Strange Folders in C:\

  • Thread starter Thread starter Ron Rosenfeld
  • Start date Start date
R

Ron Rosenfeld

For the past ten months or so, strangely named folders have been appearing in
my C:\ directory. They have names such as 5ed7eb6b0462bcd0f3416e6bcfc23b

I have Windows XP Pro 2002 SP2 and it is set to automatically update.

They contain files which mostly seem to have to do with Microsoft updates,
Windows Defender, Microsoft AntiMalware, Client Protection, but there are a few
others also, There are about 20-25 of these folders.

They can be moved to the Recycle Bin with no apparent effect on the functioning
of my system.

They can ONLY be deleted (even from the Recycle Bin) by loggin in in SAFE mode
as THE ADMINISTRATOR. (If I log in as myself, with administrator privileges,
the system will not allow me to delete them).

I believe it will be safe to delete these files, but I would like to keep them
from appearing.

I have searched the net as well as Microsoft Support to no avail; including
looking for Verbose Logging.

Any suggestions would be appreciated.
--ron
 
On Dec 13, 5:27 pm, Ron Rosenfeld <ronrosenf...@nospam.org> wrote:
> For the past ten months or so, strangely named folders have been appearing in
> my C:\ directory. They have names such as 5ed7eb6b0462bcd0f3416e6bcfc23b
>
> I have Windows XP Pro 2002 SP2 and it is set to automatically update.
>
> They contain files which mostly seem to have to do with Microsoft updates,
> Windows Defender, Microsoft AntiMalware, Client Protection, but there are a few
> others also, There are about 20-25 of these folders.
>
> They can be moved to the Recycle Bin with no apparent effect on the functioning
> of my system.
>
> They can ONLY be deleted (even from the Recycle Bin) by loggin in in SAFE mode
> as THE ADMINISTRATOR. (If I log in as myself, with administrator privileges,
> the system will not allow me to delete them).
>
> I believe it will be safe to delete these files, but I would like to keep them
> from appearing.
>
> I have searched the net as well as Microsoft Support to no avail; including
> looking for Verbose Logging.
>
> Any suggestions would be appreciated.
> --ron

Folders name with random characters appear after installing a Service
Pack or hotfix?
http://www.winxptutor.com/randomfolders.htm
 
On Thu, 13 Dec 2007 04:38:50 -0800 (PST), devil_himself
<DEVIL_HIMSELF123@rediffmail.com> wrote:

>Folders name with random characters appear after installing a Service
>Pack or hotfix?
>http://www.winxptutor.com/randomfolders.htm


Hmmm. Thanks for that link.

The folders sure seem to have the same characteristics as those described under
Windows XP Service Pack Installation Temporary Files Folder. However, they are
not being removed, and the folders are not a result of a Service Pack.

It also explains the ownership issue with regard to removal.

I'd sure like to know how to get them to be automatically removed, though.
--ron
 
On Dec 13, 6:25 pm, Ron Rosenfeld <ronrosenf...@nospam.org> wrote:
> On Thu, 13 Dec 2007 04:38:50 -0800 (PST), devil_himself
>
> <DEVIL_HIMSELF...@rediffmail.com> wrote:
> >Folders name with random characters appear after installing a Service
> >Pack or hotfix?
> >http://www.winxptutor.com/randomfolders.htm
>
> Hmmm. Thanks for that link.
>
> The folders sure seem to have the same characteristics as those described under
> Windows XP Service Pack Installation Temporary Files Folder. However, they are
> not being removed, and the folders are not a result of a Service Pack.
>
> It also explains the ownership issue with regard to removal.
>
> I'd sure like to know how to get them to be automatically removed, though.
> --ron

Automatically .??? They cannot be Deleted Automatically
 
On Thu, 13 Dec 2007 06:20:00 -0800 (PST), devil_himself
<DEVIL_HIMSELF123@rediffmail.com> wrote:

>On Dec 13, 6:25 pm, Ron Rosenfeld <ronrosenf...@nospam.org> wrote:
>> On Thu, 13 Dec 2007 04:38:50 -0800 (PST), devil_himself
>>
>> <DEVIL_HIMSELF...@rediffmail.com> wrote:
>> >Folders name with random characters appear after installing a Service
>> >Pack or hotfix?
>> >http://www.winxptutor.com/randomfolders.htm
>>
>> Hmmm. Thanks for that link.
>>
>> The folders sure seem to have the same characteristics as those described under
>> Windows XP Service Pack Installation Temporary Files Folder. However, they are
>> not being removed, and the folders are not a result of a Service Pack.
>>
>> It also explains the ownership issue with regard to removal.
>>
>> I'd sure like to know how to get them to be automatically removed, though.
>> --ron
>
>Automatically .??? They cannot be Deleted Automatically

Perhaps I used confusing terminology.

