Files With Random Names Keep Coming Back After Deletion: How to Find the Program Recreating Them

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

Stop deleting the files until you identify what is bringing them back. A file that reappears is being recreated, restored, or revealed by another process, but its unusual name does not prove that Windows is infected with a virus, Trojan, spyware, or other malware.

Possible causes include OneDrive or another sync service, backup software, an installer or updater, antivirus test files, a scheduled task, or malware persistence. In the specific BleepingComputer case behind this topic, the evidence pointed toward files generated by Aura security software rather than a confirmed virus infection.

#	Preview	Product	Price
1		CZUR ET MAX Professional Book & Document Scanner, 38MP Document Camera	$799.00	Buy on Amazon
2		WoneNice USB Laser Barcode Scanner Wired Handheld Bar Code Scanner Reader Black	$22.88	Buy on Amazon
3		Epson Workforce ES-50 Compact & Lightweight Mobile Document Scanner	$139.99	Buy on Amazon
4		Canon imageFORMULA R10 - Portable Document Scanner, USB Powered, Duplex Scanning, Document Feeder,...	$184.00	Buy on Amazon
5		FixMeStick Gold Computer Virus Removal Stick for Windows PCs - Unlimited Use on Up to 5 Laptops or...	$109.99	Buy on Amazon

What happened in the documented case?

The original forum thread was posted on September 28, 2023. It involved a Windows 10 Pro 22H2 computer where files appeared in the root of the system drive, including:

• C:!-SCPGT02.XLSX
• C:!-SCPGT03.JPEG
• C:!-SCPGT04.PDF
• Hidden directories named C:!- and C:~!-

The files appeared around the time Aura was installed. The investigation also found Aura-related folders, services, drivers, and a scheduled task called Aura service start timeout handler. One recovered file reportedly contained the text “Dummy Data ScapeGoat”.

#1 Best Overall

CZUR ET MAX Professional Book & Document Scanner, 38MP Document Camera

• High-Resolution Scanning: Features a 38MP CMOS sensor with a resolution of 7168 × 5376 and 410 DPI, suitable for capturing clear and detailed images
• Patented Curve-Flattening Technology: Automatically flattens the curved pages of bound books and removes distortion for accurate, clean scans without the need to unbind
• Powerful OCR Functionality: Converts scanned images into editable and searchable files, including Word, Excel, and searchable PDFs. Supports 180+ languages. Please note that Thai and Hebrew are currently not supported. Arabic is only supported on ET Series scanners under Windows systems; other operating systems currently do not support Arabic OCR. If you need the complete OCR language support list, please feel free to contact us for more details
• Large Scanning Area: Supports documents up to A3 size (16.5'' × 11.7''). Note: Not recommended for glossy or highly reflective materials
• Fast Scanning Speed: Scan a page in just 1.5 seconds with practiced operation—ideal for high-efficiency, bulk scanning projects

$799.00

Buy on Amazon

Those details led the forum responder to conclude that Aura was probably creating security-test or decoy data. That was an informed investigation, not a vendor-confirmed explanation or proof that every similarly named file is harmless. The thread is best understood as a case study: a frightening filename can be produced by legitimate security software, while the same symptom on another PC could have a completely different cause.

The practical lesson is simple: identify the creator instead of diagnosing the file from its name.

Why deleted files return

“It came back after I deleted it” describes a result, not a diagnosis. Common mechanisms include:

1. A running application recreates it. An application may maintain a cache, test file, lock file, or working directory.
2. A scheduled task runs again. The task may trigger at logon, startup, every few minutes, or after a failed process exits.
3. A service or startup item restores it. Windows services, Run keys, Startup-folder entries, and updaters can launch before or after you sign in.
4. Cloud synchronization restores it. OneDrive, Google Drive, Dropbox, or iCloud may copy a cloud version back to the computer.
5. Backup software restores it. A backup job or restore operation may repopulate a folder.
6. An installer or updater extracts it repeatedly. Failed updates and watchdog components sometimes recreate temporary files.
7. Security software creates decoys or quarantine artifacts. Antivirus products may use harmless files to test detection, isolation, or recovery behavior.
8. Another device or share writes it back. A network folder, NAS, removable drive, or another synchronized computer may be the source.
9. Malware uses persistence. A malicious program may launch through a scheduled task, service, registry Run key, WMI event, startup folder, script, browser extension, or other mechanism.

Random-looking names are not automatically malicious. Legitimate programs commonly use hashes, GUIDs, timestamps, short temporary names, and deliberately alarming names for testing.

