file attribute HSA

[Guest]

ref my last post about "hardrive full... NOT"

Could someone educate us on the file attributes, being A, H, C, HC, R, S or
HSA

I will admi to being more concerned about HSA.
I searched it on the web and found it means "Removed Uninstall Key".
A second search on that comes back with links to hijacked programs.
However, I am absolutly certain not to have any such nasties on my system (I
run a bunch of anti-everything). And just to be certain, I scanned using the
software "HijackThis" and all seems alright.

The files I am concerned with are:
C:WINDOWS/0 1 375 440 System file
C:WINDOWS/4 1 375 440 System file
C:WINDOWS/6 1 375 440 System file
C:WINDOWS/8 1 375 440 System file
C:WINDOWS/9 1 375 440 System file

This all have the HSA attribute and I can't do a arn thing with them even in
safe mode and all service turned of or disabled (excetp Logical Disk Manager).

 

[Wesley Vogel]

What are you trying to do?

File attributes:

A = Files ready for archiving

H = Hidden

C = Compressed

HC is two attributes = Hidden & Compressed

R = Read-only

S = System

HSA is three attributes = Hidden, System & Files ready for archiving

E = Encrypted

Encrypted files and folders cannot be compressed.

Compressed files and folders cannot be encrypted.
-----

Because the C:WINDOWS/0, 4, 6, 8 & 9 folders have the System (S) attribute,
you cannot delete them.

What's in these folders?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

My original problem is that my C drive is critically low on space.
All I have on that drive is Windows and my anti-everything program... That's
it.
The partition is 16 Gig and I only have 360Mb left on it and those 5 files
use 5.55Gig all on their own and I don't have a clue on their purpose.

And yes, I did clear all tmp and log files and my browsers aset with low
cache and small history.

I ran out of ideas and things to try.
I originally thought they were related to defrag, but I am now sure of
nothing, except that I don't have any bogies on my system.

 

[Ted Zieglar]

You can increase the size of your C drive if you feel confident using
software such as Partition Magic:

Partition Magic 8.0
http://www.symantec.com/partitionmagic/

However, Windows and your "anti-everything" software should not occupy
anything near 16GB, unless you've installed every application in the known
universe with 'anti' in its name.

Ted Zieglar

 

[Guest]

You have reached the same conclusion as me that windows should not use that
much space.

As it is, Windows is using 11.5Gig (nonesense) and Program files is using
1.5 Gig (my anti everything), because all my other programs are on another
partition.

I don't know how much space Windows XP pro SP2 should take but it's
oblivious that I have a problem, and the biggest nonsense I can see are those
untouchable windows/0 type.

 

[Wesley Vogel]

None of those folders appears on my machine. I am running Windows XP Pro
SP1.

What the heck is in them?

Here are the default folders that should be in the windows folder.
I.e. C:\WINDOWS\

Windows Folder
The Windows folder and its subfolders contain the operating system files for
your Windows XP Professional installation (as shown in Table A.4).
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prgg_det_qgtk.asp

My C:\WINDOWS folder...

Size: 1.44 GB (1,556,563,865 bytes)
Contains: 10,464 Files, 471 Folders

You have a problem, but I'm not sure exactly what it is.

What is in those folders???

C:WINDOWS/0
C:WINDOWS/4
C:WINDOWS/6
C:WINDOWS/8
C:WINDOWS/9

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Ted Zieglar]

Steph: These accounts that you've been writing about do not belong to
Windows XP, so unless you put them on your computer, somebody else did, your
protests to the contrary notwithstanding.

If you can't get rid of them in the usual ways, you'll need to backup your
data and perform a clean install.

Ted Zieglar

 

[Guest]

I have no idea what's in those files.
When in safe mode, with everything turned off except Logical Disk Manager,
I still can't get into those files.

When I try to open them, I get told that I don't have permission.
When I try to rename, move or delete them, I am told that they are system
files in use...remember, this is with Windows safe mode and all services off.

I run 1 antivirus (Norton), 1 firewall (ZoneAlarm) and 2 more antispyware
(Microsoft Antispyware and Spy Sweeper) and I also scanned with HijackThis.
My system passes all scans with no problems detected.

So something is running those files,... what I don't know!

If they don't belong to Windows, then I guess I will boot in DOS, delete
them and then see what program is not working anymore.

