What is this folder - "Apps" in appdata/local/

Callender said:

Well I've checked for anything that was modified/ created/ installed anywhere near that time/ date and have come up with nothing. It's possible that those folders were created by a program that I installed but have since removed. I have a habit of clearing out logs and junk on a fairly regular basis so possibly that's why I can't find anything else.

I've got an idea that it could be something to do with VMWare Player which I did install around that time but have since removed. I can't say for sure though.

A suggestion:

Perhaps try running Nirsoft's LastActivityView v1.06

It might show what was installed at that time even if it's since been removed.

Out of all this is there any indication of anything malicious?

Callender said:

Keyes said:

Out of all this is there any indication of anything malicious?

No. Nothing to indicate that at all.

So is there any new info on this?

Callender said:

Here's what I found:

ClickOnce applications are installed under the profile of the user who installed them.

On windows Vista and Windows 7, you will find the ClickOnce cache here: c:\users\username\AppData\Local\Apps\2.0\obfuscatedfoldername\obfuscatedfoldername

.net - How to get folder path for ClickOnce application - Stack Overflow

Also see: Uninstall ClickOnce clients - Stack Overflow

Does windows ever use click once for anything? I dont download clickonce my self.
I have deleted the folder and it hasn't come back. Im still quite confused of its origin. The only clickonce files (.application extension) I have are from steam games, howver they are quite old. Unless maybe a steam downloaded an update for them, imdont know, or if running the games somehow activates it.

Callender said:

As far as I can work out it's used when a user clicks a hyperlink in a web browser to install an application and the app then installs.

See: ClickOnce manifest build automation tool for Microsoft.Net ClickOnce - clickoncemore.net

I'm struggling to find actual examples of applications that use it but it seems that Google Chome is or was one such application.

See post 5 here: c# - How does Google Chrome manage to execute installation automatically after download? - Stack Overflow

Would .application files create any folders there? I have 4 .application files related to games, and the only thing I think of if it was a setup file when installing or something.

Callender said:

As far as I can work out it's used when a user clicks a hyperlink in a web browser to install an application and the app then installs.

See: ClickOnce manifest build automation tool for Microsoft.Net ClickOnce - clickoncemore.net

I'm struggling to find actual examples of applications that use it but it seems that Google Chome is or was one such application.

See post 5 here: c# - How does Google Chrome manage to execute installation automatically after download? - Stack Overflow

I have found a registry key related to the temp folder name. In

Hkey_classes_root/software/microsoft/windows/currentversion/deployment/sidebyside/2.0


Inside the 2.0 key are 7 other keys.

Assemblies
Categories
Components
Installations
Packagemetadata
Visibility
Visibilityroots

There is a key named clickonce35sp1update, witha a value that shows a directory to the apps folder, however its date indicates it was created when the os was installed. Are we getting closer to finding out?