folder size very large

[Trusol]

hello all.

I have the Incident Response and Endpoint Protection product installed, via LGFL , at a number of my LGFL schools  and this is all working fine. However yesterday I noticed that on a number of pcs at one of these schools the “C:\programdata\malwarebytes\mbamservice” was in excess of 25Gb which is a fair chunk of data if the pc only has an ssd drive of 128Gb. The files taking up space are shown , as an example, on the screenshot below.

 

On some pcs the folder size was considerably less so I guess this is something to do with malware infections either being quarantined items or log files of some sort

.

Can  you advise what I need to do to get this folder size back to something more manageable please?

 

thank you

 

Phil Walker

Edited December 14, 2020 by AdvancedSetup
corrected font issue

[exile360]

Greetings,

Unless I am mistaken, those appear to be the temporary backup copies of the various user registry hives that get created during scans by Malwarebytes.  They're supposed to get cleaned up automatically whenever the scan completes but some issue with those particular systems such as a buggy install of Malwarebytes, some third party security tool or data monitoring/management tool, or perhaps some permissions issue may be causing them to be left behind.  You should be able to delete all of them safely (the ones named with obvious user hive profile names, i.e. the ones starting with anything like S-1-5-*) as long as a scan isn't currently running (they're probably being created during whatever scheduled scans you have configured on the endpoints) and it should be fine, though a clean uninstall/reinstall of the endpoint client software may be in order if it is a corrupt configuration issue with the software itself.  You can test by deleting the files on one of the affected endpoints, then running a scan (a manual Threat scan is fine), then check to verify that those files it creates during the scan get deleted when the scan completes.  If they do not, then whatever is causing the issue must still be present.

I hope this helps.  Please let us know how it goes.

Thanks

[Trusol]

thank you for the response - that is what I was expecting (i.e. temp files that I can delete) so I will give a test when I am next in the school and post a response then. May not be until next week but I will also check my other schools in the meantime. thanks again. Phil

[exile360]

Excellent, just for reference this is a behavior we've seen occasionally in the past on some systems, but to my knowledge no specific bug or culprit/cause was ever identified so my personal suspicion is that it is most likely either related to permissions or simply a corrupt installation of Malwarebytes and hopefully a fresh install of Malwarebytes will fix it.  Hopefully the solution will be as simple in your case.

Thanks