Solved

File named program keeps appearing keeping services from starting.

Posted on 2014-09-03
6
168 Views
Last Modified: 2014-09-18
There was a similar issue in question titled "file named "Program" with no extension randomly created", but end result was finding related to DHCP and disabling it. We need to find resolution.

On Windows SBS 2008 server, I repeatedly have a file named Program with no extension appear at D:\ which prevents services installed to D:\Program Files from starting. I opened the file and the content is the same as result of running command "netsh dhcp show server" (server name changed):

1 Servers were found in the directory service:

      Server [server.domain.local] Address [10.0.0.100] Ds location: cn=server.domain.local

Command completed successfully.

What can I check to prevent file "D:\Program" from appearing?
0
Comment
Question by:ByteCafeSupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 22

Expert Comment

by:David Atkin
ID: 40301392
Very strange. Some questions:

How often are the files created?  Is there additional 'program' files that get created or does it just add to the existing file?

Any anti-virus on the server?

Which services is it stopping? Any events in the logs at the same time?

I'd consider using procmon to see which process is creating the file.
0
 

Author Comment

by:ByteCafeSupport
ID: 40302154
I haven't picked up on any particular pattern of when the file is generated. It appears to overwrite when there are changes. The only additional ones are the ones I renamed.

The contents do change. I just observed this content:

Invalid Syntax: Invalid option
Files\SAAZOD\zcmon\ApplicationLog\ZADMon\AdmonTemp_DcDiag_testConnectivity1.txt.
 Use dcdiag.exe /h for help.

I assume something was missing quotes that tried to write a text file.

Antivirus is GFI VIpre Business, with active protection currently disabled.

The service I was having trouble with when I noticed this was Cyberoam Transparent Authentication Suite for their Cyberoam firewall.

With the new contents, it may be an issue with the server monitoring agent we use.

I'll check with monitoring vendor and try procmon if that doesn't get me anywhere and report back.
0
 
LVL 22

Expert Comment

by:David Atkin
ID: 40302870
Yes I would check out your monitoring tool first, it looks like it could just be a log file.  Depending what agent you use it may run checks periodically.  Still very odd though.
0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 
LVL 16

Accepted Solution

by:
vivigatt earned 500 total points
ID: 40303064
It seems to me that something tries to create a file (a log, a script?) in "D:\Program Files\SomePath", but the command lacked the quotation marks.
For instance, if you run the command:
netsh dhcp show server > d:\Program Files\WhatEverThePath\mylog.txt
instead of
netsh dhcp show server > "d:\Program Files\WhatEverThePath\mylog.txt"
the output of the command will be stored in a file named d:\program and not in d:\Program Files\WhatEverThePath\mylog.txt
This is because there is a white space in "d:\Program files" that is interpreted as a separator.
I would investigate that path...
0
 

Author Comment

by:ByteCafeSupport
ID: 40330652
I had the monitoring tool vendor check it out without me and they didn't find any problems. When I check it now, the files do not exist. I believe it was something trying to write out without quotes in a path, but never found what it was.
0
 

Author Closing Comment

by:ByteCafeSupport
ID: 40330660
Accepted as solution because I believe that was the issue and pointed me in a direction, even though we never found the process.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OfficeMate Freezes on login or does not load after login credentials are input.
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question