Share via

Scanning Hidden and Suspicious file

Anonymous
2020-12-10T10:18:48+00:00

Some time ago i had made an antivirus scam but my antivirus could not open and scan a file that was strange to me. The path to the file is 

"C:\ProgramData\Microsoft\Windows Defender"

The file's weight is 0KB, the file is also hidden. My amtivirus's publisher wrote that if it is 0KB weight that can not be a malicious and I need to ask Microsoft what is this file used for. 

The file's name:

"IMpService77BDAF73-B396-481F-9042-AD358843EC24.lock"

I found a similar topic on Microsoft but the person posted it, wrote that he can't use Windows Defender to scan when I can scan my pc using Windows Defender without any errors. I'm interested what is this file used for. Thanks for help and appreciate every answer. 

Edit: Now I found that this file is only on my computer when I turn on periodic scanning by Windows Defender. When I switch it on, I can see an "Antimalware Service Executable" process and the file is in the folder. When I switch periodic scan off, the process and a file disappear. 

[Original Title: Hidden file]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

Answer accepted by question author

  1. Rob Koch 25,875 Reputation points Volunteer Moderator
    2020-12-15T16:15:27+00:00

    As already mentioned the file is clearly not malicious, since it's a zero byte file, so lets examine it a bit closer to see whether we can make an educated guess.

    "IMpService77BDAF73-B396-481F-9042-AD358843EC24.lock"

    Searching for the components of the name online, I could only find the IMpService portion related to an Intel platform file, so this section isn't going to be helpful in explaining its purpose.

    However, the "77BDAF73-B396-481F-9042-AD358843EC24" portion can be found is at least several places, most often logs for updates or other technical issues with either "Windows Defender" or "Windows Defender Antivirus" immediately preceding it.

    I then did a Find in Regedit on my own Windows 8.1 laptop and the only item I found with this string was contained in the following registry key.

    HKEY_USERS\S-1-5-18\Software\Microsoft\TelemetryClient\ThrottleStore\watson\generic\generic\windowsupdatefailure3

    So clearly this is the CLSID (Class Identifier) for Windows Defender and is most often seen relating to update or other issues within logs.

    The final ".lock" portion is actually quite commonly used to designate some sort of flag file used to tell software that some process is taking place, most often something like an update or other operation that shouldn't be interrupted.  In most cases these files are 0 zero) bytes in size, since they only exist during the time in which the operation is taking place and so don't need to contain any actual data.

    So from the above it's easy to make a guess that this file is nothing more than a Windows Defender flag file used to lock the operation of some processes that might interfere, most likely during the Windows Update processes required to replace portions of Defender such as signature definitions, engines or possibly the entire anti-malware client itself.

    Nothing at all surprising or concerning, including the fact that the file itself is locked and can't be deleted, since that's something the operating system would obviously do when such operations are in process.

    The only question might be that if the file never goes away, it's possible this indicates that some process is stuck and unable to complete.  If there are other indications of either an update or similar failure occurring with Defender, then this is simply one possible symptom and not likely itself to be the true problem.

    Rob

    2 people found this answer helpful.
    0 comments No comments

7 additional answers

Sort by: Most helpful
  1. Reza-Ameri 45,811 Reputation points Volunteer Moderator
    2020-12-15T17:20:19+00:00

    Try boot into safe mode, take a look at Start your PC in safe mode in Windows 10 (microsoft.com)

    And then see if you are able to copy this file and place it to desktop and then restart your PC and then upload it to VirusTotal.

    0 comments No comments
  2. _AW_ 67,216 Reputation points Volunteer Moderator
    2020-12-15T10:25:48+00:00

    I pulled that file from a backup image and it is genuinely a 0 byte file and has no ADS (alternate data stream), so it couldn't possibly be malicious. As to Windows Defender and why it creates this file - that's a question that only a MS developer could possibly answer.

    0 comments No comments
  3. Anonymous
    2020-12-15T08:59:05+00:00

    I have got no permission to scan it, but my friends have the same file too on their pc if it helps.

    0 comments No comments
  4. Reza-Ameri 45,811 Reputation points Volunteer Moderator
    2020-12-14T17:39:56+00:00

    Do you have access to this file?

    If yes, try upload it to VirusTotal

    0 comments No comments