Deleted Folder Keeps Returning


  1. Posts : 4
    Windows 7
       #1

    Deleted Folder Keeps Returning


    Hi everyone, I have an issue that I've researched and done extensive troubleshooting, but I haven't been able to resolve. I have a folder that keeps re-appearing on my Desktop. I delete it, but it randomly re-appears. Sometimes this happens when I transfer large files throughout my computer, other times it happens when I play a game on Steam. Its very random. The structure of the folder is:

    GameBase64
    Extras
    Videos
    Captures

    My assumption has been that some program must be writing the folder to desktop. During troubleshooting I've removed every possible program and Firefox browser addon that could cause this, to no avail. I'm to the point that I think I need some program that logs every minor activity on Windows, to tell me what exact process or program created the folder. Can anyone assist?
      My Computer


  2. Posts : 6,285
    Windows 10 Pro X64
       #2
      My Computer


  3. Posts : 4
    Windows 7
    Thread Starter
       #3

    Upon further investigation, Windows is randomly writing desktop.ini to several places. The GameBase64 folder seems to be one, another is 'My Pictures'. This seems to happen primarily when I download something from the internet or transfer large files. The GameBase64 folder appears because windows is writing desktop.ini to its root. Have you heard of this before?
      My Computer


  4. Posts : 8,608
    Windows 7 Ultimate 32bit SP1
       #4

    Do you have 'show all hidden files' checked or unchecked?
      My Computer


  5. Posts : 10,485
    W7 Pro SP1 64bit
       #5

    Process Explorer set to use VirusTotal might be of interest to you:
    Process Explorer + VirusTotal (to check all processes with 50+ AV's)

    But Process Monitor should be able to tell you what events are happening just before something writes to those INI files. If you need help using Process Monitor, look for YouTube videos.
    Last edited by UsernameIssues; 04 Sep 2015 at 10:53.
      My Computer


  6. Posts : 4
    Windows 7
    Thread Starter
       #6

    I was able to capture the event using process monitor. The main event is below, but I'm unable to interpret it. It looks like Steam.exe is writing Desktop.ini to the folder, with the actual Gamebase64 creation in the final lines below:

    11:46:56.6513340 AM Steam.exe 7916 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions SUCCESS Desired Access: Read
    11:46:56.6513653 AM Steam.exe 7916 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286A68-3C57-41A1-BBB1-0EAE73D76C95} SUCCESS Desired Access: Read
    11:46:56.6514027 AM Steam.exe 7916 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions SUCCESS
    11:46:56.6514170 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Category SUCCESS Type: REG_DWORD, Length: 4, Data: 4
    11:46:56.6514291 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Name SUCCESS Type: REG_SZ, Length: 26, Data: Local Videos
    11:46:56.6514385 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParentFolder NAME NOT FOUND Length: 144
    11:46:56.6514474 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Description NAME NOT FOUND Length: 144
    11:46:56.6514550 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\RelativePath SUCCESS Type: REG_SZ, Length: 14, Data: Videos
    11:46:56.6514648 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParsingName BUFFER OVERFLOW Length: 144
    11:46:56.6514733 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParsingName SUCCESS Type: REG_SZ, Length: 176, Data: shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}
    11:46:56.6514840 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InfoTip SUCCESS Type: REG_EXPAND_SZ, Length: 84, Data: @%SystemRoot%\system32\shell32.dll,-12690
    11:46:56.6514929 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalizedName SUCCESS Type: REG_EXPAND_SZ, Length: 84, Data: @%SystemRoot%\system32\shell32.dll,-21791
    11:46:56.6515018 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Icon SUCCESS Type: REG_EXPAND_SZ, Length: 80, Data: %SystemRoot%\system32\imageres.dll,-189
    11:46:56.6515103 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Security NAME NOT FOUND Length: 144
    11:46:56.6515183 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResource NAME NOT FOUND Length: 144
    11:46:56.6515255 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResourceType NAME NOT FOUND Length: 144
    11:46:56.6515344 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalRedirectOnly NAME NOT FOUND Length: 144
    11:46:56.6515420 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Roamable NAME NOT FOUND Length: 144
    11:46:56.6515500 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PreCreate SUCCESS Type: REG_DWORD, Length: 4, Data: 1
    11:46:56.6515581 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Stream NAME NOT FOUND Length: 144
    11:46:56.6515657 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PublishExpandedPath NAME NOT FOUND Length: 144
    11:46:56.6516000 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\DefinitionFlags NAME NOT FOUND Length: 144
    11:46:56.6516161 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Attributes SUCCESS Type: REG_DWORD, Length: 4, Data: 1
    11:46:56.6516250 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\FolderTypeID NAME NOT FOUND Length: 144
    11:46:56.6516317 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InitFolderHandler NAME NOT FOUND Length: 144
    11:46:56.6516509 AM Steam.exe 7916 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag SUCCESS Desired Access: Read
    11:46:56.6516817 AM Steam.exe 7916 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95} SUCCESS
    11:46:56.6517241 AM Steam.exe 7916 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5 SUCCESS Desired Access: Query Value
    11:46:56.6517375 AM Steam.exe 7916 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\KnownFolders NAME NOT FOUND Desired Access: Query Value
    11:46:56.6517464 AM Steam.exe 7916 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5 SUCCESS
    11:46:56.6517620 AM Steam.exe 7916 RegOpenKey HKCU SUCCESS Desired Access: Read
    11:46:56.6517759 AM Steam.exe 7916 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS Desired Access: Read
    11:46:56.6517884 AM Steam.exe 7916 RegCloseKey HKCU SUCCESS
    11:46:56.6517973 AM Steam.exe 7916 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{35286A68-3C57-41A1-BBB1-0EAE73D76C95} SUCCESS Type: REG_EXPAND_SZ, Length: 94, Data: %USERPROFILE%\Desktop\GameBase64\Extras\Videos
    11:46:56.6518647 AM Steam.exe 7916 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS
    11:46:56.6520812 AM Steam.exe 7916 CreateFile C:\Users\Mark\Desktop\GameBase64\Extras\Videos\desktop.ini PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
    11:46:56.6521633 AM Steam.exe 7916 CreateFile C:\Users\Mark\Desktop\GameBase64\Extras\Videos\desktop.ini PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
      My Computer


  7. Posts : 10,485
    W7 Pro SP1 64bit
       #7

    AM Steam.exe is looking to see if the desktop.ini file is there. The result of that event is "PATH NOT FOUND".

    If you look below those events, you might see where AM Steam.exe creates the folders and the ini file.

    The games might need these folders. You might be able to change the location via some settings in Steam or the game's interface.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 21:59.
Find Us