Strange files

Topic

New Reply

In Windows Explorer I have a large nuimber of files in my root directory in the format {752FACFB-A3BB-404C-B6AF-A6229A82E268}. What are these and can I delete them without problems?[/SIZE][/FONT]

Reply | Quote

Replies

Those are most likely folders left over from software installations. As long as you don’t have any pending re-boots you can delete them.

Have you looked at the contents?

If you are nervous about deleting them you could move them to an external drive for a while and see if the system complains. Or rename them by changing one digit or letter and see if the system complains.

Joe

--Joe

Reply | Quote

They are not folders, but individual files, mostly less than 10KB. I have tried to open them with Notepad or Word but all I get is garbage. Renaming all of them would be a task and a half, there are 33 of them!!

Reply | Quote

They are not folders, but individual files, mostly less than 10KB. I have tried to open them with Notepad or Word but all I get is garbage. Renaming all of them would be a task and a half, there are 33 of them!!

I have been using a powerful and rather full-featured bulk rename utility called (surprise!)
Bulk Rename Utility from http://www.bulkrenameutility.co.uk/Main_Intro.php

Makes renaming files easy.

Reply | Quote

You are looking at less than 500 MB of space. How large is your HD? I would not worry about them. This is a fairly inconsequencial amout of space in today’s HD’s.

Reply | Quote

I like the idea of just moving them somewhere else, like another HD, a CD or flash drive, etc.

Sometime it’s not the size of the file that is a burden, but the very fact that the file has to be scanned over and over every time your AV or AS software does a scan. Even a defrag, has to deal with extra files every time it’s run.
Remember this quote, “Minus crud is cool!”

I run several different programs, even one that I wrote myself, to get the junk off of my hard drive.

Cheers Mates!
The Doctor

Reply | Quote

I find it strange that no-one has been able to tell me exactly what these files are. JoeP517 thought they were most likely folders left over from software installations, so he obviously wasn’t sure. I pointed out in my response that they were in fact files, not folders, but I have heard nothing further.

Reply | Quote

It is possible that the people who have looked at this thread have not suffered the same problem and are unable to give a concrete answer.

To be honest, you don’t give much to work on, for example what version of Windows does this occur in? What other software do you have installed that may update itself periodically? When were these files created?

Reply | Quote

I am running Windows XP Home SP3, updating software includes Norton Internet Security 2011, Malwarebytes, Superantispyware, AdAware. The files were created on a range of dates from Sept 2010 to April 2011. I also have a dozen similar files on a networked PC created between October and December 2010.

Reply | Quote

Because no one but you can attempt to open these files to examine them, we can only guess what they are. Would you like someone to guess then definitively say delete them with the possibility of hosing your system. OK, go ahead and delete them. If something untoward happens to your system it’s not my fault, I can not look at your system so I also can only guess what these are. Also, many of us have switched to Win 7 so can not look at similar files on our systems.

So we have made our best guesses what they are. The best guess appears to have been put forth by Joe. Create a good Image of your system, move the files somewhere or delete them and see what happens. I for one can not afford to travel to your home to examine the files myself so can only make a guess as well.

Reply | Quote

No, I was not expecting anyone to “guess” what these files were. I just felt that the unusual format of the file names may have been recognised by someone.

Reply | Quote

Have you tried right-clicking any of those files and checking “properties”? You might find some relevant info there.

If that doesn’t work, you could, if you wish to test if they are vital/relevant, delete them. Do not empty them out of the Rubbish Bin – leave them for a week or more to see if your system behaves OK without them.

Reply | Quote

I have tried that but it gives no useful information. In the description window it merely repeats the file name.

Reply | Quote

No, I was not expecting anyone to “guess” what these files were. I just felt that the unusual format of the file names may have been recognised by someone.

The name format looks like GUIDs to me. A GUID (Global Unique ID) is a string that is supposed to be guaranteed unique, like a VIN number on a car. Some programs use them while installing, or in the registry. If you create a GUID and allocate it to a specific version of a program, it should never be used by anything else, so you can tell if it has been installed before, or keep info for it in the registry attached to that as a key, or whatever you’re trying to do. This is why they’re sometimes used for install folders – you can create the folder during the install without worrying you’re going to clash with anything else, and then after a reboot (or during uninstall) you know that folder was yours.

You can create them on the fly, so they’re sometimes used for temporary working files for the same reason – create a new GUID, name your file that, it should never clash with anything else. If you delete it after use, it’s cleaned up, no harm done. You’re supposed to put this stuff in the TEMP location, so if you crash and leave stuff behind, it’s easier for people to realise it’s junk. But if your TEMP points to a missing location, or the programmer is lazy or clueless, C: is sometimes used.

