What is this strange user folder?

[stanhilliard]

My Windows 7 pro laptop contains a user account folder that is not a user in the ordinary sense -- there is no login for that user. Its name is /stan_2/ and is a sub-folder to /Users/. My normal user name is stan, but I have the folders /stan/ and /stan_2/. Explorer says /stan/ was created 12/07/09, /stan_2/ was created 09/05/14.

The /stan_2/ folder contains only eight NTUSER.DAT files with various additional extensions, plus an AppData folder. The 8 NTUSER.DAT files are all dated 08/22/15. The AppData folder is dated 09/05/14.

When I drill down on the AppData folder there are three files -- two of them dated 09/03/15 (today) and the other 09/05/14. The path to those files is /Users/stan_2/AppData/Roaming/Real/RPDS/db/. The files are named library.sl3, library.sl3-shm, and library.sl3-wal.

What might my this user-folder be?

What should I do about it?

 

[paul1149]

It's Real Player Desktop Service, which is part of the RP Cloud service. Apparently RP takes it upon itself to create a separate Windows account in order to manage cloud syncing. Sounds bizarre, but that's all I can surmise. Maybe it's to get around open/locked file permissions, but this is the first I've heard of this technique being used. There's a lot of displeasure about the software and the way it digs deep into Windows, and that's even without people knowing about this user account business.

And RP doesn't make it easy to get it off the system, either. See HERE for removal instructions that seem to work (untried, as I will not have RP on my machines).

 

[stanhilliard]

And RP doesn't make it easy to get it off the system, either. See HERE for removal instructions that seem to work (untried, as I will not have RP on my machines).

Thanks. I think I removed Realplayer from my system:

1) I checked add/remove programs. Real was not listed.
2) There were three next-level subfolders in Crogram Files (x86)\Real\ I found two uninstall files and ran both: uninst.exe, r1puninst.exe
They do not delete themselves. Running them a second time causes them to try to reinstall.
3) I deleted the sub folders one at a time and then the main \Real\ folder.
4) I deleted the unwanted user folder and subfolders: \Users\stan_2\

I can't find any evidence of Realplayer remaining.

 

[paul1149]

I would also check Start / Run / services.msc for RPDS. Disable if there. Then check Admin Tools / Scheduled Tasks for anything RP. Then watch that user profile for a while and see if anything is updating it. When the dust settles, you should be able to delete it. But I would take a disk or partition backup image first, because I like covering myself.

 

[stanhilliard]

I didn't find any sign of RP in services or scheduled tasks. What should I be looking at for user profiles -- or is that the users folders?

 

[paul1149]

Yes, the user folder hierarchy at C:\Users. Look for updated timestamps.

 

[stanhilliard]

I thought I had Realplayer licked.
Then I came across it in Firefox Plugins. It was set to notify me before starting but I never used it or if I did it didn't notify. I set it to disabled.

There was no delete button or procedure. The plugin install location was at: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\.

There were about 20 subfolders under \Real\. They included plugins for all popular browsers. The date that \Real\ was last modified was 9.4.15 at 11 pm. That was about the time I was working on this problem.

I couldn't find any files that looked like uninstallers. I renamed the Real folder to xReal.

 

[paul1149]

According to this, that should have removed the plugin from firefox immediately. If so, you should be set. Make sure there are no bad effects, then after a time you should be able to delete the folder entirely. At the time that article was written, Mozilla was allowing third parties to install plugins without user knowledge. Not sure if that's still true or not, but I definitely don't like the policy.