Solved

File named program keeps appearing keeping services from starting.

Posted on 2014-09-03
6
144 Views
Last Modified: 2014-09-18
There was a similar issue in question titled "file named "Program" with no extension randomly created", but end result was finding related to DHCP and disabling it. We need to find resolution.

On Windows SBS 2008 server, I repeatedly have a file named Program with no extension appear at D:\ which prevents services installed to D:\Program Files from starting. I opened the file and the content is the same as result of running command "netsh dhcp show server" (server name changed):

1 Servers were found in the directory service:

      Server [server.domain.local] Address [10.0.0.100] Ds location: cn=server.domain.local

Command completed successfully.

What can I check to prevent file "D:\Program" from appearing?
0
Comment
Question by:ByteCafeSupport
  • 3
  • 2
6 Comments
 
LVL 22

Expert Comment

by:David Atkin
ID: 40301392
Very strange. Some questions:

How often are the files created?  Is there additional 'program' files that get created or does it just add to the existing file?

Any anti-virus on the server?

Which services is it stopping? Any events in the logs at the same time?

I'd consider using procmon to see which process is creating the file.
0
 

Author Comment

by:ByteCafeSupport
ID: 40302154
I haven't picked up on any particular pattern of when the file is generated. It appears to overwrite when there are changes. The only additional ones are the ones I renamed.

The contents do change. I just observed this content:

Invalid Syntax: Invalid option
Files\SAAZOD\zcmon\ApplicationLog\ZADMon\AdmonTemp_DcDiag_testConnectivity1.txt.
 Use dcdiag.exe /h for help.

I assume something was missing quotes that tried to write a text file.

Antivirus is GFI VIpre Business, with active protection currently disabled.

The service I was having trouble with when I noticed this was Cyberoam Transparent Authentication Suite for their Cyberoam firewall.

With the new contents, it may be an issue with the server monitoring agent we use.

I'll check with monitoring vendor and try procmon if that doesn't get me anywhere and report back.
0
 
LVL 22

Expert Comment

by:David Atkin
ID: 40302870
Yes I would check out your monitoring tool first, it looks like it could just be a log file.  Depending what agent you use it may run checks periodically.  Still very odd though.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 16

Accepted Solution

by:
vivigatt earned 500 total points
ID: 40303064
It seems to me that something tries to create a file (a log, a script?) in "D:\Program Files\SomePath", but the command lacked the quotation marks.
For instance, if you run the command:
netsh dhcp show server > d:\Program Files\WhatEverThePath\mylog.txt
instead of
netsh dhcp show server > "d:\Program Files\WhatEverThePath\mylog.txt"
the output of the command will be stored in a file named d:\program and not in d:\Program Files\WhatEverThePath\mylog.txt
This is because there is a white space in "d:\Program files" that is interpreted as a separator.
I would investigate that path...
0
 

Author Comment

by:ByteCafeSupport
ID: 40330652
I had the monitoring tool vendor check it out without me and they didn't find any problems. When I check it now, the files do not exist. I believe it was something trying to write out without quotes in a path, but never found what it was.
0
 

Author Closing Comment

by:ByteCafeSupport
ID: 40330660
Accepted as solution because I believe that was the issue and pointed me in a direction, even though we never found the process.
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
Redirected folders in a windows domain can be quite useful for a number of reasons, one of them being that with redirected application data, you can give users more seamless experience when logging into different workstations.  For example, if a use…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now