Share via

Windows 7 - Carbon Black Sensor Creating 10s of thousands of files using up all my CPU

Anonymous
2018-06-18T07:15:37+00:00

So I've been having a problem with a slow computer for a while now . Spent days trying to figure it out. And finally found the source of the problem. But can't figure out how to stop it.

The path of the problem is

C:/Windows/CarbonBlack/store

Pretty much there are 10s of thousands of files being created creating gigibytes of data.

Theres a text file and a data file created in each folder. The txt file simply has text like

"\Device\HarddiskVolume1\Windows\System32\NaturalLanguage6.dll"

I know this is the issue because in safe mode I deleted over 2gb of these files and started my computer normal and it was faster than ever. But immediately there were 10s of thousands of files created and the computer started slowing down within a minute.

There's nothing I can figure out to delete CarbonBlack, it requires administrative permissions and I can't even locate it in the regedit to do a forced uninstall.

I have a symantec endpoint anti-virus that says it has been quarantining a "Webcoinminer" malware, but says it has been fixed. I downloaded malwarebytes and malwarebytes finds absolutely nothing.

Any thoughts on what I can do to stop this? Thanks

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

4 answers

Sort by: Most helpful
  1. Anonymous
    2018-06-18T17:15:34+00:00

    I cleaned the folder out again and tried this morning. Computer loads in like 15 seconds, it's amazing. But within 10 seconds there was already 2,000 files created.

    You could alter the access permissions for the folder C:\Windows\CarbonBlack\store so that write-access is denied to everyone.

    2 people found this answer helpful.
    0 comments No comments
  2. Anonymous
    2018-06-18T15:54:00+00:00

    There's nothing I can figure out to delete CarbonBlack, it requires administrative permissions and I can't even locate it in the regedit to do a forced uninstall.

    Please elaborate:  What happens when you go to Programs and Features and attempt to uninstall Carbon Black Sensor in the usual way?   If you get an error message, please provide the complete text.

    Please elaborate:   "it requires administrative permissions" 

    • Are you logged on with a user account that has "computer administrator" privileges?
    • If you're not logged on as a user with "administrator" privileges, a  task that requires such permissions normally gives you the opportunity to grant permission by providing the account name and password of an administrator account.  Did you get a pop-up window requesting this information?

    Hi, thanks for the reply. When I try to uninstall it from the uninstall.exe I get "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

    When I try to do it from the 'Programs and Features' I get "The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not currently installed. Contact your support personnel for assistance."

    I cleaned the folder out again and tried this morning. Computer loads in like 15 seconds, it's amazing. But within 10 seconds there was already 2,000 files created and I just restarted the computer and booted in safe mode. Think there is some hidden malware or something? When I run a disk scan every thing checks out, all the drivers respond with saying they're up to date, malwarebytes doesn't find anything. Only thing that finds something is Symantec Endpoint but it says it's quarantined.

    0 comments No comments
  3. LemP 74,925 Reputation points Volunteer Moderator
    2018-06-18T15:23:11+00:00

    There's nothing I can figure out to delete CarbonBlack, it requires administrative permissions and I can't even locate it in the regedit to do a forced uninstall.

    Please elaborate:  What happens when you go to Programs and Features and attempt to uninstall Carbon Black Sensor in the usual way?   If you get an error message, please provide the complete text.

    Please elaborate:   "it requires administrative permissions" 

    • Are you logged on with a user account that has "computer administrator" privileges?
    • If you're not logged on as a user with "administrator" privileges, a  task that requires such permissions normally gives you the opportunity to grant permission by providing the account name and password of an administrator account.  Did you get a pop-up window requesting this information?
    0 comments No comments
  4. Anonymous
    2018-06-18T07:46:22+00:00

    As a first step I would launch the Task Manager and disable each and every task under the Startup tab.

    0 comments No comments