Random bogus filenames display in shares

When opening shares, local machine or remote, odd filenames are displayed, eg:
QzsckYo303218194.png
!!!!!3984876308.eml
!!!!!913991512.doc
ZZZZZ3206883135.bmp
QzsckYo1765664544.txt
!!!!!1173571699.ppt
XORXOR1439796768.doc
XORXOR75156527.pps
ZZZZZ2942035339.mdb
!!!!!1948152156.pem

They do not display when accessing a folder directly, only a share, and only in DOpus, not in Windows Explorer or with command prompt. Most "files" are Hidden, some show as folders. -- Windows 11 21H2

1 Like

File Explorer and the dir command do not show hidden files by default.

Is that the reason you only see them in Opus?

Try dir /ah to list the hidden files. If they appear then, they really exist, and Opus isn't doing anything wrong.

They look like canary files from your anti-malware software.

Yeah, those files seem like a "feature" of the Traps anti-ransomware software.

Found some threads:

They are nothing to do with Opus, and they show up in anything that doesn't hide hidden files.

I suspected that a recent change from Crowdstrike to PaloAlto's Cortex might be the culprit, this confirms it. I have hidden & system files visible in both Explorer & DO, but the bogus files only show in DO, and only when accessing a directory as a Share, not directly. I don't see them in Powershell or command prompt, even as admin showing hidden files.

It's something you'll have to ask PaloAlto about, but seems to be a well documented side-effect of their software which doesn't just affect Opus.

Maybe they hook the filesystem APIs and change which files are reported to exist to different processes, but I can only guess.