3

I'm on a Windows 7 PC on a domain in my office. Looking at my c:/users folder today, I found 314 folders totaling 131 GB. The folder names appear to be intentionally random, and each one contains a fully fleshed-out windows profile. Our tech support team has no idea what could cause this, but they tell me it is affecting multiple PCs.

enter image description here

With some effort, I was able to delete all but one of the folders (I had to use Unlocker to free them and flag for delete on reboot.) The one that I couldn't get rid of has two sub-folders held open by c:\windows\system32\lsass.exe

lsass.exe locking these two folders

I have admin rights on the box, but cannot access, delete, or take ownership of the two "Credentials" folders.

I'm looking for any clue as to what might be happening here and how to stop it.

I spent a lot of time in Google, but only came away with dusty memories of the Sasser worm. (Not a likely cause. We have up-to-date antivirus, lsass.exe is signed by MS, and I didn't see any of the signature files of that worm.)

After the last reboot, a new folder appeared with a matching naming scheme.

Update: Many thanks to arana and EMK. Landesk is likely the culprit. We have a ticket open with our Landesk tech. I will post the solution here when the issue is resolved.

Improve this question
4
  • 1
    Do you use landesk by any chance? those look like profiles created by landesk somehow, we had one pc with similar symptoms and it was all landesk fault. We had to reinstall and apply all patches and it stopped doing that, landesk support staff was not helpful regarding this.
    – arana
    Mar 2, 2017 at 0:17
  • There is a good chance. I'll check with the network guys.
    – Brien Malone
    Mar 2, 2017 at 0:23
  • 2
    reddit.com/r/hacking/comments/5s1uw1/… So Landesk client system management program seems to be the most likely as per arana's comment.
    – HelpingHand
    Mar 2, 2017 at 0:32
  • Thanks for the reference EMK. That is definitely the front-runner. We do use Landesk. We've got a support ticket open now for them to look into this further. Even that link doesn't explain in depth about what is going on and what was done to resolve the problem. I will post that info here once it is available.
    – Brien Malone
    Mar 2, 2017 at 0:36

2 Answers 2

Reset to default
0

We are running LanDesk 2016.3. According to LanDesk/Ivanti, this is a known issue that is fixed with Service Update 3. The Release notes are really well done, but I was unable to find out which resolved defect speaks to this problem.

Improve this answer
-2

"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC or server. Lsass generates the process responsible for authenticating users for the Winlogon service. This is performed by using authentication packages such as the default, Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates then inherit this token.

I have also folders on my drive like 3f8704I1d2943a84ef894ec6146346532 . These folders probably contain log files and/or "remnants" from Microsoft updates. But I am not sure about yours.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .