Identify file found on USB sticks named "syncguid.dat"

Question

All of my USB sticks now have contain a file named syncguid.dat. They began to appear when I bought a new HP Mini Note and I assume they are created by some of the bundleware that came with it.

But now I'm concerned that it could be malware. I couldn't find much using Google even when I added "HP" and "Mini Note" to the search terms.

(There seems to be no other questions of this type on Superuser.com but the FAQ doesn't say anything against it so let's give it a try)

UPDATE

It is a JSON file with the following format (x represents a hexadecimal digit)

{"id":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","synced":false}

Solution 1

It might be possible to find out what is writing to the drive with procmon - start it up, plug in a drive without that file (optionally) remove the registry and network related filters, and search for syncguid.dat

Solution 2

I believe this is a function of GOMlab's GOM Encoder video encoder. It uses the .dat file to keep track of what has been synchronized with removable media devices (like iPods etc).

Solution 3

A program called "Syncables Desktop" creates this file on every volume it finds. I guess it uses this file to keep track of volumes to sync the files on them. (GUID = Globally Unique ID)

Syncables Desktop was preinstalled on my DELL Inspiron. As long as the Syncables background task is running, it will re-create the file when you delete it. I opened task manager and killed all tasks with "syncables" in their path (syncables.exe, OTiSyncApp.exe and an instance of javaw). Then I could delete the file and it wouldn't come back.

The strange thing is, I have never used Syncables. When I launched it, it asked me to confirm the EULA. So it wasn't even initialized, but still started silently writing to drives. Creepy. I'll uninstall it and hope it is gone for good.

Solution 4

If you want to stop it from putting syncguid.dat on every drive you use do the following. Click on the start button at the bottom left of the screen Type in the box msconfig Click on msconfig In msconfig in the Startup Tag untick sysncables desktop Apply and OK You will then be asked to do a Restart so Restart your PC

You can now delete all the syncguid.dat files

View more solutions

Comments

[studiohack]

no worries, this is on topic :)

[Thalys]

have you tried uploading it to something like virustotal to rule out the file is a virus?

[hippietrail]

@The Journeyman Geek: VirusTotal found nothing. Since it's just a little JSON text file that makes plenty of sense that it can't be infected but doesn't rule out malware using it to mark USB sticks somehow. (Or non malware...)

[hippietrail]

Hmm I think I did install something from GOM to play a video from somebody else's phone. I'll check for that when I get back to my home computer tonight. Thanks.

[hippietrail]

Aha I finally got around to testing procmon and indeed it identified HP Quicksync to be accessing it, which is indeed bundleware on my HP Mini. It supposedly "synchronizes and migrates email, contacts, calendars, files, folders, browser bookmarks, and more between computers and a new generation of mobile storage devices."

[hippietrail]

Perhaps it's a pseudo standard? It was definitely HP Quicksync that was writing it on my machine. Of course one could be an OEM rebranding of the other or they could both use the same library, etc.

[hippietrail]

Yes a quick Google search verifies that HP Quicksync is indeed a version of Syncables!