Deleted folder keeps reappearing on my desktop

[de8212]

A few days ago I had a .rar file the I wanted to uncompress. I just created a new folder on the desktop named "Temp" and extracted the .rar contents into the folder. I ended up deleting the Temp folder. Over the last few days the Temp folder automatically reappears????? The first couple of times I thought I had just not deleted it but I am now certain that's not the case.
I ran AVG and spyware s/w to make sure it's no virus, etc.
Any ideas on this?

 

[BlueWeasel]

That's odd. Have you tried deleting the Temp folder from C:\Documents and Settings\Yourusername\Desktop?

 

[de8212]

Originally posted by: BlueWeasel
That's odd. Have you tried deleting the Temp folder from C:\Documents and Settings\Yourusername\Desktop?

No, I haven't. I just generally right-click and choose delete or either I drag it to the recycle bin. I'll give that a try and see if it does anyhting different.

 

[Budman]

AVG is not that good at detecting viruses,I suggest you use Antivir http://www.free-av.com/

You could also use an online antivirus scanner

http://housecall.trendmicro.co...usecall/start_corp.asp
http://www.pandasoftware.com/a...tivescan_principal.htm

 

[de8212]

Thanks for th elinks Budman, I'll give one of them a try.

BTW I tried to delete the folder through the method Blue Weasel suggested but the folder just comes back.

Any other suggestions?

 

[timswim78]

First scan for viruses and spyware.

Then, run a registry cleaner.

 

[de8212]

I tried Antivir and it didn't detect any problems.

Budman- Is there a registry cleaner that you would recommend?

ANy other thoughts on this?

 

[Budman]

Originally posted by: de8212
I tried Antivir and it didn't detect any problems.

Budman- Is there a registry cleaner that you would recommend?

ANy other thoughts on this?

Have you tried using system restore? restore to a date before you created that temp folder with winrar...

Also like timswim78 said using spybot & adaware could help..

http://www.spybot.info/en/download/index.html
http://www.lavasoftusa.com/software/adaware/

 

[imported_FishTaco]

Try deleting from Safe Mode.

 

[de8212]

I have tried Spybot and adaware.

WIll try safe mode next time it appears.

 

[mechBgon]

Is this a standalone computer or a member of a domain?

 

[de8212]

Originally posted by: mechBgon
Is this a standalone computer or a member of a domain?

It's networked to one other machine and every once in blue moon my laptop. ALso xbox is hooked to the hub every so often.

It hasn't reappeared since my post earlier today. Then again I've been gone most of the day. Strange thing is that it's never appeared on bootup. I could be on it for hours and then look at the desktop and there it is.

 

[mechBgon]

Was the original content anything that you had reason to be suspicious of? Next time it shows up, you might scan it using a different antivirus scanner to see if it picks up anything. Someone over in Technical Support had a mystery .exe running that kept coming back, and I had him send me a copy in my email. AVG7 doesn't see an infection, but McAfee and Norton both ID it as a Gaobot variant.

Never a bad time to check your security situation, at any rate. What do you have for:

1. a software firewall?
   
2. a hardware firewall (router)?
   
3. strong passwords on your Admin-class user accounts to thwart exploitation of their powers (right-click My Computer > Manage > Local Users & Groups > Users > right-click users to set passwords, then run a MBSA scan to ensure you got them all)
   
4. Windows/etc patching up-to-date?
   
5. Office patching up-to-date?
   
6. (for WinXP w/SP2) Data Execution Prevention enabled for all programs?

 

[rainypickles]

Originally posted by: de8212
It hasn't reappeared since my post earlier today. Then again I've been gone most of the day. Strange thing is that it's never appeared on bootup. I could be on it for hours and then look at the desktop and there it is.

could it be that winrar is using that folder as temp folder now? i dont even know how to accidently change this, but that would explain why it pops up suddenly. maybe when you use winrar? how puzzling!

 

[VirtualLarry]

It's possible, that by using the mini-Explorer.exe "common dialog" for saving, you chose that directory for a temp directory, and now the last-used/default directory for saving is that directory, and then if some other program uses the same "common dialog", depending on the file-open flags and stuff, it might be dynamically re-creating that directory, simply because of the existance of a cached path pointing into it.

I have a similar problem oftentimes, I extract to a temporary directory, or some short-lived directory, and then I later try to delete it, but can't, because stupid broken Explorer.exe still has an open handle to that directory. 🙁

 

[mechBgon]

You could mess with its mind by creating a folder on the desktop named Temp, and then using NTFS permissions to deny all access to it, even by SYSTEM 🙂 Might yield some clues, if you get an error box saying "such-&-such could not blah-blah."