.

The strange thing is, I have never used Syncables. When I launched it, it asked me to confirm the EULA. So it wasn't even initialized, but still started silently writing to drives. Creepy. I'll uninstall it and hope it is gone for good.

share|improve this answer
Perhaps it's a pseudo standard? It was definitely HP Quicksync that was writing it on my machine. Of course one could be an OEM rebranding of the other or they could both use the same library, etc. – hippietrail May 10 '12 at 13:14
Yes a quick Google search verifies that HP Quicksync is indeed a version of Syncables! – hippietrail May 10 '12 at 13:25
up vote 1 down vote

If you want to stop it from putting syncguid.dat on every drive you use do the following. Click on the start button at the bottom left of the screen Type in the box msconfig Click on msconfig In msconfig in the Startup Tag untick sysncables desktop Apply and OK You will then be asked to do a Restart so Restart your PC

You can now delete all the syncguid.dat files

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.