A Strange "c" File with No Extension Keeps Appearing After Deletion but Not After Renaming It

Ok, so this is my first post and I hope I'm posting in the right forum. However, I noticed a strange file located in
C:\Users\<my suer name here>\AppData\Roaming as I was creating a start menu shortcut of a portable application. As I was manuevering through the directories, I noticed a strange file called "c" with no extension in the above mentioned directory. Curious, I sandboxed a copy of the file, and opened it with notepad. Once it was opened, a "\" is the only text contained in the file. So, I asked a ChatGPT program that I have installed on my PC that's specifically made for PC troubleshooting and PowerShell scripting, and followed all the recommended actions - such as scan my PC with Malwarebytes, Hitman Pro, etc. etc. My PC comes up clean each time. Following the next step of this ChatGPT advice, I renamed the file to "c.bak" to see if it would create another instance of the file and to see if I would have an appllication misbehave/ fail to load, etc. After waiting a few days as recommended I deleted the c.bak file figuring an application hadn't malfunctioned or anything so I figured it was safe to delete, thinking maybe it was a leftover from another application that I had uninstalled. Immediately after deleting the c.bak file, another instance of the original "c" file suddenly appeared. So, I went ahead and renamed it to "c.disabled" this time. My question is, is that I cannot trace what is creating this "c" file with no extension. I figured if this was caused from an application it would occur immediately right after renaming the file as "c.bak" which it did not - but the moment I delete the file, a new instance of "c" file appears suddenly. How can I trace what application is causing this? And yes, I did look at the properties details tab and it's just blank. Any ideas of what's going on here?

bn40400 said:

........................the moment I delete the file, a new instance of "c" file appears suddenly. How can I trace what application is causing this?

Click to expand...

Process Monitor is an app that can help with this.

1) Open ProcMon, stop the capture, make sure that only "File System Activity" is selected, then clear the current events.

2) Start capture, delete that "C" file, and as soon as it reappears, stop the capture.

3) Look through the log for the app or service etc that created that file.

If you rightclick on the c file and select properties, what does it show? Does it at least give you a date?

Are you typing anything into a command prompt? It could be generated if you mistyped C:\

Echo \ >c would do it

Maybe you are running a script or batch file with this error?

bn40400 said:

Ok, so this is my first post and I hope I'm posting in the right forum....

Click to expand...

Welcome to Eleven Forum...

bn40400 said:

I noticed a strange file located in
C:\Users\<my suer name here>\AppData\Roaming as I was creating a start menu shortcut of a portable application. As I was manuevering through the directories, I noticed a strange file called "c" with no extension in the above mentioned directory.

Click to expand...

I have that too....



I wonder what it's for? Even Copilot is puzzled.....

kelper said:

Echo \ >c would do it

Click to expand...

No, that produces a 3 byte file (there's a CR, LF too). The one in Roaming is just 1 byte. Mine was created in November 2023, so it's been there a long time.

Bree said:

I have that too....

Click to expand...

I don't see this on my machine. I honestly have no idea what that is.

Bree said:

No, that produces a 3 byte file (there's a CR, LF too). The one in Roaming is just 1 byte. Mine was created in November 2023, so it's been there a long time.

Click to expand...

But does your file contain the "\"?

andrew129260 said:

I don't see this on my machine. I honestly have no idea what that is.

Click to expand...

I see it on every W11 machine I've looked at so far. It's even there in my Insider Canary build.

It's not in mine.

kelper said:

It's not in mine.

Click to expand...

Mine neither.

'copy nul c' in a cmd prompt creates a file named c with zero bytes.

I'm not seeing it in my Win11 machines.

I think it's caused by a tweaking utility that I don't have!

kelper said:

I think it's caused by a tweaking utility that I don't have!

Click to expand...

I don't use them either as I have to be able to see what my clients see when they have issues but it's quite possible for things like that to happen. It brings back memories of the '90s and Shareware which allowed a trial then buy or uninstall but the uninstall left behind an unseen marker that it had been there and couldn't again install it unless wiping the drive and rebuilding.

No 'c' to see on my C drives in my multiple builds either, that I see...

OAT said:

No 'c' to see on my C drives in my multiple builds either, that I see...

Click to expand...

We ‘c’ what you did there!

bn40400 said:

I noticed a strange file located in .... \AppData\Roaming ... a strange file called "c" with no extension....

Click to expand...

Berton said:

I'm not seeing it in my Win11 machines.

Click to expand...

kelper said:

I think it's caused by a tweaking utility that I don't have!

Click to expand...

I don't use any 'tweaking utility' - never have, never will.....

OAT said:

No 'c' to see on my C drives in my multiple builds either, that I see...

Click to expand...

I have finally found just one of my W11 machines that doesn't have it - a recent clean install of 24H2.



All my other W11 machines have been around for some time, Most have had W11 installed since 2021, only seen upgrades since then. All my Appdata\Roaming\c files have a creation date around the end of 2023, maybe an update created it?. None of my W10 machines have it.

Please don't cc me on any of your jokes!

@Bree @kelper @Secret Squirrel Thank you all for your help, as well as others. After following all of the steps of all of your advice (checking all of my .bat files, running Procmon, and reinitializing my tweaking applications [Winearo, Windhawk, etc.]) I still couldn't trace the file. Aside from those tweaking applications, I only have a few batch and .ps1 files that I created for task scheduling purposes. I just deleted it and had a cumulative beta insider update (23H2 still) sitting waiting to be installed - so I installed the update, and the "c" file has not reappeared after reboot. At this point, I'm venturing to say that maybe it was created from an earlier insider build or other general Windows update? Bree had mentioned they had it too. @Bree - Thank you for welcoming me, but did you open your copy with notepad? Was there any containing text? Just an odd file, and at this point I'm thinking it's just a harmless file maybe placed by MS for some reason or another (could even be the tweaks and mods I have on this PC). I'll see if it comes back, but after an update and a reboot, it hasn't regenerated. If it does, I'll update this post. In my opinion, I still don't consider this resolved until I can figure out who (Microsoft? other software?), what it is, and what purpose it serves! lol Yes, I'm that stubborn! In all seriousness though, I'm just wanting to make sure it's not any kind of malware or some other harmful file. Thanks again everybody!