A folder constantly recreated without knowledge

Hi drragostea, Yes, it does sound creepy, I agree. I see you were looked after by LDTate in October 2008. Are there any other spooky things happening on your system or is the one described the only issue at this present time. Others will voice their opinion here, but maybe your system has been compromised again so a New Year visit to the HJT forum maybe in order for you. Keep us posted please. Best regards,

I think it's a little too much to say my machine has been "compromised" because I'm pretty sure I double check the stuff I do.

There doesn't seem to be anything odd going lately, not that I'm aware of and a SAS, MBAM, a2 scans came back clean.

I can't seem to describe the problem any further because the problem is just so… like so little to describe about.
It doesn't happen on specific times just randomly. Like it is created only once each day (I use the computer everyday).

Do you think I should go to the Malware Removal Forums to have it checked out? Or any tools that can diagnose this problem?

I'll try to remove McAfee SiteAdvisor and see if this resolves it. At the moment I'm not sure. It seems like the problems started occuring after I installed the new version of SiteAdvisor 2.9. I'll remove now and see how it goes tomorrow.

Thanks again tallin.

Take care.

Hello again,

Yes try this diagnostic tool, follow the link and post back how you go….

I see you are running FF 3. I was going to give you this link, but I think it is only for IE, but you can check it out as it would be a good alternative to McAfee Site Advisor.

Run the tool first. Maybe you should post a log in the HJT forum, however I would wait until some of the other techies wake up to see if they have alternatives for you to try.

Let us know how you go with the diagnostic tool.

Best regards,

Edit:Here is WOT for Firefox

drragostea,

Shot in the dark guess…

Are you a FireFox Browser user?
If so, do you have the "Save in Folder" Add-on installed?

Doug

Hello Drragostea. I deduce from your log here that you have uTorrent installed. uTorrent downloads all the files onto the hard drive, by default, into the following location:

C:\Documents and Settings\Administrator\My Documents\Downloads

So whenever you will run uTorrent, the folder will be recreated so that uTorrent can automatically download / seed the files within it. All in all, it is nothing to worry about. Just a word of caution; please proceed with care while using BitTorrent programs as they are the biggest source of Malware out there.

Hope that helps.

– Mohit

Hello again and thanks for all the help. Doug, I'm a Mozilla Firefox user (3.0.5) but I do not have any "Save in Folder" add-on, but thank you. Mohit, I've uninstalled uTorrent completely (removing it using Revo Uninstaller) a few months ago, so I'm pretty sure it is not that. Thanks tallin. I have WOT installed for Firefox (I use Firefox more often), but it doesn't seem like the problem because WOT was installed a few months ago and it didn't cause any trouble. The DirectX diagnostic tool came back clean (no problems). Thanks again for your knowledge and effort .

Let's have a look at what you do have running from Startup.
It's possible you have a culprit in there that you weren't aware of.

Please consider running this simple utility that will help you get control of programs and processes that you wish to have running active, or not.

CodeStuff-Starters
http://www.snapfiles.com/get/Starter.html

Download and install, agreeing to the licensing terms and allow to install with all of the default settings as preselected in the installation wizard.

When you finally allow CodeStuff-Starters to run
It will preselect StartUps Tab

• Click on File
• Select - save as Plain Text (name the report file - Startups Dec26.txt)

In your next reply, post the file as an attached file (use browse and upload buttons – at the bottom-right corner of your topic posting window where you are typing your next reply)

Then as you are reviewing these items that are running actively, give us your own best judgment of the ones that you intentionally want to have running (and consuming resources) and the ones that you either don't recognize or think you can do without.

Please do not make any changes with Code-Stuff Starters, until after you post the requested information above and receive recommendations from a helper here.

Best Regards

This folder doesn't seem like it's being created anymore, so I guess this thread is resolved. I'll give it a few more days and see if the folder is still created. Thanks Doug and all who contributed.

I'll just copy and paste the log because I don't think it's really necessary to upload it and such .

Name,Value,Section,Enabled,Description,Company
"avast!","C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe","Registry - Machine Run","1","avast! service GUI component (avast! Antivirus )","ALWIL Software"
"BOC-427","C:\PROGRA~1\Comodo\CBOClean\BOC427.exe","Registry - Machine Run","1","COMODO BOClean - Anti-Malware","COMODO"
"COMODO Internet Security",""C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h","Registry - Machine Run","1","COMODO Internet Security","COMODO"
"Win.ini"," ","Win.ini Run","1","",""
"Win.ini"," ","Win.ini Load","1","",""
"WinPatrol","C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot","Registry - Machine Run","1","WinPatrol System Monitor ( WinPatrol Monitor)","BillP Studios"

I am not familiar with these two items appearing in StartUp

"Win.ini"," ","Win.ini Run","1","",""
"Win.ini"," ","Win.ini Load","1","",""

Please do attach the list, instead of the copy/paste.

Note:
neither Pac's Portal, nor BleepingComputers lists win.ini as a common item in Startup.

If the full CodeStuff Starters - StartUp(tab) panel shows win.ini as an executable, you "may" have identified a problem.
Further investigation is recommended.

Note: it may just be the way the copy/paste captured the above items, and they will fall into place with the full display.
I do not wish to cause you alarm and most likely the full panel will show the items correctly as a support portion of one or more of the other items.

That's the odd thing, this entry never came up before. And I have no idea where the source is. I'm thinking nothing will happen because the value is blank (is it?). I currently have it disabled. The folder doesn't seem like it's being created "anymore", but I can't be sure. I think it's because of McAfee's SiteAdvisor 2.9 (it seems to me like that's when the folders began appearing).

Now it seems like it's reappearing again. Just not so often. Now I can't even be sure if McAfee's SiteAdvisor is the culprit.

Another "long shot" guess… Have you installed Chrome Browser from Google?

Well to state the implied obvious, it's most likely a program that is automatically creating this folder.

We can also assume that it's a program run on a schedule, or it is a program you often use and thus the folder is often created. Try deleting the file, and then leaving Windows Explorer open in My Documents. Then run some of the programs you use every time you turn on the computer and check My Documents after each one to see which program re-created the folder. Make sure to press F5 each time to refresh Windows Explorer, also the folder would appear at the bottom unless you have auto-arrange on.

You can also try right clicking on the folder and going to the Security Tab. Then, click on your user group and check all the Deny boxes except for "Full Control". What this should do is cause an error to occur whenever the program tries to do anything to the folder. It's another long shot but the title of the error box may contain the name of the program trying to access it , and then we have our problem causer. As for the Security Settings, leave them on deny for a couple of days as it could be any program you use, or even one you don't, it could be self-run on a schedule.

Both of the above are basic theories but since it appears no one has anything solid yet, I'd give them a try. I would set up the second part first, and then when you go through the programs you may get the error and know which program it is, either way it's the same idea of trial-and-error.

Doug: Your long shot was successful. It hit the target (Nah, I'm only kidding). Could Google Chrome be the culprit? How? Thanks Vectris, that's a good idea. Except, er I think Doug hit the spot. But thanks.