odd folders........!

[indrajit]

I’m using Win XP Pro with SP2. I have a 40 GB hard disk split in three partitions namely C (system), D and E.

Since a few days I’m noticing three folders in my D drive by the name 1eaec33d759, 5266d644c14fa3548b706e and a469cc426d55e67413d851cf20d.

All the three folders have a sub folder by the name sp1, which cannot be accessed or deleted. On clicking on sp1 it says access is denied.

Does any one have any clue what these are? I’m using eTrust EZ Antivirus (regularly updated) and it didn’t detect these as virus. I’ve scanned using stinger too.
Any suggestions?

[vysakh]

have u installed windows XP SP1
looks like it is a temporary folder

[indrajit]

I used to update Windows from net, but don't remember instaling SP1. As I said, I'v installed SP2.
But even if those are folders caused due to SP1 why are they inaccessible?

[NikhilVerma]

If they are in some floder named temp or msdownload.temp etc.etc then you can delete it..

Other wise if it's in program Files ... Then never delete it.... they might be essential for the running of the system...

[indrajit]

I already mentioned the names of the folders in the starting post. They are in my D drive, not in system drive and except for the name of the sub folders (SP1) nothing suggests they have any connection to Microsoft related products. And then again SP1 might not nescessarily be Service Pack 1.

[theraven]

try starting in safe mode and delete it
or get the taskmanager up
shutdown explorer.exe process
from file=> run type cmd
and now browse to ur folder and manually delete the folders using
"deltree <folder name>"

SP1 = service pack 1 or no ... the folder is not required

[NikhilVerma]

Just place the folders somewhere else... And If you system works fine then delete them....

It's that simple

[indrajit]

Originally Posted by NikhilVerma

Just place the folders somewhere else... And If you system works fine then delete them....

It's that simple

I told this before, the folders are inaccessible, can't move or delete them. Even can't get inside the sub folders; says access is denied!

@ Raven: I'll try your suggestion and post whether it was a success or not.

[IG]

might be from sys restore...

[Ashis]

Hide Them (If possible) or delete them in Safe Mode as mention Earlier.

[it_waaznt_me]

Hmm.. Those folders are usualy created by WindowsUpdate .. You can safely delete them ... To find which program has locked that folder you can use WhoLockMe ..

[Aseem Nasnodkar]

I guess they r system folders of sp. I have seen them on my sys too

[indrajit]

Originally Posted by Raven

try starting in safe mode and delete it
or get the taskmanager up
shutdown explorer.exe process
from file=> run type cmd
and now browse to ur folder and manually delete the folders using
"deltree <folder name>"

Tried what you said, didn't work.

Originally Posted by Batty

Hmm.. Those folders are usualy created by WindowsUpdate .. You can safely delete them ... To find which program has locked that folder you can use WhoLockMe ..

My OS is Win XP PRO.
Installed WhoLockMe. When I right clicked on those folders and clicked on WhoLockMe nothing happened. I use PC Security to lock folders. I tried WhoLockMe on one of the folders locked by me using PC Security but this time too nothing happened.
Tried to delete the folders using TuneUp Shredder (component of TuneUp Utilities), but got the same message, "Access Denied"!

Arrrgh! HELP!

[busyanuj]

Originally Posted by theraven

and now browse to ur folder and manually delete the folders using
"deltree <folder name>"

The deltree command doesn't run in XP.

Originally Posted by indrajit

My OS is Win XP PRO.
Installed WhoLockMe. When I right clicked on those folders and clicked on WhoLockMe nothing happened. I use PC Security to lock folders. I tried WhoLockMe on one of the folders locked by me using PC Security but this time too nothing happened.
Tried to delete the folders using TuneUp Shredder (component of TuneUp Utilities), but got the same message, "Access Denied"!

Arrrgh! HELP!

if you have a second OS installed, boot from it.
you will be able to delete the folder from there.

[indrajit]

Originally Posted by busyanuj

The deltree command doesn't run in XP.

Yep! Didn't work.

I'v Win XP Pro and Red Hat Linux 8 as two OSs. Can't delete anything in windows from Linux! So that wont help. Can't format the drive cause it has got huge amount of data. And btw the folders are not harming me in any way, its just irritating!

[it_waaznt_me]

Hmmm... Does this thing help ... ?

[indrajit]

Originally Posted by it_waaznt_me

Hmmm... Does this thing help ... ?

I think "dellater" can work with a file only. Mine are folders. Tried it. Didn't work.

[theraven]

aah jsorry abt the deltree command
when u get to cmd after shutting down explorer ..
tru gettin into the folder by using the "cd" command
then in each folder and sub folder run "del *.*"
after all folders and sub folders are empty u can remove them by using the "Rd" command

[ShekharPalash]

do following things... and report...

properties>customize is accessuble or not??
is "read-only" or hidden is grayed out?

kill explorer and all WU services and try to move/delete

post ur hijackthis log... may be some naughty startup stuff using them...

check ur drives for eror... defrag them...

hey!... did u inteeeerrrupttt the process when u tried to delete them thru tune-up shredrer???

if yes, then it could create problem... i had a similar case... when i tried to delete shortcut of max payne 2 from my start menu....

access denied... no move no delete... even righclick were not working on it.... but when i uninstalled max payne 2 after 1 month that shortcut also removed....

why don't u try to uninstall some WUs if you have their backup... and WU ebsite is always there to get them... ??

also if u hav system retore enabled and have a restore point before all these irritation started.... restore it back!

but don't forget to backup ur current file

njoy.

