PDA

View Full Version : EXTREMELY Hidden File - Desktop.ini


Dazed_and_Confused
April 28th, 2004, 10:29 PM
I'm not sure if this is a legitimate threat, but it concerns me.

For some reason the directory "C:\Documents and Settings\All Users\Documents" on my XP Home PC apparently contains a file called "Desktop.ini". I know this because my virus scanner (NOD32) told me the folder contained this file, but that it could not scan it because it was locked. >:(

When I view this folder in Windows Explorer (with the option to view hidden and system files enabled), the folder shows to be EMPTY. :-\ The properties of the folder, however, shows to contain a single file at 62 bytes.

Why do I feel this is a potential security concern:

1. My virus scanner cannot scan the file (desktop.ini)
2. The file (desktop.ini) seems to be very hidden

A scan of the directory with TDS-3 shows a file to be there, and does not generate an alarm, so I feel a little better. But what's up with this hidden file?? Should I be concerned? ???

bigc73542
April 28th, 2004, 10:35 PM
-{ Quote: "I'm not sure if this is a legitimate threat, but it concerns me.

For some reason the directory "C:\Documents and Settings\All Users\Documents" on my XP Home PC apparently contains a file called "Desktop.ini". I know this because my virus scanner (NOD32) told me the folder contained this file, but that it could not scan it because it was locked. >:(

When I view this folder in Windows Explorer (with the option to view hidden and system files enabled), the folder shows to be EMPTY. :-\ The properties of the folder, however, shows to contain a single file at 62 bytes.

Why do I feel this is a potential security concern:

1. My virus scanner cannot scan the file (desktop.ini)
2. The file (desktop.ini) seems to be very hidden

A scan of the directory with TDS-3 shows a file to be there, and does not generate an alarm, so I feel a little better. But what's up with this hidden file?? Should I be concerned? ???" }-
you might try looking here (http://www.cpcug.org/user/clemenzi/technical/WinExplorer/desktop_ini.htm) or here (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/shellcc/platform/shell/programmersguide/shell_basics/shell_basics_extending/custom.asp)

Dazed_and_Confused
April 28th, 2004, 10:44 PM
Hi, Big C -

Thanks. That explains it. I'm assuming that since Windows is designed to hide desktop.ini files, that this is not a security issue? And NOD32 not being able to scan this file should also not concern me?

bigc73542
April 28th, 2004, 10:49 PM
-{ Quote: "Hi, Big C -

Thanks. That explains it. I'm assuming that since Windows is designed to hide desktop.ini files, that this is not a security issue? And NOD32 not being able to scan this file should also not concern me?" }-
It is a windows file and you don't have to worry about this one. But you did just what you should have done with a file or folder that you don't know about. You can always ask someone here and we will be happy to help. ;)


bigc

Dazed_and_Confused
April 28th, 2004, 10:49 PM
Using the link posted by Big C, I was able to display the file (see attached). Thre are also two more entries that I was unaware of that seem to be two more directories within the .../Documents folder that are unnamed. Am I reading this right?

bigc73542
April 28th, 2004, 10:52 PM
-{ Quote: "Using the link posted by Big C, I was able to display the file (see attached). Thre are also two more entries that I was unaware of that seem to be two more directories within the .../Documents folder that are unnamed. Am I reading this right?" }-
It looks like two empty dirs. and one with 62 bytes. I don't see anything bad. ;)

Dazed_and_Confused
April 28th, 2004, 11:00 PM
-{ Quote: "It looks like two empty dirs. and one with 62 bytes. " }-
Thanks again, Big C ! :-*

I can sleep better tonight now, and that's where I'm headed now.

By the way, I did some testing with the DOS DIR command. Those same two entries that appear to be directories with the dots to the right appear on anytime I do a "DIR /a" command on any folder. So I'm not really sure what that means. I'm not as fluent with DOS commands as I should be. ;)

bigc73542
April 28th, 2004, 11:01 PM
-{ Quote: "Thanks again, Big C ! :-*

I can sleep better tonight now, and that's where I'm headed now.

By the way, I did some testing with the DOS DIR command. Those same two entries that appear to be directories with the dots to the right appear on anytime I do a "DIR /a" command on any folder. So I'm not really sure what that means. I'm not as fluent with DOS commands as I should be. ;)" }-
Anytime I can help.

bigc