Do not delete the files first

Deleting the visible files often leaves the responsible process untouched. It can also destroy useful evidence, trigger a sync conflict, remove a sample that could be analyzed, or cause the application to generate a fresh copy immediately.

Before removing anything, record:

• The exact full path, including the drive letter.
• The filename, extension, and file size.
• Creation, modification, and access times.
• Whether the file is hidden, read-only, or marked as a system file.
• Whether identical names appear on other drives, computers, network shares, or removable media.
• What happens immediately before the return: logon, reboot, opening an application, connecting a USB drive, resuming sync, or waiting several minutes.

Take screenshots if useful. Preserve one representative file only if doing so is safe, and do not open or execute it merely to identify it.

Inspect the directory without opening the files

Get-ChildItem -LiteralPath "C:pathtofolder" -Force |
    Select-Object Name, Length, CreationTime, LastWriteTime, Attributes

Replace the path with the affected directory. This lists metadata without launching the files.

Rank #2

WoneNice USB Laser Barcode Scanner Wired Handheld Bar Code Scanner Reader Black

• Plug and play, This laser handheld barcode scanner has simple installation with any USB port and Ideal for businesses, shops and warehouse operations. Its function is unbeatable and easy to use, design is stylish
• Compatible with Windows, Mac, and Linux; works with Word, Excel, Novell, and all common software
• Scanning Speed: 200 scans per second. Scanning angle: Inclination angle 55°, Elevation angle 65°. Operational Light Source:Visible Laser 650-670nm.
• Decode Capability: Code11, Code39, Code93, Code32, Code128, Coda Bar, UPC-A, UPC-E, EAN-8, EAN-13, ISBN/ISSN, JAN.EAN/UPC Add-on2/5 MSI/Plessey, Telepen and China Postal Code,Interleaved 2 of 5, Industrial 2 of 5, Matrix 2 of 5, etc ; 300 configurable options for prefix, suffix and termination strings, support turn on/off the beep.
• Color: Black. Dimensions: 3.6 x 2.6 x 6.1 inches. Type of Cable: 2M or 6ft straight cable. Shock: 1.5m drop on concrete surface. Regulatory Approvals: FCC CE.

$22.88

Buy on Amazon

Compare returning files with SHA-256

A file with the same name may not be the same file. Compare its size, content, timestamps, file type, digital signature, and hash. For a non-sensitive sample:

Get-FileHash -LiteralPath "C:pathtofile.ext" -Algorithm SHA256

Run the command before deletion and again if the file returns. Do not execute suspicious .exe, .scr, .js, .vbs, .ps1, .bat, .cmd, or Office files to discover what they are. A document can contain active content, and a filename or icon can be deceptive.

First determine whether this is sync or local recreation

Check whether the affected location is inside OneDrive, Google Drive, Dropbox, iCloud Drive, a backup destination, a shared network folder, or a removable drive. The official OneDrive support pages explain current sync controls and status indicators.

If a sync or backup source is plausible:

1. Pause synchronization or temporarily exit the sync client.
2. Wait through the normal return interval, or repeat the action that previously caused the file to reappear.
3. Check the service’s web recycle bin, activity history, conflict copies, and other connected devices.
4. Review scheduled backup jobs and network-share activity.
5. Do not delete the same files simultaneously from several devices until you know which copy is authoritative.

If the files stop returning while sync is paused, investigate the cloud or backup source before permanently deleting anything. Deleting a local synchronized file can otherwise cause a cloud copy or another computer to restore it.

Use timing and location as diagnostic clues

These patterns narrow the investigation but do not prove a cause.

Check startup entries safely

Start with Windows’ built-in locations:

• Settings → Apps → Startup
• Task Manager → Startup apps
• Press Win+R, enter shell:startup, and inspect the current user’s Startup folder.
• Press Win+R, enter shell:common startup, and inspect the shared Startup folder.

Also inspect, without deleting entries blindly:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce

For a broader inventory, Microsoft’s free Sysinternals Autoruns lists startup programs, services, scheduled-task entries, Explorer extensions, drivers, and other autostart locations.

In Autoruns:

1. Run it as administrator.
2. Enable signature verification.
3. Save a report before making changes.
4. Search for the exact filename, parent folder, recently installed application, or unknown publisher.
5. Disable one clearly associated entry at a time.
6. Wait for the known trigger or reboot, then check whether the files return.

Hide Microsoft Entries is a convenience filter, not proof that every remaining item is dangerous. Do not disable random Windows, hardware, driver, or security entries because their names look technical. Autoruns inventories autostart locations; it does not identify malware automatically.