Perhaps I should be asking how I can keep them from being created?

Most of these folders have to do with Windows Defender updates. I have checked
other computers on which Windows Defender is getting updated regularly, and
these folders do NOT exist.

So either there is something that is causing them to be created on my machine,
as opposed to others; or there is some mechanism whereby the update program
removes them on the other machines, but not on mine.

Whether they are "deleted" or "not created" makes no difference to me. I would
like them to not be permanently installed on my C:\ drive, as is the case for
others with what appear to be similar setups.
--ron
 
Your OS takes up about 4 gigs of space, YMMV. The system will always be
requiring a few more bits to fine tune what is essentially an ever-changing
system.
Defender is a prime example of that. There is probably some collision in
your Permissions that allows the write but not the delete. You could try
what is becoming the current 'cure all' for conflicts like this.

Aaron Stebner's WebLog Solving setup errors by using the SubInACL tool to
repair file and registry permissions:
http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx

--
Mark L. Ferguson
e-mail subject line must include "QZ" or it's deleted
..
"Ron Rosenfeld" <ronrosenfeld@nospam.org> wrote in message
news:5dg2m3dlau794bh3mo3cg0mrnb37gjkr29@4ax.com...
> On Thu, 13 Dec 2007 06:20:00 -0800 (PST), devil_himself
> <DEVIL_HIMSELF123@rediffmail.com> wrote:
>
>>On Dec 13, 6:25 pm, Ron Rosenfeld <ronrosenf...@nospam.org> wrote:
>>> On Thu, 13 Dec 2007 04:38:50 -0800 (PST), devil_himself
>>>
>>> <DEVIL_HIMSELF...@rediffmail.com> wrote:
>>> >Folders name with random characters appear after installing a Service
>>> >Pack or hotfix?
>>> >http://www.winxptutor.com/randomfolders.htm
>>>
>>> Hmmm. Thanks for that link.
>>>
>>> The folders sure seem to have the same characteristics as those
>>> described under
>>> Windows XP Service Pack Installation Temporary Files Folder. However,
>>> they are
>>> not being removed, and the folders are not a result of a Service Pack.
>>>
>>> It also explains the ownership issue with regard to removal.
>>>
>>> I'd sure like to know how to get them to be automatically removed,
>>> though.
>>> --ron
>>
>>Automatically .??? They cannot be Deleted Automatically
>
> Perhaps I used confusing terminology.
>
> Perhaps I should be asking how I can keep them from being created?
>
> Most of these folders have to do with Windows Defender updates. I have
> checked
> other computers on which Windows Defender is getting updated regularly,
> and
> these folders do NOT exist.
>
> So either there is something that is causing them to be created on my
> machine,
> as opposed to others; or there is some mechanism whereby the update
> program
> removes them on the other machines, but not on mine.
>
> Whether they are "deleted" or "not created" makes no difference to me. I
> would
> like them to not be permanently installed on my C:\ drive, as is the case
> for
> others with what appear to be similar setups.
> --ron
 
On Thu, 13 Dec 2007 09:14:43 -0600, "Mark L. Ferguson" <marfer_mvp@Yahoo.com>
wrote:

>Your OS takes up about 4 gigs of space, YMMV. The system will always be
>requiring a few more bits to fine tune what is essentially an ever-changing
>system.
>Defender is a prime example of that. There is probably some collision in
>your Permissions that allows the write but not the delete. You could try
>what is becoming the current 'cure all' for conflicts like this.
>
>Aaron Stebner's WebLog Solving setup errors by using the SubInACL tool to
>repair file and registry permissions:
>http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx
>
>--
>Mark L. Ferguson
>e-mail subject line must include "QZ" or it's deleted

Mark,

That is interesting.

When I examined the Permissions for a few of the errant folders, ALL of the
permissions had been DEselected (even for Administrator).

I will try this and see what happens.

--ron
--ron
 
Ron

Are you using Windows Live OneCare or Windows Defender as a standalone?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Ron Rosenfeld wrote:
> On Thu, 13 Dec 2007 09:14:43 -0600, "Mark L. Ferguson"
> <marfer_mvp@Yahoo.com> wrote:
>
>> Your OS takes up about 4 gigs of space, YMMV. The system will
>> always be requiring a few more bits to fine tune what is essentially
>> an ever-changing system.
>> Defender is a prime example of that. There is probably some
>> collision in your Permissions that allows the write but not the
>> delete. You could try what is becoming the current 'cure all' for
>> conflicts like this.
>>
>> Aaron Stebner's WebLog Solving setup errors by using the SubInACL
>> tool to repair file and registry permissions:
>> http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx
>>
>> --
>> Mark L. Ferguson
>> e-mail subject line must include "QZ" or it's deleted
>
> Mark,
>
> That is interesting.
>
> When I examined the Permissions for a few of the errant folders, ALL
> of the permissions had been DEselected (even for Administrator).
>
> I will try this and see what happens.
>
> --ron
> --ron
 
On Fri, 14 Dec 2007 13:05:26 -0000, "Gerry" <gerry@nospam.com> wrote:

>Ron
>
>Are you using Windows Live OneCare or Windows Defender as a standalone?

