Forum Discussion

Harodman's avatar
Harodman
Silver Contributor
Jan 07, 2025

A Strange "c" File with No Extension Keeps Appearing After Deletion but Not After Renaming It

Ok, so this is my first post and I hope I'm posting in the right forum. However, I noticed a strange file located in
C:\Users\<my suer name here>\AppData\Roaming as I was creating a start menu shortcut of a portable application. As I was manuevering through the directories, I noticed a strange file called "c" with no extension in the above mentioned directory. Curious, I sandboxed a copy of the file, and opened it with notepad. Once it was opened, a "\" is the only text contained in the file. So, I asked a ChatGPT program that I have installed on my PC that's specifically made for PC troubleshooting and PowerShell scripting, and followed all the recommended actions - such as scan my PC with Malwarebytes, Hitman Pro, etc. etc. My PC comes up clean each time. Following the next step of this ChatGPT advice, I renamed the file to "c.bak" to see if it would create another instance of the file and to see if I would have an appllication misbehave/ fail to load, etc. After waiting a few days as recommended I deleted the c.bak file figuring an application hadn't malfunctioned or anything so I figured it was safe to delete, thinking maybe it was a leftover from another application that I had uninstalled. Immediately after deleting the c.bak file, another instance of the original "c" file suddenly appeared. So, I went ahead and renamed it to "c.disabled" this time. My question is, is that I cannot trace what is creating this "c" file with no extension. I figured if this was caused from an application it would occur immediately right after renaming the file as "c.bak" which it did not - but the moment I delete the file, a new instance of "c" file appears suddenly. How can I trace what application is causing this? And yes, I did look at the properties details tab and it's just blank. Any ideas of what's going on here?

1 Reply

  • Yhooum's avatar
    Yhooum
    Iron Contributor

    Use Process Monitor to monitor the file creation process, and then terminate the process using Unlocker or Handle tools before deleting it. Check whether it is regenerated by a scheduled task or service.

Resources