Deleted Folder Keeps Returning

[earthprime]

Hi everyone, I have an issue that I've researched and done extensive troubleshooting, but I haven't been able to resolve. I have a folder that keeps re-appearing on my Desktop. I delete it, but it randomly re-appears. Sometimes this happens when I transfer large files throughout my computer, other times it happens when I play a game on Steam. Its very random. The structure of the folder is:

GameBase64
Extras
Videos
Captures

My assumption has been that some program must be writing the folder to desktop. During troubleshooting I've removed every possible program and Firefox browser addon that could cause this, to no avail. I'm to the point that I think I need some program that logs every minor activity on Windows, to tell me what exact process or program created the folder. Can anyone assist?

 

[Ztruker]

Looks like it has something to do with this: GB64.COM - C64 Games, Database, Music, Emulation, Frontends, Reviews and Articles

 

[earthprime]

Upon further investigation, Windows is randomly writing desktop.ini to several places. The GameBase64 folder seems to be one, another is 'My Pictures'. This seems to happen primarily when I download something from the internet or transfer large files. The GameBase64 folder appears because windows is writing desktop.ini to its root. Have you heard of this before?

 

[Jacee]

Do you have 'show all hidden files' checked or unchecked?

 

[UsernameIssues]

Process Explorer set to use VirusTotal might be of interest to you:
http://www.sevenforums.com/tutorial...er-virustotal-check-all-processes-50-avs.html

But Process Monitor should be able to tell you what events are happening just before something writes to those INI files. If you need help using Process Monitor, look for YouTube videos.

 

[earthprime]

I was able to capture the event using process monitor. The main event is below, but I'm unable to interpret it. It looks like Steam.exe is writing Desktop.ini to the folder, with the actual Gamebase64 creation in the final lines below:

11:46:56.6513340 AM Steam.exe 7916 RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions SUCCESS Desired Access: Read
11:46:56.6513653 AM Steam.exe 7916 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286A68-3C57-41A1-BBB1-0EAE73D76C95} SUCCESS Desired Access: Read
11:46:56.6514027 AM Steam.exe 7916 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions SUCCESS
11:46:56.6514170 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Category SUCCESS Type: REG_DWORD, Length: 4, Data: 4
11:46:56.6514291 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Name SUCCESS Type: REG_SZ, Length: 26, Data: Local Videos
11:46:56.6514385 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParentFolder NAME NOT FOUND Length: 144
11:46:56.6514474 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Description NAME NOT FOUND Length: 144
11:46:56.6514550 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\RelativePath SUCCESS Type: REG_SZ, Length: 14, Data: Videos
11:46:56.6514648 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParsingName BUFFER OVERFLOW Length: 144
11:46:56.6514733 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParsingName SUCCESS Type: REG_SZ, Length: 176, Data: shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}
11:46:56.6514840 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InfoTip SUCCESS Type: REG_EXPAND_SZ, Length: 84, Data: @%SystemRoot%\system32\shell32.dll,-12690
11:46:56.6514929 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalizedName SUCCESS Type: REG_EXPAND_SZ, Length: 84, Data: @%SystemRoot%\system32\shell32.dll,-21791
11:46:56.6515018 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Icon SUCCESS Type: REG_EXPAND_SZ, Length: 80, Data: %SystemRoot%\system32\imageres.dll,-189
11:46:56.6515103 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Security NAME NOT FOUND Length: 144
11:46:56.6515183 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResource NAME NOT FOUND Length: 144
11:46:56.6515255 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResourceType NAME NOT FOUND Length: 144
11:46:56.6515344 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalRedirectOnly NAME NOT FOUND Length: 144
11:46:56.6515420 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Roamable NAME NOT FOUND Length: 144
11:46:56.6515500 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PreCreate SUCCESS Type: REG_DWORD, Length: 4, Data: 1
11:46:56.6515581 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Stream NAME NOT FOUND Length: 144
11:46:56.6515657 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PublishExpandedPath NAME NOT FOUND Length: 144
11:46:56.6516000 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\DefinitionFlags NAME NOT FOUND Length: 144
11:46:56.6516161 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Attributes SUCCESS Type: REG_DWORD, Length: 4, Data: 1
11:46:56.6516250 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\FolderTypeID NAME NOT FOUND Length: 144
11:46:56.6516317 AM Steam.exe 7916 RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InitFolderHandler NAME NOT FOUND Length: 144
11:46:56.6516509 AM Steam.exe 7916 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag SUCCESS Desired Access: Read
11:46:56.6516817 AM Steam.exe 7916 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95} SUCCESS
11:46:56.6517241 AM Steam.exe 7916 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5 SUCCESS Desired Access: Query Value
11:46:56.6517375 AM Steam.exe 7916 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\KnownFolders NAME NOT FOUND Desired Access: Query Value
11:46:56.6517464 AM Steam.exe 7916 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5 SUCCESS
11:46:56.6517620 AM Steam.exe 7916 RegOpenKey HKCU SUCCESS Desired Access: Read
11:46:56.6517759 AM Steam.exe 7916 RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS Desired Access: Read
11:46:56.6517884 AM Steam.exe 7916 RegCloseKey HKCU SUCCESS
11:46:56.6517973 AM Steam.exe 7916 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{35286A68-3C57-41A1-BBB1-0EAE73D76C95} SUCCESS Type: REG_EXPAND_SZ, Length: 94, Data: %USERPROFILE%\Desktop\GameBase64\Extras\Videos
11:46:56.6518647 AM Steam.exe 7916 RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS
11:46:56.6520812 AM Steam.exe 7916 CreateFile C:\Users\Mark\Desktop\GameBase64\Extras\Videos\desktop.ini PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
11:46:56.6521633 AM Steam.exe 7916 CreateFile C:\Users\Mark\Desktop\GameBase64\Extras\Videos\desktop.ini PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

 

[UsernameIssues]

AM Steam.exe is looking to see if the desktop.ini file is there. The result of that event is "PATH NOT FOUND".

If you look below those events, you might see where AM Steam.exe creates the folders and the ini file.

The games might need these folders. You might be able to change the location via some settings in Steam or the game's interface.