However, out of desperation, I will mention that since I formated and
re-installed my whole computer back in September, System Restore has never
worked. Everytime I try to access it, I am told that it is unable to protect
my computer and to restart my machine to restart the service again. I don't
know if there could be any relation, but I gave up on that one some time ago.
Could it be some SR kinda lost log file????

For sure, a format and re-install would correct the situation, but I have
over 50 business application, programing and editing software (from C++ to
Flash, to Office and Adobe) installed, I am a busy student and simply cannot
afford a whole week to re-install and update everything, so I have to fix
this one, at least until the summer.

And by the way, a wonderful tanks to all who are trying to help!!!!

 

[David Candy]

You can use OH from
http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

Type
oh +otl
reboot
then
oh /t file <filename>
or leave filename blank to see all.

EG to see what program has inbox.dbx open (OE's inbox file)

oh /t file inbox.dbx
which returns

//
// TIME: 2004-03-30 19:50
// MACHINE: SERENITY
// BUILD: 2600
// OH version: built by: dnsrv_dev(v-smgum)
//
//
00000CF0 msimn.exe File 050c \Documents and Settings\David Candy\
Local Settings\Application Data\Identities\{E6E1A8F2-C885-46A5-975E-94A4A1F8C788
}\Microsoft\Outlook Express\Inbox.dbx

[Microsoft Internet Mail And News (MSIMN.EXE) is the real name of Outlook Express rather than the marketing name. Office's Outlook internet features is a copy of Outlook Express. OL stole OE's code while OE got OL's name.]


Also try typing in Help
taking ownership

 

[Guest]

That was interresting! I got a list of 233 lignes.

I don't know why you sspected an issue with outlok, but I don't have that
file running anyway.

So, first I tried to interpret what showed...
First I looked for unusual names... some I don,t know what they are, but
none that stands out as suspecious.

Second, I looked at a relevent group of seven entries.
As you can see, I have 7 weird files on my drive
C:WINDOWS/0 1 375 440 System file 2005-01-23-20:39(date
modified) HSA
C:WINDOWS/4 1 375 440 System file 2005-01-23-20:39(date
modified) HSA
C:WINDOWS/6 1 375 440 System file 2005-01-23-20:39(date
modified) HSA
C:WINDOWS/8 1 375 440 System file 2005-01-23-20:39(date
modified) HSA
C:WINDOWS/9 1 375 440 System file 2005-01-23-20:39(date
modified) HSA
C:WINDOWS/S 1 375 440 System file 2005-01-23-20:39(date
modified) HSA
C:WINDOWS/Y 1 375 440 System file 2005-01-23-20:39(date
modified) HSA

And here's what groups of seven I found. Can you make any sens out of that???
Could it be Norton that's causing havoc? What's "nvsvc32.exe"???

000006BC nvsvc32.exe File 000c \WINDOWS\system32
000006BC nvsvc32.exe File 0044 \net\NtControlPipe13
000006BC nvsvc32.exe File 0088
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
000006BC nvsvc32.exe File 0090
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
000006BC nvsvc32.exe File 0098
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
000006BC nvsvc32.exe File 010c
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9
000006BC nvsvc32.exe File 0190
\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9

 

[David Candy]

I don't suspect an issue with outlook express, I showing you how to use OH with OE data files as the example.

Directories are files, so

oh /t file 0

will show you who has any directories or files with the name 0 in it open.

EG c:\windows\0\afilename

will show what has afilename open.

cacls c:\windows\0 will show security status.

nvsvc32 is nvidia video card stuff.

 

[David Candy]

The rest of your post is irrelevent and normal.

 

[Guest]

I just tried to shut down everything from Norton and ran a new scan.

Keeping on the theme of seven, I have found those entries that look similar.
Also, I tried, just for the fun of it, to delete my mysterious
files(C:\WINDOWS\9) from the command prompt. Well that didn't work either
because it says that they cannot be found.

