Weird System Files In LocalLow Not Long After Boot

Hi all,

I recently noticed files appearing not long after restarting my laptop in LocalLow. These files have long string character names, and appear to belong to the System. They remain in use and can't be deleted until restart occurs, and once deleted shortly thereafter new ones will show back up.

I'm wondering if anyone has seen this before. I've read that LocalLow is used to store files with low level access, so why they would be system files is beyond me. I would also expect any files the system is using to be concealed. I've had difficulty pinpointing what exactly is causing them. I was gonna try booting in safe mode, but I couldn't figure out how to do that on my laptop (the instructions on Dell's website are clear, but the option in the blue menu isn't visible).

These files don't appear to be causing any sort of problems with my computer. I don't suspect a virus at work, and I've found no indications in my event log of something amiss (besides the device setup manager failures that have been occurring regularly, but I've read that's something Microsoft needs to fix, and these started long after I first noticed them).

I suspect this may be a system bug from recent windows updates. But I'd like your thoughts. Thank you.

I do not see such files on my particular machine. It does not have to be the system creating them. Malware or an app running in the background could also be what's creating them.
To be on the safe side I would run a full scan with Malwarebytes Free. Free Antivirus 2023 | Download Free Antivirus & Virus Scan | 100% Free & Easy Install
I would also test in clean boot to see if the files get created. If it doesn't happen in a clean boot, you know some piece of software is creating the files. You can weed out which software using Brink's tutorial.
Perform a Clean Boot in Windows 11 to Troubleshoot Software Conflicts Tutorial

Hello @recursor01 and welcome to ElevenForum.

Please take another screenshot that includes the address bar of File Explorer.

Ghot said:

Hello @recursor01 and welcome to ElevenForum.

Please take another screenshot that includes the address bar of File Explorer.

Click to expand...

I don't have them but the OP means here (LocalLow)
C:\Users\<user>\AppData\LocalLow

@recursor01
When you try to delete the file(s), what process is holding the delete?
Files in that location are usually generated by an app or program after log in.
You could open them in notepad and see if you decipher something from their content.
Forget the previous line, an active process will prevent that.
Can't use strike-thru option, don't know why.

Yeah, I'm sorry, I forgot to mention that. The message says the file is open in Settings. Some of the files that appear can be deleted once they generate, but two or three can't, and those say the file is open in Settings. I have run a full bitdefender scan and also run MalwareBytes. Neither has picked up anything, and I highly doubt it is a virus. I have tried disabling certain programs, but next I will take the advice above and do a clean boot.

Alright, update, so I tried the clean boot, and that didn't solve anything. But I did notice that right before the files generated, two things happened. One, a percentage of CPU in task manager was dedicated to Muoso core worker (which I think is associated with Windows update), and two, the widgets task. Which lends credence to the idea that this might be some sort of Windows bug.

OAT said:

C:\Users\<user>\AppData\LocalLow

Click to expand...

Uh yes... I know where LocalLow is.

Try to open any of them with Notepad, to see its contents.

I have, the contents are encrypted of course.

I'll go ahead and do an OS reinstall and see if that resolves the issue. I imagine it will. But if it doesn't, I'm just gonna blame Microsoft and not worry about it.

recursor01 said:

I'll go ahead and do an OS reinstall and see if that resolves the issue. I imagine it will. But if it doesn't, I'm just gonna blame Microsoft and not worry about it.

Click to expand...

You can just to an In-Place upgrade (repair install)




For Windows 11...

An In-Place Upgrade "compares" what is installed on the computer, with the Windows ISO image.
Then, it overwrites any corrupted Windows files, with clean copies from the ISO image.
This is how it "repairs" Windows while allowing you to keep your programs and personal files.

Here is the short version of the In-place upgrade tutorial...

DISABLE non-Microsoft:
a) antivirus software
b) firewall software
c) drive encryption software


Make a full OS backup with a program like Macrium Reflect or AOMEI Backupper Standard
Making a backup is optional, but always a smart move.
Macrium Reflect
AOMEI Backupper Standard (free)


Get the Windows 11 ISO (Option #2), and save it to your desktop...


Right click the ISO image and choose: MOUNT
Open File Explorer and you will see a new drive letter. It will "look" like a DVD optical drive.
Double click the new drive letter to open it.
Find setup.exe and double click it to start the in-place upgrade.

Choose the Keep personal files and apps option.

After it's all done... to UNmount the ISO image, right click the new drive letter and choose: EJECT.

The ONLY thing you will lose is some of your personalizations.
Your drivers, programs and data will be intact.

MoUSO Core Worker Process is the part of Windows update that manages the order in which updates are downloaded and installed on the operating system. Simply put, this process controls which updates are downloaded and installed first.

The file sizes are negligible, I would do nothing in your case.

It isn't ransomware, just some app creating some kind of logs, or backups of its settings.

Just run a Windows antivirus scan on your hard disk, if it finds nothing, you do not have to worry.