Rank #3

Sale

Epson Workforce ES-50 Compact & Lightweight Mobile Document Scanner

• PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
• QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
• VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
• INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
• EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0

$139.99

Buy on Amazon

Inspect scheduled tasks

Open Task Scheduler by pressing Win+R, entering taskschd.msc, and reviewing the Task Scheduler Library and relevant subfolders. Pay attention to tasks that:

• Run at startup, logon, or a repeating interval.
• Launch programs from AppData, Temp, ProgramData, Downloads, or an unusual root directory.
• Invoke PowerShell, cmd.exe, wscript.exe, mshta.exe, or rundll32.exe with an unfamiliar path or arguments.
• Have no publisher or a suspicious author.
• Were created around the first appearance of the files.

You can inventory tasks from Command Prompt:

schtasks /query /fo LIST /v

Or use PowerShell:

Get-ScheduledTask |
    Select-Object TaskName, TaskPath, State,
        @{Name="Actions";Expression={$_.Actions.Execute}}

Do not delete a task until you understand its action, executable path, publisher, trigger, and associated application. Windows and legitimate software create many scheduled tasks. In the documented case, the Aura service timeout task appeared alongside legitimate Google and OneDrive tasks, demonstrating why context matters more than the task name.

Find the process that creates the file

When guessing fails, Microsoft Sysinternals Process Monitor can show which process performs the file operation.

1. Start Process Monitor with appropriate administrator permissions.
2. Filter on the exact filename or affected directory.
3. Watch for CreateFile, WriteFile, SetRenameInformationFile, and related events.
4. Record the process name, PID, command line, user, parent process, and executable path.
5. Check the file’s publisher and digital signature before stopping or uninstalling anything.

This can distinguish a sync client, updater, antivirus engine, script interpreter, browser component, and unknown executable far more reliably than a filename-based diagnosis.

Scan Windows safely

1. Open Windows Security.
2. Choose Virus & threat protection.
3. Update protection intelligence.
4. Run a Full scan.
5. If the cause remains unexplained or persistence is suspected, run Microsoft Defender Offline.

Defender Offline scans from a trusted recovery environment before normal Windows processes fully load. It may remove detected threats, but no scanner guarantees detection or complete remediation. Menu labels can vary by Windows edition and build, so follow the current Windows Security interface rather than an old screenshot. See Microsoft’s Defender Offline guidance.

For a one-time second opinion, download the Microsoft Safety Scanner directly from Microsoft. It is free and intended for on-demand use; download a current copy when needed because its protection database is time-limited.

You can also use the free ESET Online Scanner as a second opinion. Do not install multiple real-time antivirus products without checking compatibility. They can conflict, repeatedly scan one another’s files, or complicate diagnosis. The original case involved Aura and Kaspersky while Windows Defender was disabled, and the forum responder specifically cautioned about overlapping antivirus products.

Rank #4

Canon imageFORMULA R10 - Portable Document Scanner, USB Powered, Duplex Scanning, Document Feeder, Easy Setup, Convenient, Perfect for Mobile Users, White

• STAY ORGANIZED – Easily convert your paper documents into digital formats like searchable PDF files, JPEGs, and more.Power Consumption : 2.5W or less (Energy Saving Mode: 0.7W). Suggested Daily Volume : 500 scans..Does it contain liquid: no
• CONVENIENT AND PORTABLE –lightweight and small in size, you can take the scanner anywhere from home offices, classrooms, remote offices, and anywhere in between
• HANDLES VARIOUS MEDIA TYPES – Digitize receipts, business cards, plastic or embossed cards, reports, legal documents, and more
• FAST AND EFFICIENT – No technical hurdles or complicated setups here; easily scan both sides of a document at the same time, in color or black-and-white, at up to 12 pages-per-minute, and with a 20 sheet automatic feeder
• BROAD COMPATIBILITY – Works with both Windows and Mac devices, be it laptop or computer

$184.00

Buy on Amazon

Remove the source, then remove residual files

Once Process Monitor, Autoruns, Task Scheduler, timestamps, or a scan identifies the responsible application:

1. Pause the responsible process only after recording the evidence.
2. Uninstall the application through Settings → Apps → Installed apps.
3. Restart Windows.
4. Repeat the trigger that previously caused the files to return.
5. Only after recurrence stops, remove leftover files and folders.
6. Empty the relevant recycle bin or quarantine only when you are certain the contents are not needed.
7. Confirm that your intended real-time security protection is enabled.

Uninstalling the application may stop the behavior, but residual services, scheduled tasks, folders, or cloud copies can remain. Do not take ownership of protected files or change permissions simply because Windows says a file is in use. Identify the locking process first.