00000378 winlogon.exe File 0208 \Program Files\Common
Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm
00000378 winlogon.exe File 020c \Program Files\Common
Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm
00000378 winlogon.exe File 0218 \Program Files\Common
Files\Microsoft Shared\web server extensions\40\isapi\_vti_aut
00000378 winlogon.exe File 021c \Program Files\Common
Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut
00000378 winlogon.exe File 0224 \Program Files\Common
Files\Microsoft Shared\web server extensions\40\bin
00000378 winlogon.exe File 0230 \Program Files\Common
Files\Microsoft Shared\web server extensions\40\servsupp
00000378 winlogon.exe File 0234 \Program Files\Common
Files\Microsoft Shared\web server extensions\40\bots\vinavbar

 

[David Candy]

It appears nothing has those files open. Do the security thingy (cacls)

Command prompt normally ignores files with the attributes you specified.

Try

attrib -r -s -h c:\windows\0

and note the error or if not one retry the command prompt delete. It is 0 and not o or O?

you can also try this syntax

del \\?\c:\windows\0

 

[R. C. White]

Hi, Steph.

I've read the thread thus far. I'd like to back up a few steps and have you
try a few things.

First, open a "DOS" window in WinXP. At the Root of C:, type dir /x. The
/x switch should produce a column of SFNs (Short File Names, also known as
8.3 filenames) before the LFNs. Every file has to have a valid SFN. Some
apparently-valid LFNs have hidden characters that do not show up normally,
but they must show if you use the /x switch. Even some 3-character
filenames are not valid SFNs if they include spaces or unprintable
characters. And, of course, the \ is not a valid character in an 8.3
filename; it indicates a subdirectory. What is the SFN for WINDOWS\0, for
example? When I typed "md C:\WINDOWS\0", "DOS" created both the \Windows
folder and a subdirectory under \Windows named \0. They both had zero
bytes, of course. And dir windows /s/x/a produces a blank SFN column, since
both "WINDOWS" and "0" are valid SFNs. (As usual in a "DOS" window, type
dir /? to see a mini-Help file showing all the switches available with the
dir command.)

If those files don't show up with dir /x, it's probably because of the HSA
attributes, as Wes explained. In that case, either remove the attributes,
or just type dir /x /a. The /a switch shows ALL files in the directory, no
matter which attributes may be set. If you still don't see the SFN for
WINDOWS\*, then please tell us what you DO see with dir C:\ /x /a. We would
expect the SFN to also be WINDOWS, of course; if it isn't then we SURE want
to know that!

Once you know the SFN of \WINDOWS\0, for example, it should be a simple
matter to see the contents of that file or folder, using dir with the /s or
other switches, if it is a folder, or the Type or Edit command if it is a
file.

You haven't said whether your system is networked or standalone. I'm a
one-man, one-computer kind of guy. I know nothing of networks or profiles
or permissions. So if your problem is caused by those aspects of WinXP,
then I can't help much. But if your system is just a standalone single
computer, we should be able to find the problem and fix it.

RC

 

[Guest]

Hi David!

Sorry I didn,t read your instruction correctly last night. At the same time
I was trying to follow your instructions, I was trying to finish a report I
had to submit this morning (Monday).

Anyway, I have now followed Aall your commands, except for de delete one. I
have left that one for further troubleshooting in case one of you Grand
master Wiz can figure out how it came to happen... if it is worht trying to
understand.

Anyhow, I have put the results of your instruction on a web page at
http://pages.videotron.com/steph1/first_page.

I can see the files but still cannot do anything to them, not even change
the attributes.

Thanks again, I am learning lots so far!

 

[Guest]

Hi RC!

I have followed your instructions and posted the results at
http://pages.videotron.com/steph1/first_page

However, as you will see, I come up with the same results as what David got
me to try.

I'm not sure if I understand the LFN thing though. I could still see the
files 0, 4,6, 8, S and Y from Windows Explorer, so I'm not sure if your
procedure was to allow vewing of those files or if it was about getting more
informations about them??

By the way, I am on an individual computer.
With this going back to school thing, my entire life is on the one computer,
so my wife won't even try to get near it...or I'll bite her LOL. And my
daughter is only 3 years old and she hasn't bogged me to have her own machine
.....yet!

 

[Wesley Vogel]

Steph,

The LFN thing is Long File Name.

SFN or Short File Name or 8.3 name

Short File Name is
C:\DOCUME~1\WESLEY~1.VOG\LOCALS~1

Long File Name is
C:\Documents and Settings\Wesley P. Vogel\Local Settings

Same path, different names.

More info...