Gerry,

As far as I know, I am just using Windows Defender as a standalone. I've not
(knowingly) enabled anything called Windows Live OneCare.

Why do you ask?
--ron
 
Windows Defender can be part of Windows Live OneCare. Windows Defender
as a standalone is fine but Windows Live OneCare can cause problems.



~~~~


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Ron Rosenfeld wrote:
> On Fri, 14 Dec 2007 13:05:26 -0000, "Gerry" <gerry@nospam.com> wrote:
>
>> Ron
>>
>> Are you using Windows Live OneCare or Windows Defender as a
>> standalone?
>
> Gerry,
>
> As far as I know, I am just using Windows Defender as a standalone.
> I've not (knowingly) enabled anything called Windows Live OneCare.
>
> Why do you ask?
> --ron
 
On Fri, 14 Dec 2007 16:24:41 -0000, "Gerry" <gerry@nospam.com> wrote:

>Windows Defender can be part of Windows Live OneCare. Windows Defender
>as a standalone is fine but Windows Live OneCare can cause problems.

Well, I guess it's fortunate I don't have Windows Live OneCare. Doing some
research revealed to me that it is a "paid subscription" type of product, so I
am definitely certain I don't have that.

And since a few of the "funny folders" don't seem to relate to Defender, I
suppose the problem is elsewhere -- likely with the Windows Update function.

Thanks.
--ron
 
On Thu, 13 Dec 2007 09:14:43 -0600, "Mark L. Ferguson" <marfer_mvp@Yahoo.com>
wrote:

>Your OS takes up about 4 gigs of space, YMMV. The system will always be
>requiring a few more bits to fine tune what is essentially an ever-changing
>system.
>Defender is a prime example of that. There is probably some collision in
>your Permissions that allows the write but not the delete. You could try
>what is becoming the current 'cure all' for conflicts like this.
>
>Aaron Stebner's WebLog Solving setup errors by using the SubInACL tool to
>repair file and registry permissions:
>http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx
>
>--
>Mark L. Ferguson


Mark,

So far, so good. I ran the SubInACL tool you recommended last week, and, at
least for the update that took place this week, there was no errant folder
created in my root directory.

Thanks again for the pointer.

Hopefully, this improvement will persist.

Best wishes,
--ron
 
On Wed, 19 Dec 2007 07:57:25 -0500, Ron Rosenfeld <ronrosenfeld@nospam.org>
wrote:

>On Thu, 13 Dec 2007 09:14:43 -0600, "Mark L. Ferguson" <marfer_mvp@Yahoo.com>
>wrote:
>
>>Your OS takes up about 4 gigs of space, YMMV. The system will always be
>>requiring a few more bits to fine tune what is essentially an ever-changing
>>system.
>>Defender is a prime example of that. There is probably some collision in
>>your Permissions that allows the write but not the delete. You could try
>>what is becoming the current 'cure all' for conflicts like this.
>>
>>Aaron Stebner's WebLog Solving setup errors by using the SubInACL tool to
>>repair file and registry permissions:
>>http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx
>>
>>--
>>Mark L. Ferguson
>
>
>Mark,
>
>So far, so good. I ran the SubInACL tool you recommended last week, and, at
>least for the update that took place this week, there was no errant folder
>created in my root directory.
>
>Thanks again for the pointer.
>
>Hopefully, this improvement will persist.
>
>Best wishes,
>--ron

Uh Oh, I wrote too soon.

This morning there is a new "funny folder" and it also is not detectable by
just hitting delete. As evidenced by the contents of one of the contained
files, as_delta.ini, it has to do with a Windows Defender update.

Any other thoughts, guys???



==========================
; MpSigStub INI Configuration File

;----------------------------------------------------
; Configuration Section
;
; This section specifies parameters for the stub
;----------------------------------------------------
[Parameters]
PATCH_FULL_ENGINE=0

;----------------------------------------------------
; Products Section
;
; These sections specify the products that are to
; be updated.
;----------------------------------------------------
[WD]
PRODUCT_NAME=Windows Defender
PRODUCT_CONFIG_ROOT_KEY=SOFTWARE\Microsoft\Windows Defender
PRODUCT_MIN_VERSION_DEFAULT=1.1.1592.0
==================================
--ron
 
Ron

Uninstall Windows Defender and download and install the latest version?