[indrajit]

@Raven:

When I got inside the directory and typed “del *.*� it asked for deleting confirmation. I typed in ‘Y’ and then checked using ‘dir’. The sub directory ‘sp1’ was still there. From inside the folder I tried “rd sp1� but says ‘access is denied’.

@ShekharPalash:

Yes, properties>customize is accessible. The folders are marked read only and no option is grayed out. Tried deleting after unchecking read only, didn’t work.

What do you mean by "WU services"?

Already defraged the drives and checked using scandisk. No error.

These folders are there for quite sometime. Don’t remember how long exactly they have been there. So trying system restore is a problem cause that will cause several unwanted changes in the system.

hey!... did u inteeeerrrupttt the process when u tried to delete them thru tune-up shredrer???

Didn’t get you.

This is my HijackThis Log:

Logfile of HijackThis v1.98.2
Scan saved at 11:28:16 AM, on 11/13/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\winser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\winwd.exe
C:\WINDOWS\sdaemon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\Tapas\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rediff.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://crackspider.net/ie/assist.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CHotKey] mHotkey.exe
O4 - HKLM\..\Run: [EPSON Stylus C41 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C41 Series" /O6 "USB001" /M "Stylus C41"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SDaemon] C:\WINDOWS\sdaemon.exe
O4 - HKLM\..\Run: [SWd] C:\WINDOWS\winwd.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096662908781
O17 - HKLM\System\CCS\Services\Tcpip\..\{58769E06-2020-4F49-AC41-2A23548D595F}: NameServer = 172.100.10.1

[Deep]

ok give this a try and see

open task manager end explorer.exe

then file - new task - select that folder and delete it...

see it works or not...

after this write explorer in new process to start the explorer again...

telling this to you coz those explorer might be using that folder for some reason..

just give it a shot and see..

Deep

[it_waaznt_me]

Hmm.. Try shutting down PC Security before deleting that folder ... And you can safely disable the Dumprep entry from startup list ..

[indrajit]

Originally Posted by Deep

ok give this a try and see

open task manager end explorer.exe

then file - new task - select that folder and delete it...

see it works or not...

after this write explorer in new process to start the explorer again...

telling this to you coz those explorer might be using that folder for some reason..

just give it a shot and see..

Deep

Didn't work!

Originally Posted by it_waaznt_me

Hmm.. Try shutting down PC Security before deleting that folder ... And you can safely disable the Dumprep entry from startup list ..

Didn't work!
And btw, disabled dumprep....thanx batty!

Do I have any other option left than to format if I ever want to get rid of those folders?

[Deep]

if the folders are not taking much of size then let it be there...
will try to find the solution in the mean time...

Regards
Deep

[indrajit]

Originally Posted by Deep

if the folders are not taking much of size then let it be there...
will try to find the solution in the mean time...

Regards
Deep

The properties of the folders show "0 bytes". So space is not a problem. Its just that the thought of there being somethin on my PC that I can't control is disturbing, if not irritating! I'll wait eagerly till any of you guyes can come up with a solution.
Thanx to all you guyes who took their time to try and help me!

[Deep]

ok man..
give this a try...

change attributes of the folder and try...

current attribute might be read only and system..

so do this..

in command window write this..

attrib -r -s d:\foldername

this will remove attributes read only and system from the folder and then try to delete it

Regards
Deep

[indrajit]

@Deep: Same message



sp1 happens to be the sub folder inside each of those three folders, if you didn't know that already.

[busyanuj]

Originally Posted by indrajit

Do I have any other option left than to format if I ever want to get rid of those folders?

if your partition is FAT32, mount it in write mode from Linux (giving Linux write permission to the fat partition) and delete the folder from there.

NTFS will not give write access to Linux, so this solution won't work for NT file system.

[beyondthegracefgod]

Use spybot snd.In it u have a tool called secure shredder put the folder in it.It'll surely chop off ur problem.

[indrajit]

Originally Posted by busyanuj

if your partition is FAT32, mount it in write mode from Linux (giving Linux write permission to the fat partition) and delete the folder from there.

NTFS will not give write access to Linux, so this solution won't work for NT file system.

My file system is NTFS, and on this particular drive I'v got the "compess drives to save disk space" option on. So, if I try to convert back to FAT32 fille system I might risk losing important data. So, till I get the chance to back up this drive (9.76 GB), can't try out your suggestion.

Originally Posted by beyondthegracefgod

Use spybot snd.In it u have a tool called secure shredder put the folder in it.It'll surely chop off ur problem.

Secure Shredder works with files not folders. The folder I'm having problem with is inacccessible, so can't add its contents (if any) to the shredder's window!