File named program keeps appearing keeping services from starting.

There was a similar issue in question titled "file named "Program" with no extension randomly created", but end result was finding related to DHCP and disabling it. We need to find resolution.

On Windows SBS 2008 server, I repeatedly have a file named Program with no extension appear at D:\ which prevents services installed to D:\Program Files from starting. I opened the file and the content is the same as result of running command "netsh dhcp show server" (server name changed):

1 Servers were found in the directory service:

      Server [server.domain.local] Address [10.0.0.100] Ds location: cn=server.domain.local

Command completed successfully.

What can I check to prevent file "D:\Program" from appearing?
ByteCafeSupportAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David AtkinTechnical DirectorCommented:
Very strange. Some questions:

How often are the files created?  Is there additional 'program' files that get created or does it just add to the existing file?

Any anti-virus on the server?

Which services is it stopping? Any events in the logs at the same time?

I'd consider using procmon to see which process is creating the file.
0
ByteCafeSupportAuthor Commented:
I haven't picked up on any particular pattern of when the file is generated. It appears to overwrite when there are changes. The only additional ones are the ones I renamed.

The contents do change. I just observed this content:

Invalid Syntax: Invalid option
Files\SAAZOD\zcmon\ApplicationLog\ZADMon\AdmonTemp_DcDiag_testConnectivity1.txt.
 Use dcdiag.exe /h for help.

I assume something was missing quotes that tried to write a text file.

Antivirus is GFI VIpre Business, with active protection currently disabled.

The service I was having trouble with when I noticed this was Cyberoam Transparent Authentication Suite for their Cyberoam firewall.

With the new contents, it may be an issue with the server monitoring agent we use.

I'll check with monitoring vendor and try procmon if that doesn't get me anywhere and report back.
0
David AtkinTechnical DirectorCommented:
Yes I would check out your monitoring tool first, it looks like it could just be a log file.  Depending what agent you use it may run checks periodically.  Still very odd though.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

vivigattCommented:
It seems to me that something tries to create a file (a log, a script?) in "D:\Program Files\SomePath", but the command lacked the quotation marks.
For instance, if you run the command:
netsh dhcp show server > d:\Program Files\WhatEverThePath\mylog.txt
instead of
netsh dhcp show server > "d:\Program Files\WhatEverThePath\mylog.txt"
the output of the command will be stored in a file named d:\program and not in d:\Program Files\WhatEverThePath\mylog.txt
This is because there is a white space in "d:\Program files" that is interpreted as a separator.
I would investigate that path...
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ByteCafeSupportAuthor Commented:
I had the monitoring tool vendor check it out without me and they didn't find any problems. When I check it now, the files do not exist. I believe it was something trying to write out without quotes in a path, but never found what it was.
0
ByteCafeSupportAuthor Commented:
Accepted as solution because I believe that was the issue and pointed me in a direction, even though we never found the process.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.