Long name:
[[A folder name or file name longer than the 8.3 file name standard (up to
eight characters followed by a period and an extension of up to three
characters) of the FAT file system. This version of Windows supports long
file names up to 255 characters.]]

[[On Windows platforms, each "long file name" (file name which is not in DOS
8.3 format) has a "short file name" (in DOS 8.3 format) alternate name. For
example, "longfilename.txt" (which is not in DOS 8.3 format) has an
alternate file name "longfi~1.txt", and "name.jumbo" has an alternate file
name "name~1.jum". The short file name is basically formed by taking the
name part of the file name (all characters up to the extension), trimming it
to 6 characters if necessary, and appending "~1" to it, and then trimming
the extension to 3 characters if necessary.

If there is already a file with that same (alternate) name in the directory,
then the number (after the "~") is incremented until a free name is found.
This scheme has one exception - if the name part is 1-2 characters long,
then a different algorithm is used to produce the name part.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[David Candy]

At least we know the reason why you can't delete it. Nothing to do with security or attributes. The system is using the file. Now we need to find why the system is using the file.

Looking at the size of them, and looking at some of the things in the dir list, it appears you could be running coporate type software? Or virtual hard drives (seeing I just found another thread by you about defrag)? Any application can create it's own swap file but these tend to be big server type apps.

Now your defrag thread is interesting, not for the replies (I don't think it's a virus - I think it software you have installed but we'll check), but for what you say.

"The report showed that files c:windows/0 had over 800 files that could not
be defragmented and file c:windows/4 had over 400 files"

Files don't normally have files in them (and I did glance at that thread a few days ago and is must be the reason I thought we were talking about directories with these names). Can you elaborate on the defrag thing. All of us must of thought that you were writing typical non technical person explaining something and thus comes out as gibberish and so others just ignored it - many users call folders files. But you seem quite technical. Can you reget that report, there's a way of copy and pasting it but I can't tell you how as my defrag doesn't work as I just discovered (I use Perfect Disk). Found more threads by you. Viruses don't cause everything. Found a thread by a German guy in december so I emailed him (he got worse help than you, least people want to talk to you).

This is the email I sent.
http://groups.google.com.au/groups?...=/groups?hl=en&lr=&q=%22c%3A%5Cwindows%5C0%22

Above is google's copy of a post you made on the 8th of the 12th.

Did you find the cause of this? If so what was it.

If not you may want to monitor
news://msnews.microsoft.com/microsoft.public.windowsxp.perform_maintain

Post dated Sun, 23 Jan 2005 10:39:02 -0800

Subject Re: file attribute HSA

This will open the the group in Outlook Express or you can access the group via the web interface you used before.

 

[Guest]

Hi RC!

Now I get it with the SFN and LFN. Fubnny, I tought that DOS was completelly
out of the system since Win 2000! I guess I was wrong!

Anyway, I am quoting your original question asking me what SFN I could see
and here are the results.

/*What is the SFN for WINDOWS\0, for example?
If you still don't see the SFN for WINDOWS\*, then please tell us what you
DO see with dir C:\ /x /a. We would expect the SFN to
also be WINDOWS, of course; if it isn't then we SURE want to know that!*/

/*Once you know the SFN of \WINDOWS\0, for example, it should
be a simple
matter to see the contents of that file or folder, using dir with the /s or
other switches, if it is a folder, or the Type or Edit command if it is a
file. */

2005-01-24 20:19 1 408 450 560 0
2005-01-24 20:20 0 0.log
2005-01-24 20:19 1 408 450 560 4
2005-01-24 20:19 1 408 450 560 6
2005-01-24 20:19 1 408 450 560 8
2005-01-24 20:19 1 408 450 560 9
2005-01-24 20:19 1 408 450 560 S
2005-01-24 20:19 1 408 450 560 Y

But what do we want to know from the SFN?

And the /s command produced the following:
C:\>dir /s /a windows\0
Volume in drive C is WINDOWS
Volume Serial Number is 38BF-EE85

Directory of C:\windows

2005-01-24 20:19 1 408 450 560 0
1 File(s) 1 408 450 560 bytes

Total Files Listed:
1 File(s) 1 408 450 560 bytes
0 Dir(s) 1 142 890 496 bytes free



http://pages.videotron.com/steph1/first_page