Solved New and Mysterious File Folders Appearing on my Win 7 Computer

[Maxxwire]

A file folder of this type first showed up on the root of my computer's C drive about 3 months ago. Most recently one also appeared on the computer's attached SSD drive and that was when I began to become suspicious of the nature and origin of these empty folders with special permissions that return after they have been deleted.

Do any of you know or possibly speculate upon the source and purpose of these folders being created on my Win 7 computer over the last few months?

 

[UsernameIssues]

See this post:
http://www.sevenforums.com/general-...-files-creating-external-hdd.html#post2550806

 

[Maxxwire]

Thank you for your timely and reassuring reply! I am still wondering why these folders are recreated each time after they have been removed? Are there additional installations occurring each time they reappear with a new name?

 

[UsernameIssues]

In your System Spec area for this forum, there is a field for Antivirus. You might want to fill that field in so that other members can know that answer without having to ask you

So, what antivirus app are you using? The reason that I ask is: Microsoft Security Essentials (MSE) can create one of these folders with each signature file update. It depends on how you ask MSE to update.* MSE also leaves these folders behind at times.

*edit: If you download the relatively large (~150MB) manual update file, it makes a temp folder.

The folders should be randomly named so as to not interfere with other folders that already exists. If you leave them alone, you will probably just get more of them. Whatever app is creating them, probably does not reuse old folders. It probably creates a new one each time one is needed.

One way to maybe figure out what process made the folder is to:
Right click on the folder and select Rename from the context menu.
Copy the folder's random name into the Windows clipboard.

Open Microsoft's Management Console and load the Computer Management snap-in.
(e.g. Start > right click on Computer and select Manage from the context menu)

Open the left pane to the area shown below...

...then select any entry in the right pane (after it loads).
Use Ctrl-F and paste to find an entry with that folder name.


That said, these are just temp folders. They might not be related to installations (but they probably are). There could be some app creating/using them and not removing them. If we can find the offending app, we might be able to encourage it (via settings) to use a specific temp folder instead of the root of various drives.

 

[Maxxwire]

Thank you for your detailed instructions on how to find out where these temp files are coming from. The next time one of them pops up I will use your suggestions to see if I can find out which app is creating them.

 

[Maxxwire]

Another new file appeared today and so I followed the directions concerning how to determine the source of these folders which keep returning, but the find feature could not locate the file by it's name. Have I somehow made a mistake in the procedure?

 

[UsernameIssues]

As you found out, not all installers will write that random path to the Windows Event logs. Look at the time that the folder with the random name was created. See if the folder creation time corresponds with events in the logs named Application, Setup or System.

It might not be an app installer that is creating these folders. It might be some minor update process. What antivirus product are you using?

 

[ThrashZone]

Hi you might just show what you have installed,
Click Start and type in the search box,
msconfig
Click on the suggestion on top or hit the Enter key,
Go to the Startup section and take some screen shots for a complete list,
Go to the Services section and on the bottom left Check the box to Hide All Microsoft services,
Repeat the screen shots,
Cheers.

 

[Maxxwire]

It might not be an app installer that is creating these folders. It might be some minor update process. What antivirus product are you using?

I am currently using Malwarebytes 2.1.6.1022 along with MSE. It had occurred to me that the folder in question may have been created by MSE when I manually updated it directly through windows update which was very close to the time that the mysterious folder was created. Today there was another MSE update included along with 3 other updates having to do with upgrading to Win 10. I deleted the existing folder to find out if another would be created my the MSE update, but no new folder appeared. I've had this Win 7 computer for almost 5 years and whatever is creating and recreating this folder it just started it a little over 3 months ago. The mystery continues...

 

[UsernameIssues]

The folder in your original post has 32 random characters. MSE creates temp folders with 32 random characters too - but only when certain parts of MSE require updates (scanning engines vs. definitions). You did not see another temp folder because MSE did not need to make one today.

The folder should go away after the update(s) completes. Perhaps something has changed recently that is causing some of them to be left behind. Maybe the change was on Microsoft's side or maybe Malwarebytes has changed and is preventing the rapid creation & deletion of certain folders. Maybe those that use MSE & MBAM could let us know if they see these folders too. Even the automatic updates can create these folders. I've seen computers with 3 or 4 of these folders. I just delete them.


> I deleted the existing folder to find out if another would be created my the MSE update, but no new folder appeared.
While it does not hurt to delete them, they do not get reused. A new one (with a different name) will be created the next time one is needed.


If you want to see one of these folders, use Internet Explorer to download and run one or two of MSE's manual update files. Visit this webpage:
https://www.microsoft.com/security/portal/definitions/adl.aspx
Scroll to the bottom section named "Network Inspection System updates".
See the image in step two.
Take note of all of the version info on that "About" screen.

Scroll back up to the section named "Manually download the latest updates".
Click on the applicable link to download the manual update file. (~150MB)
Select Run. Do not select Save.....
That makes the file download to and run from IE's Temporary Internet Files (TIF) folder. Running from there should cause the installer to create one of these temp folders. The installer might create a temp folder no matter where it is run from. I'm just guessing that running from the TIF folder gives you the best shot at seeing a random folder being created. That said, if no updates are required, the temp folder might be create and deleted too fast for you to see via Windows Explorer. You might need to run Process Monitor to capture the sub-second even.

The manual update file does not make any screens for you to see or interact with. It is kind of hard to know when it has finished. If updates are applied, it may animate MSE's icon in the system tray (notification area). [I do not use MSE and I cannot test MSE inside a virtual machine right now. So all of this is from memory.] After you run that manual update file, check the "About" screen again to see if any of the numbers have changed.

Also, you might want to download/run the manual update file for the Network Inspection System. I'm not sure if the NIS updates are a part of the larger file that you just downloaded above. You tell us

 

[Maxxwire]

The folder in your original post has 32 random characters. MSE creates temp folders with 32 random characters too - but only when certain parts of MSE require updates (scanning engines vs. definitions). The folder should go away after the update(s) completes. Perhaps something has changed recently that is causing some of them to be left behind. Maybe the change was on Microsoft's side.

I first noticed the appearance of one of these folders just after a patch Tuesday update about 3 months ago so as you pointed out these empty files could very well be a result of recent changes in the way that MSE handles it's temp files.

Thank you very much for all of the time and effort that you have put into helping me to find the source of these folders that were being created on my Win 7 computer as well as it's external SSD drive. I want you to know that I genuinely appreciate all of the intricately detailed and very helpful information that you have so knowledgeably posted in response to my inquiry.

 

[Maxxwire]

Case Closed

UsernameIssues- Thank you again for all of your help in tracking down the source of the mysterious folders which had been appearing on the internal and attached drive of my computer. The above documentation provides sufficient confirmation for me to know that the files were indeed being created by MSE as you had suggested all along.

 

[UsernameIssues]

You are welcome. Now let's hope that these folders will start going away as they should.

I should probably check in on some of the MSE users that I support. They might have lots of these abandoned folders :-(

 

[Maxxwire]

Actually I have never seen more than one of these folders at a time. Originally there was one on the root of my C drive that remained there for several months. One day I decided to delete it (because I could) and a singular second file appeared on my attached drive which I became concerned about. As I mentioned before each time I would delete the file another one would appear a few days later, but there was never more than one file at a time on the drive. Thanks to your help and guidance I was finally able to identify the mysterious folder as being created by MSE which was a great relief to me.

 

[UsernameIssues]

If we knew why the automatic deletion sometimes fails, then maybe we could make sense out of why you see one at a time and I've seen 3 different folders in one month on one computer.