access denied on update folder

Hi;

I have a windowsxp prof system (latest updates and patches, using updated AV
software and firewall all the time)..
I use C: for as a OS drive, D: for applications and E for data (with some
exceptions since not all applications allow me to install them on the D
drive)

I notice i have a folder in the root of D, that is named something like:
D:\0e1c386b6050a1e.......and some more random characters

This folder contains 8 files ( $shtdwn$.req , empty.cat, msdxm.ocx,
spmsq.dll, spuninst.exe, wmp.dll, wpm.dll, wpmcore7.dll. and wmpcore8.dll)
and one folder named update.

I ran a trojan check (from windowssecurity.com) on my system and that told
me that the update folder was not accessible. So I checked and it turned out
to have a read only attribute. I switched this off, using the regular
dialogue, clicked OK and found out that its read only attribute was turned
on again. Of course read only by itself should not forbid me to read the
folders content.

Checking google I found out that the mentioned files are related to windows
mediaplayer and internet explorer.

I can't help to wonder if I have some kind of nasty software in that folder,
though my system runs fine and my isp isný complaining about spam or
virussen on my machine.

Any info is appreciated

Gerard Verhoef.

cedric
Tue Oct 05 06:09:11 CDT 2004

"Gerard Verhoef" wrote:

> Hi;
>
> I have a windowsxp prof system (latest updates and patches, using updated AV
> software and firewall all the time)..
> I use C: for as a OS drive, D: for applications and E for data (with some
> exceptions since not all applications allow me to install them on the D
> drive)
>
> I notice i have a folder in the root of D, that is named something like:
> D:\0e1c386b6050a1e.......and some more random characters
>
> This folder contains 8 files ( $shtdwn$.req , empty.cat, msdxm.ocx,
> spmsq.dll, spuninst.exe, wmp.dll, wpm.dll, wpmcore7.dll. and wmpcore8.dll)
> and one folder named update.
>
> I ran a trojan check (from windowssecurity.com) on my system and that told
> me that the update folder was not accessible. So I checked and it turned out
> to have a read only attribute. I switched this off, using the regular
> dialogue, clicked OK and found out that its read only attribute was turned
> on again. Of course read only by itself should not forbid me to read the
> folders content.
>
> Checking google I found out that the mentioned files are related to windows
> mediaplayer and internet explorer.
>
> I can't help to wonder if I have some kind of nasty software in that folder,
> though my system runs fine and my isp isný complaining about spam or
> virussen on my machine.
>
> Any info is appreciated
>
> Gerard Verhoef.
>
>
>
>
>

To get access to folder:

Login as an administrator
go to the specified folder
rightklik and go to properties
go to security
put your account or all the administrators in the container and give them at
least read rights (if you want to browse the folder) or modify (if you want
to work in it (delete))

I think the folder is a backup of windows updates!

Gerard
Tue Oct 05 08:07:35 CDT 2004


"cedric" <cedric@discussions.microsoft.com> wrote in message
news:7345919E-515A-493A-A98A-BD71F1646C9C@microsoft.com...
>> To get access to folder:
>
> Login as an administrator
> go to the specified folder
> rightklik and go to properties
> go to security
> put your account or all the administrators in the container and give them
> at
> least read rights (if you want to browse the folder) or modify (if you
> want
> to work in it (delete))
>
> I think the folder is a backup of windows updates!

Thanks for your response.
I'm trying to do what you suggest, but there seems to be no tab or button
"security" in the properties window of any folder I check. I think I do
remember that there used to be something like that. Can it be an SP2-thing?
I did use an account with admin rights when I tried to set the attrib rights
of that folder earlier (I did't mention that in my OP)

Gerard

Gerard
Tue Oct 05 08:38:47 CDT 2004

Thanks again,

I fixed the "I have no security tab" problem I mentioned a couple of minutes
earlier. Should have checked my friend Google. Excuse me for this ignorance.

But, now that I can see the security tab (deselected use simple file sharing
in the View dialogue), I see now that there is an extra user for this map.
He (or she ) has the unpronouncable name of S-1-5-21-746137067- and a lot
more.
The user icon has a questionmark in it.

But... I still cannor read the update folder. I don't have enough privilages
to change the security settings for this folder, not even as an
administrator. Don't really like that part.

It might indeed be something connected to windowsupdate. Bill Gates created
an extra .NET user once on my system without telling me, so I'm not very
surprised. But I still am concerned.

I might try loggin is as that silly user. Wonder what happens than.

Gerard