Unfortunately, the name itself means nothing – it’s just a code. So these could be crap left over from some sloppy program, or they could be parts of an install, or some program could actually be expecting them to be there and need them – you can’t tell without moving/deleting them and seeing what happens. You could try searching for an individual string and seeing what you find – if they are associated with a specific program you may get a hit. But if they’re just for temp files and generated on the fly, then by definition they should only be on your machine.

Reply | Quote

I’m somewhat surprised no one came up with this earlier: 128 bits worth of hex COULD be IPv6 addresses, but is unlikely to be when formated as you’ve described. One way you could likely get a clue whether they’re temporary junk that can be deleted or might actually be significant (though competent software really shouldn’t have left them around in the first place, especially in your root directory) is to search the Registry for the same names (if you get hits, they should not only provide an indication of who the culprit is but could suggest that the culprit might still be depending on them; if not, they’re likely just left-over temporary trash, though moving them temporarily elsewhere to see if anything breaks would still be prudent).

Reply | Quote

In Windows Explorer I have a large nuimber of files in my root directory in the format {752FACFB-A3BB-404C-B6AF-A6229A82E268}. What are these and can I delete them without problems?[/SIZE][/FONT]

philkiwi,
Hello… I have a question ..you mention “root directory” … What exactly are you meaning ? Most of these type are located in “Temp”…. could you post a “Screen Shot” . Also if you configure it …(View>choose Details> Date Modified) you can see when these “things” were created ….possibly a clue.:cheers: Regards Fred

Reply | Quote

Root directory is the top-most direct28205-screen2ory on my PC, otherwise shown as C:. I have taken two screen shots as these strange files take up more than can be shown on the monitor at one time.28204-screen1

Reply | Quote

philkiwi,
Hello… there are a few clues …
1.Try to open the folders ..ones with the similar numbering, e051…etc.
2.Noticed the repetitive files and times and dates 5829KB…like something is running on “Auto”
3.What is “NPE.exe” bottom of screen shot?…has similar size. :cheers: Regards Fred

Reply | Quote

e051… is full of files, many of which are MUI files and seem to be Microsoft files related to Internet Explorer 8. ec29… is empty apart from a sub-folder called Update which is also empty. NPE.exe is Norton Power Eraser.

Reply | Quote

I suspect that these are temporary files created during application installs/updates. They are probably images of Registry entries (if you search your registry you may find lots of them e.g. in HKEY_CLASSES_ROOTCLSID). As registry hive images, they are binary files so unlikely to be meaningful in a text editor. If you’ve lots of spare time, you might like to compare the title strings of the files against the entries in your registry (copy the name and use it to search in Regedit). If you follow the references back up the tree you should eventually be able to determine which application created them. Normally these files are deleted automatically when the application install/update is completed.

Reply | Quote

This gives some info on GUIDs
http://en.wikipedia.org/wiki/Globally_unique_identifier

If you are absolutely confident of your disaster recovery capability (e.g. Macrium image to restore and or Erunt Registry Hive Backup)
Or if you are competent with Registry Cleaning, I suggest :-
Using CCleaner to scan for issues (but NOT clean) and select the issues and right click for Save To Text.
You may find they these GUIDs appear as entries of past installations.
Then create a new folder in the same partition and using Windows Explorer select all these strange things and MOVE them to the new folder.
Once more run CCleaner and Scan for issues and see what has changed.

Any changes suggest that you have moved something which had an impact on the registry,
possibly something installed that you need,
more probably something unwelcome you never knew had got on board,
and which just possibly might merit getting assistance with malware.

If there are no registry changes then there is a good chance they are junk left over after they had served their purpose,
and if everything continues to work well with them in the new folder you are probably safe to delete.

Reply | Quote

philkiwi,
OK…Just to be on the safe side download (and run) this free scanning program Malwarebytes Free…gotta think on this a bit… My mind seems to work all on it’s own trying to solve problems…no matter what i want…I call him “Ming the Merciless” …at some point “Ming” will “download me” some ideas (always around 3AM)… i hope ..Best :cheers: Fred

PS: Also noticed that the “Dates” from around the “Temp” folders down are all crazy (16-06-2011 etc.)… have a look inside them

Reply | Quote

I replied to this before but it hasn’t appeared yet. Ran Malwarebytes previously and it found nothing. What do you mean the “Dates” from around the “Temp” folders down are all crazy (16-06-2011 etc.)… ??? What Temp folders and what is crazy about 16-06-2011?

