1

(Note: This is probably not connected to OneDrive, but OneDrive is letting me see my files are being accessed. It may help others search this same issue if it happens to them.)

Every reboot of my computer, this file is accessed by "Node.js JavaScript Runtime" -- which causes OneDrive to download it. This is all happening without my instruction:

enter image description here

It is a backup file that is over 1 GB in size. I deleted it to make it stop, but it just downloaded the next (1 GB backup file) in the same folder. I keep these backup files on the cloud only. (EDIT: In case it matters, these are .cty (CityDesk) files, from Joel Spolsky's old CMS.)

What I have done:

I have done a virus scan, quick and full. I am about to do an offline scan. APPEND: The quick, full, and offline scans did not find anything malicious.

What I am looking for:

I am looking for ideas of what might be causing this. Also, how do I discern which program is causing this? And why?

UPDATE:

Following helpful advice below, on my recent boot I caught two node.exe / Node.js JavaScript Runtime processes:

enter image description here

enter image description here

I'll investigate further and see if it's Adobe doing this for some reason.

It's also in my Startup Apps:

enter image description here

I'll uninstall these apps - Adobe Creative Cloud and Adobe Acrobat -- and see if it clears it out.

UPDATE: This worked!

enter image description here

Hard to see, but I'm showing no node.exe / Node.js JavaScript Runtime processes and OneDrive not downloading any files due to it accessing them.

Improve this question
6
  • 1
    First off, the file is not downloaded by Node.js. That’s what OneDrive does. This notification means that Files On Demand had to download a file that was accessed by a Node.js process. Node.js knew nothing about the file being on OneDrive. // You can only find out what a Node.js process is doing by investigating its command line and working directory. Node.js is used in many applications, sometimes only as a helper.
    – Daniel B
    Commented Nov 9, 2023 at 14:57
  • Thanks. I know OneDrive downloads it, but something accessed it making OneDrive download it, which is what gave me notice. I'll adjust the wording to be more clear. Can you help with how I would investigate the Node.js process?
    – Xonatron
    Commented Nov 9, 2023 at 15:07
  • 1
    Process Explorer, Task Manager, anything you like that can display command line and working directory. Once you have these you’ll either know already or you can update your question. If the process is short-lived, this may prove difficult. Maybe check known autorun locations for what’s starting the process instead in that case.
    – Daniel B
    Commented Nov 9, 2023 at 15:31
  • 1
    Open Task Manager, go to the Details tab, right click the "Name" column title at the top of the list of processes and then click "Select Columns". In the box that appears scroll down until you find "Image Path Name" and tick the box next to it and press OK. Now scroll down the list of processes until you see "Node.js Javascript Runtime" and then scroll right to see what program/folder the program is running from.
    – Mokubai ♦
    Commented Nov 9, 2023 at 16:22
  • Thank you (both), not sure if I caught it (as it happens quickly on boot) but I caught two processes. I'll update my question.
    – Xonatron
    Commented Nov 11, 2023 at 2:35

1 Answer 1

Reset to default
0

It was caused by one of two Adobe applications:

  • Adobe Creative Cloud
  • Adobe Acrobat

I uninstalled them both.

I verified that node.exe / Node.js JavaScript Runtime no longer runs.

I verified that the files in question were no longer being accessed (and OneDrive was therefore no longer downloading them).

Note: I may have been able to disable these apps on startup, but maybe they would have accessed these files anyway. Who knows.

See the original question and comments for more detail. I jumped through a few hoops while figuring this out, and detailed my notes there!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .