1

(Note: This is probably not connected to OneDrive, but OneDrive is letting me see my files are being accessed. It may help others search this same issue if it happens to them.)

Every reboot of my computer, this file is accessed by "Node.js JavaScript Runtime" -- which causes OneDrive to download it. This is all happening without my instruction:

enter image description here

It is a backup file that is over 1 GB in size. I deleted it to make it stop, but it just downloaded the next (1 GB backup file) in the same folder. I keep these backup files on the cloud only. (EDIT: In case it matters, these are .cty (CityDesk) files, from Joel Spolsky's old CMS.)

What I have done:

I have done a virus scan, quick and full. I am about to do an offline scan. APPEND: The quick, full, and offline scans did not find anything malicious.

What I am looking for:

I am looking for ideas of what might be causing this. Also, how do I discern which program is causing this? And why?

UPDATE:

Following helpful advice below, on my recent boot I caught two node.exe / Node.js JavaScript Runtime processes:

enter image description here

enter image description here

I'll investigate further and see if it's Adobe doing this for some reason.

It's also in my Startup Apps:

enter image description here

I'll uninstall these apps - Adobe Creative Cloud and Adobe Acrobat -- and see if it clears it out.

UPDATE: This worked!

enter image description here

Hard to see, but I'm showing no node.exe / Node.js JavaScript Runtime processes and OneDrive not downloading any files due to it accessing them.

Xonatron
  • 1,272
  • 6
  • 16
  • 23

1 Answers1

0

It was caused by one of two Adobe applications:

  • Adobe Creative Cloud
  • Adobe Acrobat

I uninstalled them both.

I verified that node.exe / Node.js JavaScript Runtime no longer runs.

I verified that the files in question were no longer being accessed (and OneDrive was therefore no longer downloading them).

Note: I may have been able to disable these apps on startup, but maybe they would have accessed these files anyway. Who knows.

See the original question and comments for more detail. I jumped through a few hoops while figuring this out, and detailed my notes there!

Xonatron
  • 1,272
  • 6
  • 16
  • 23