Advanced tools require care. Autoruns is for inventory and controlled disabling; Process Monitor is for tracing file operations; Farbar Recovery Scan Tool (FRST) is a specialist diagnostic and repair tool; Revo Uninstaller can help remove an identified application but is not malware proof. Never copy an FRST fixlist from another computer. FRST repairs are system-specific and can damage Windows when applied incorrectly.

When should you suspect malware?

The concern is stronger when several of these signs appear together:

• The returning items are executable or script files.
• The publisher is missing, invalid, or inconsistent with the installed application.
• The creator runs from a user-writable location such as AppData, Temp, or Downloads.
• A task or service invokes PowerShell, mshta, wscript, or rundll32 with an unusual path.
• Security settings are disabled or exclusions are added without your action.
• Browser extensions, proxy settings, DNS settings, accounts, or passwords change unexpectedly.
• The files continue returning after sync clients and recently installed applications are disabled or removed.
• Unrelated documents are modified, renamed, encrypted, or held for ransom.
• You see suspicious outbound connections or unknown administrator accounts.

A clean scan does not prove the files are harmless. It may mean they are benign, not recognized by that scanner, generated by a legitimate program, or no longer being created. Conversely, a suspicious file should not be dismissed simply because one scan is clean.

Important edge cases

External drives

Disconnect removable drives and test the computer with only the system drive attached. Scan removable media separately before reconnecting it. If the files return only after a USB device is connected, investigate that device, its backup software, and other computers that use it.

Network shares

If the files appear on multiple computers, inspect the shared folder, NAS, backup application, and other connected clients. The source may be a shared or synchronized location rather than local malware.

Best Value

FixMeStick Gold Computer Virus Removal Stick for Windows PCs - Unlimited Use on Up to 5 Laptops or Desktops for 2 Years - Works with Your Antivirus

• WHAT YOU GET: FixMeStick Virus Removal Tool for Windows PCs (Windows XP, Vista, 7, 8, 8.1, 10, and 11. 512 MB RAM required), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.

$109.99

Buy on Amazon

File-extension deception

Enable the display of known file extensions in File Explorer. A file shown as document.pdf may actually be document.pdf.exe. Do not trust an icon or the first visible part of a filename.

Protected or locked files

A file being locked is not proof of infection. It may be undergoing quarantine, backup, scanning, or normal application use. Record the process holding it before attempting forced deletion.

When to disconnect the PC or reinstall Windows

If ransomware or mass encryption is occurring, disconnect the computer from networks and stop using it. If banking, email, or password theft is suspected, use a separate clean device to change passwords and enable multifactor authentication.

Seek professional malware-removal or IT support when the system has administrator- or SYSTEM-level persistence, security tools are being tampered with, multiple persistence mechanisms are present, credentials may have been stolen, business data is involved, or you cannot confidently distinguish legitimate entries from malicious ones.

A clean Windows reinstall may be more reliable than prolonged manual cleanup when compromise is extensive. Before reinstalling, preserve only essential personal data, avoid copying unknown executables or scripts, and plan to change credentials from a clean device. Reinstallation does not by itself secure compromised cloud accounts or recover stolen passwords.

Bottom line

Files with strange names that return after deletion are evidence of an active creator or restoration source—not automatic proof of a virus, Trojan, spyware, or malware infection. Document the files, pause synchronization, check when they return, trace the creating process, scan with Windows Security and Defender Offline when appropriate, and remove the responsible application or persistence mechanism only after you understand it. In the documented case, the strongest evidence pointed to Aura-generated test or decoy files, but that conclusion cannot be applied universally.

Quick Recap

Bestseller No. 1

CZUR ET MAX Professional Book & Document Scanner, 38MP Document Camera

$799.00

Bestseller No. 2

WoneNice USB Laser Barcode Scanner Wired Handheld Bar Code Scanner Reader Black

$22.88

SaleBestseller No. 3

Epson Workforce ES-50 Compact & Lightweight Mobile Document Scanner

$139.99

Bestseller No. 4

Canon imageFORMULA R10 - Portable Document Scanner, USB Powered, Duplex Scanning, Document Feeder, Easy Setup, Convenient, Perfect for Mobile Users, White

BROAD COMPATIBILITY – Works with both Windows and Mac devices, be it laptop or computer; This product is not intended for scanning photographs on photo paper / photographic media

$184.00

Bestseller No. 5

FixMeStick Gold Computer Virus Removal Stick for Windows PCs - Unlimited Use on Up to 5 Laptops or Desktops for 2 Years - Works with Your Antivirus

$109.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.