Reply | Quote

What do you mean the “Dates” from around the “Temp” folders down are all crazy (16-06-2011 etc.)… ??? What Temp folders and what is crazy about 16-06-2011?

philwiki,
Hello… All my dates ( on all Systems ) are… monthdayyear…. If you look.. seems that you have a mix. There are 3 “Temp folders”.:cheers: Regards Fred

Reply | Quote

I cannot see any “mix” in these dates. As far as I can see they are all in the format d/MM/YYYY as set on my PC through Control Panel. You say there are 3 Temp folders. Two of them were created by me for personal reasons to hold particular files and have subsequently been deleted.

Reply | Quote

I cannot see any “mix” in these dates. As far as I can see they are all in the format d/MM/YYYY as set on my PC through Control Panel. You say there are 3 Temp folders. Two of them were created by me for personal reasons to hold particular files and have subsequently been deleted.

philkiwi,
Hello… Sorry ..just my confusion at your date configuration … all my OS’s are monthdayyear … to the point… I think that the “Norton.exe” might be the cause of the manifestation of all those mysterious entries…as i looked through my OS’s and i don’t have any “.exe” (in the root ) wouldn’t hurt to move Norton into it’s own folder in “Program files”.You can then run it and see what happens… Also before that in the “View” Choose Details …select “Date accessed ” this might provide more clues. :cheers: Regards Fred

Reply | Quote

I think I will leave NPE.exe where it is or just delete it as I can run it from the internet if needed and on my other networked PC I also have a dozen of these similarly formatted files but no instance of NPE.exe so I doubt very much that it is involved. Thank you for your interest.

Reply | Quote

philwiki,
Sorry that i could not be of more help …If you find the answer ..please post back with what it was…:cheers: Regards Fred

Reply | Quote

You could download a free Hex editor, such as Cygnus Hex Editor and open a selection of the files in Read Only mode. In the right hand column, you may then be able to inspect fragments of data that indicate their source and purpose.

Reply | Quote

In Windows Explorer I have a large nuimber of files in my root directory in the format {752FACFB-A3BB-404C-B6AF-A6229A82E268}. What are these and can I delete them without problems?[/SIZE][/FONT]

I have seen these a few times om my XP PC. They are put there from software installed. Converters I believe. Why they were placed on the root….not sure. The only place I have seen hundreds of these on my computer is in the registry under CLSID. Here is a lnk explaining what CLSID is. It will show similar files of what you are talking about. http://ezinearticles.com/?What-Is-CLSID?&id=302860

Reply | Quote

The only place I have seen hundreds of these on my computer is in the registry under CLSID. Here is a lnk explaining what CLSID is. It will show similar files of what you are talking about. http://ezinearticles.com/?What-Is-CLSID?&id=302860

sevenships,
Hello…could you please check your link, it does not seem to be working..Thanks :cheers: Regards Fred

Reply | Quote

Typically, files like those are created by some piece of software, like maybe when it installs or updates.
But with programs like Norton on your PC, I’d not even venture a guess. That’s got to be the very last
program in the world, that I’d trust my PC Security to.

But by now, you’ve received many suggestions, the best of which is to just move the files to a holding area,
on another hard drive, partition or flash drive.
I’ve seen files like those on customer’s PC’s, but not having the luxury of the time to research them, I just
leave them alone and spend my time removing things that I know for sure are just garbage.

good luck to you,
I’d love to visit New Zealand some day.

The Doctor 😎

Reply | Quote

Phil, I’m wondering if you have a Registry cleaner installed that is making strange back-ups of the entries it deletes?

I agree with the earlier poster who felt the safest thing to do is put them somewhere else and see if they’re missed. Most likely they won’t be. I would just make a folder “C:Delete Later” and move them all in there. Then delete them later after you’re sure they’re not needed. Or even if you don’t delete them, you can move them just so you don’t have to see them.

Good luck! Chuck

Reply | Quote

The files and/or folders you are referring to ARE definitely leftover from various updates. The reason you cannot read them is because of the language they are written in. They are not created for your use, but are used in the Registry.

A normal “delete” will place them in your Recycle Bin, as has been noted by others and there they can remain for a week or so just to give you some confidence that they are not needed. Then they may be removed completely:cool:. In my experience, if these are files that might be needed later, they are locked and the operating system will not allow you to delete them.

, I have been working with Windows since version 1.0 and have NEVER deleted one that would delete by normal means and had any repercussions from it.

Reply | Quote