http://www.microsoft.com/athome/security/spyware/software/default.mspx

1.1.1592.0 is not the latest version.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Ron Rosenfeld wrote:
> On Wed, 19 Dec 2007 07:57:25 -0500, Ron Rosenfeld
> <ronrosenfeld@nospam.org> wrote:
>
>> On Thu, 13 Dec 2007 09:14:43 -0600, "Mark L. Ferguson"
>> <marfer_mvp@Yahoo.com> wrote:
>>
>>> Your OS takes up about 4 gigs of space, YMMV. The system will
>>> always be requiring a few more bits to fine tune what is
>>> essentially an ever-changing system.
>>> Defender is a prime example of that. There is probably some
>>> collision in your Permissions that allows the write but not the
>>> delete. You could try what is becoming the current 'cure all' for
>>> conflicts like this.
>>>
>>> Aaron Stebner's WebLog Solving setup errors by using the SubInACL
>>> tool to repair file and registry permissions:
>>> http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx
>>>
>>> --
>>> Mark L. Ferguson
>>
>>
>> Mark,
>>
>> So far, so good. I ran the SubInACL tool you recommended last week,
>> and, at least for the update that took place this week, there was no
>> errant folder created in my root directory.
>>
>> Thanks again for the pointer.
>>
>> Hopefully, this improvement will persist.
>>
>> Best wishes,
>> --ron
>
> Uh Oh, I wrote too soon.
>
> This morning there is a new "funny folder" and it also is not
> detectable by just hitting delete. As evidenced by the contents of
> one of the contained files, as_delta.ini, it has to do with a Windows
> Defender update.
>
> Any other thoughts, guys???
>
>
>
> ==========================
> ; MpSigStub INI Configuration File
>
> ;----------------------------------------------------
> ; Configuration Section
> ;
> ; This section specifies parameters for the stub
> ;----------------------------------------------------
> [Parameters]
> PATCH_FULL_ENGINE=0
>
> ;----------------------------------------------------
> ; Products Section
> ;
> ; These sections specify the products that are to
> ; be updated.
> ;----------------------------------------------------
> [WD]
> PRODUCT_NAME=Windows Defender
> PRODUCT_CONFIG_ROOT_KEY=SOFTWARE\Microsoft\Windows Defender
> PRODUCT_MIN_VERSION_DEFAULT=1.1.1592.0
> ==================================
> --ron
 
Gerry,

My Windows Defender Version is 1.1.1593.0.

I believe the message in the .ini file refers to the minimum version it will
work on, and not the version installed.

<sigh>

But the page you referenced did indicate I could get some free support. So I'm
going to try that route.

-- Ron

On Fri, 21 Dec 2007 13:34:55 -0000, "Gerry" <gerry@nospam.com> wrote:

>Ron
>
>Uninstall Windows Defender and download and install the latest version?
>http://www.microsoft.com/athome/security/spyware/software/default.mspx
>
>1.1.1592.0 is not the latest version.
>
>--
>
>
>
>Hope this helps.
>
>Gerry
>~~~~
>FCA
>Stourport, England
>Enquire, plan and execute
>~~~~~~~~~~~~~~~~~~~


--ron
 
Ron

There are specialist private newsgroups devoted to Windows Defender:
http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Ron Rosenfeld wrote:
> Gerry,
>
> My Windows Defender Version is 1.1.1593.0.
>
> I believe the message in the .ini file refers to the minimum version
> it will work on, and not the version installed.
>
> <sigh>
>
> But the page you referenced did indicate I could get some free
> support. So I'm going to try that route.
>
> -- Ron
>
> On Fri, 21 Dec 2007 13:34:55 -0000, "Gerry" <gerry@nospam.com> wrote:
>
>> Ron
>>
>> Uninstall Windows Defender and download and install the latest
>> version?
>> http://www.microsoft.com/athome/security/spyware/software/default.mspx
>>
>> 1.1.1592.0 is not the latest version.
>>
>> --
>>
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~
>
>
> --ron
 
On Fri, 21 Dec 2007 14:20:31 -0000, "Gerry" <gerry@nospam.com> wrote:

>Ron
>
>There are specialist private newsgroups devoted to Windows Defender:
>http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

Thanks, Gerry,

I will check them out.

MS Help told me that was "normal behavior". I find it hard to believe since
these files are not present on other machines with Windows Defender.

His suggestion was to make them "hidden" files.
--ron
 
Back
Top