CapabilityAccessManager causing storage issues and potential RoonServer.exe infection (ref#KYRDIY)

Hi! What’s not quite right with Roon?

· None of the above quite fits

None of the above quite fits

· None of these quite match

Tell us what's going on

· I started getting messages that I was out of storage on my 250GB hard drive. I'd clear out 5 or 10 GB, but it would be gone the next day.
I eventually figured out that the main culprit was the CapabilityAccessManager file in ProgramData/Microsoft/Windows. Other people had this problem and I followed the directions to delete the file. But it started to grow again immediately. So I did a Windows Reset, saving my personal files.
I reloaded my music applications and the file started to grow again. I ran Microsoft Safety Scanner and it reported over 400 infected files, but froze when it scanned RoonServer.exe. So I uninstalled Roon, and reran the scan. It completed a full scan reporting no infected files. But my wifi adapter stopped working, so I did another reset, this time wiping everything on the Windows drive.
I reloaded the scaler driver and Qobuz, and everything works fine now. Storage does change much from day-to-day. I haven't reloaded Roon because I'm concerned that it will start filling the drive again.

Tell us about your home network

· I'll add this information if you think its relevant, but as the network has no difficulty streaming music files from Qobuz, I don't think this was ever a problem.

Hi @stevekeen4,

The storage growth and the scan behavior you described point us toward checking what is happening on the Windows machine before we draw any conclusions about Roon Server.

There have been some false positives of Roon being picked up by antivirus software, but I have not heard of Roon causing this kind of behavior in the past. Do you happen to have a copy of the last Roon database/logs folder? Those may help with investigation.

As for initial steps, I suggest:

  1. Reinstall Roon Server only after you have a fresh Windows Security or Microsoft Safety Scanner result
  2. Once Roon Server is running again, watch the Windows drive usage and note whether the CapabilityAccessManager file starts growing again, along with the date and time it begins.
  3. If the file grows again, please upload a screenshot of the file path and size, along with the scanner report, so we can compare that with what Roon Server is doing.
We can also enable diagnostics on your account, then the next time the issue occurs, note the exact local time, date, and what Roon Server was doing, and let us know that timestamp here so that we can review the logs around that window.

The logs were wiped out with the Windows reset. I’ll try a reinstall after the 4/20 version becomes available and then monitor the file.

Hello @stevekeen4,

Thank you for the update. It makes complete sense that you want to be cautious after dealing with such a massive storage and system issue!

To put your mind at ease regarding Roon, I want to provide a little context on what likely happened here. The fact that the Microsoft Safety Scanner found over 400 infected files indicates that your Windows machine had unfortunately contracted a severe malware or virus infection from an outside source.

Malware often tries to aggressively access system permissions in the background (like location, network, etc.), which is exactly what causes the Windows CapabilityAccessManager log files to bloat up and consume your entire hard drive.

Why did the scanner freeze on Roon? RoonServer.exe is a continuously running background server that manages a complex, active database. Antivirus scanners frequently hang or freeze when they attempt to scan a large, active database process because the files are constantly being read and written to by the system. Roon was not the source of the infection; it was simply a large, active file that the struggling scanner choked on.

Now that you have performed a full Windows wipe, you have successfully eradicated the actual malware that was filling up your drive. Your system is now a clean slate.

Downloading and installing a fresh copy of Roon from our official website is completely safe and will not trigger that storage bug. We think your plan to reinstall once the new update drops is a great idea. Please let us know how it goes, and we will be standing by if you need any assistance!

Hello @stevekeen4 ,

The new update has been released, when you have a chance, please try to update to the latest Roon version and let us know how it goes!

Reloaded on the 21st, and it seems to be working fine. Fingers crossed.

Hi @stevekeen4,

Great to hear it’s working fine after the reload on the 21st. Fingers crossed indeed, and we’ll mark this thread for closure. Enjoy your Roon experience!