Strange folder on desktop

[ROBO731]

I noticed a strange folder that had been generated on my desktop. The folder is called "Rar$DRb0.302" Here's some of the things I had been doing prior to noticing the folder relatively in the order that they happened :

-Archiving with winrar (locking, setting passwords, etc...)
-Launched Hamachi
-Launched Privoxy
-Launched mIRC
-Downloaded video through XDCC
-Watched video with VLC
-Closed video and saw the folder on desktop
*Had Firefox, Skype, and TeamvViewer, (also some applications that always run in the background, but those are the notable ones) open the whole time

Let me know if there's any other info you need, I'd be glad to provide it.

 

[ICIT2LOL]

Hello ROBO might be an idea to scan with SuperAntiSpyware and Malwarebytes if you haven't already as it seems like some sort of adware. But I stand to be corrected.

SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer

 

[Duzzy]

This has something to do with Winrar. Generally folders with names similar to this are created in your temp folder when you open or view a file from within a RAR file and are deleted when you close the RAR file.

Not sure why it's on your desktop though, is it empty?
Has WinRAR closed properly, no WinRAR process showing in Task Manager?

Most likly a glitch in WinRAR and can safely be deleted but it couldn't hurt to run a AntiSpyware, AntiMalware program to put your mind at rest.

 

[ICIT2LOL]

Hum Duzzy that is why I thought some ads might have been downloaded with the stuff txr has been using - you know what it is like

 

[ROBO731]

Thanks guys, now that I think about it I changed winrar's default save location to my desktop from the temp folder so maybe that's why it's there. I'll run the antimalware programs you guys suggested just to be safe. I've already run avast, but you can never be too safe. I had to turn my computer off last night, but now that I've turned it back on the folder is gone.

Update: I just noticed another file, it's in my documents folder, it's a remote desktop connection file called "Default.rdp" Just like the folder it's zero bytes. The date modified says 7/16/2012 1:36 PM and it's a hidden file. Now I'm getting a little nervous.

Update 2: I did a search for other folders that begin with "Rar" in the temp folder and found four others. They seem to be for virtuadub.

Update 3 (sorry for all the updates): I temporarily disabled avast and when I opened firefox a window at this address opened: http://69.31.136.5/defaults/sendspace-pop.html I believe it's been trying to open recently when I open firefox, but it usually gets blocked.

 

[ROBO731]

I finished all of the scans, none of them detected any issues other than tracking cookies.

 

[ICIT2LOL]

Sorry late reply mate been working. Try a look in msconfig > Start > type - msconfig (on it's own) > go to the Start button as in my pic and just tick the OS and the security mine has my UPS GUI it is up to you what you want to run but you only need those at startup/ There are more things in this panel you can change to speed up the machine too - just see -

http://www.sevenforums.com/tutorials/11728-optimize-windows-7-a.html?filter[2]=Performance Maintenance

For the rest of the changes plus others it is a must in my mind

Meant to say if you move that bar over next to Microssoft Manufacturer / Command it will show what is there ie OS whatever.

 

[ROBO731]

Thanks.

 

[robertwnielsen]

I'm surprised nobody has mentioned this yet -- do you have "Show Hidden Files" enabled? (Check in Windows Explorer under Tools\Folder Options\View

Just my $.02 worth (if it's worth that much).

 

[ROBO731]

Yes, I do have it enabled. I believe that's the reason that I first saw the default.rdp.

 

[ICIT2LOL]

No probs ROBO in that msconfig you can also disable the stuff in Services too just "hide" the Microsoft stuff and do some sorting. There are some other options but for now you should ok and yes robert is right too you could try that

 

[ROBO731]

Will do, thanks for all the help guys.