Missing Content.IE5 folder

[Guest]

I ran a rootkit scan and found that it flagged my C:\Documents and
Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5 folder.
Upon looking for it under Explorer I find nothing under the \Temporary
Internet Files\ folder. The folder view settings are on to show hidden
system files.
IE works OK, but I am suspicious. I have other accounts on the same PC and
they all have the Content.IE5 folder (with sub-folders).
Can anyone advise
1) Is it normal to have a missing Content.IE5 folder?
2) Could this be a rootkit infection?
3) If this is abnormal, how can I correct it?
Thanks. JK-of-Indy

 

[Frank Saunders, MSMVP-OE]

I ran a rootkit scan and found that it flagged my C:\Documents and
Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5
folder.
Upon looking for it under Explorer I find nothing under the \Temporary
Internet Files\ folder. The folder view settings are on to show hidden
system files.
IE works OK, but I am suspicious. I have other accounts on the same PC
and
they all have the Content.IE5 folder (with sub-folders).
Can anyone advise
1) Is it normal to have a missing Content.IE5 folder?
2) Could this be a rootkit infection?
3) If this is abnormal, how can I correct it?
Thanks. JK-of-Indy

It's there, but Windows Explorer won't show it to you unless you're logged
on as a different Windows User. Maybe you have to logon as the default
Administrator.

 

[kaream]

It's there, but Windows Explorer won't show it to you unless you're logged
on as a different Windows User. Maybe you have to logon as the default
Administrator.

It's "normal" in the sense that unlike earlier versions, XP was
deliberately set up to make the Content.IE5 folder not only hidden but
"super-hidden", so that Windows Explorer cannot find or recognize it.
This is not in itself indicative of an infection. Presumably Microsoft
knows why Windows was changed this way, but if so, they aren't telling.

As both you and Frank Saunders indicated, what's really happening is
that only your *own* Content.IE5 folder is hidden -- you can easily see
any other Content.IE5 folders resident in the different logons in
Documents and Settings. You may or may not be able to log on in your
computer as a different user, depending on how it was set up. But it
isn't really necessary to do that; there are other methods.

The first question is whether you are trying to cover your tracks and
delete everything showing where you've been, or whether you're simply
curious to see what's there. If you're trying to wipe the slate clean,
there's gobs of info posted here in Google Groups (seemingly of varying
accuracy and utility) -- just search Groups for "Content.IE5" and start
rummaging.

Otherwise, the simplest way to access the folder is to open Folders
view, click down though C: \ Documents and Settings \ [my logon name] \
Local Settings, and click on Temporary Internet Files. This displays
all of the cookies and other pointers to files from visited websites,
and also puts this address in the Address bar at the top. In the
Address bar add "\Content.IE5" following the word "Files" and hit Enter
or click Go. Now you'll see Content.IE5 with all of its 8-character
randomly-named subfolders, usually about 16 to 20 of them. Unlike the
cookies and pointers in the main TIF folder, these are actual files
that had been automatically downloaded from every visited website.
These files can be opened, copied, moved, run, or otherwise
manipulated, and may be individually deleted. The file names are
similar to, but slightly different from the names in the main TIF
folder. If you're looking for something in particular, it might be
inside any of the various subfolders; sorting each subfolder by date,
type or size makes it easier to locate a specific file. Explorer
Search still won't work here; you have to do the looking yourself.

 

[kaream]

It's there, but Windows Explorer won't show it to you unless you're logged
on as a different Windows User. Maybe you have to logon as the default
Administrator.

It's "normal" in the sense that unlike earlier versions, XP was
deliberately set up to make the Content.IE5 folder not only hidden but
"super-hidden", so that Windows Explorer cannot find or recognize it.
This is not in itself indicative of an infection. Presumably Microsoft
knows why Windows was changed this way, but if so, they aren't telling.

As both you and Frank Saunders indicated, what's really happening is
that only your *own* Content.IE5 folder is hidden -- you can easily see
any other Content.IE5 folders resident in the different logons in
Documents and Settings. You may or may not be able to log on in your
computer as a different user, depending on how it was set up. But it
isn't really necessary to do that; there are other methods.

The first question is whether you are trying to cover your tracks and
delete everything showing where you've been, or whether you're simply
curious to see what's there. If you're trying to wipe the slate clean,
there's gobs of info posted here in Google Groups (seemingly of varying
accuracy and utility) -- just search Groups for "Content.IE5" and start
rummaging.

Otherwise, the simplest way to access the folder is to open Folders
view, click down though C: \ Documents and Settings \ [my logon name] \
Local Settings, and click on Temporary Internet Files. This displays
all of the cookies and other pointers to files from visited websites,
and also puts this address in the Address bar at the top. In the
Address bar add "\Content.IE5" following the word "Files" and hit Enter
or click Go. Now you'll see Content.IE5 with all of its 8-character
randomly-named subfolders, usually about 16 to 20 of them. Unlike the
cookies and pointers in the main TIF folder, these are actual files
that had been automatically downloaded from every visited website.
These files can be opened, copied, moved, run, or otherwise
manipulated, and may be individually deleted. The file names are
similar to, but slightly different from the names in the main TIF
folder. If you're looking for something in particular, it might be
inside any of the various subfolders; sorting each subfolder by date,
type or size makes it easier to locate a specific file. Explorer
Search still won't work here; you have to do the looking yourself.

 

[kaream]

It's there, but Windows Explorer won't show it to you unless you're logged
on as a different Windows User. Maybe you have to logon as the default
Administrator.

It's "normal" in the sense that unlike earlier versions, XP was
deliberately set up to make the Content.IE5 folder not only hidden but
"super-hidden", so that Windows Explorer cannot find or recognize it.
This is not in itself indicative of an infection. Presumably Microsoft
knows why Windows was changed this way, but if so, they aren't telling.

As both you and Frank Saunders indicated, what's really happening is
that only your *own* Content.IE5 folder is hidden -- you can easily see
any other Content.IE5 folders resident in the different logons in
Documents and Settings. You may or may not be able to log on in your
computer as a different user, depending on how it was set up. But it
isn't really necessary to do that; there are other methods.

The first question is whether you are trying to cover your tracks and
delete everything showing where you've been, or whether you're simply
curious to see what's there. If you're trying to wipe the slate clean,
there's gobs of info posted here in Google Groups (seemingly of varying
accuracy and utility) -- just search Groups for "Content.IE5" and start
rummaging.

Otherwise, the simplest way to access the folder is to open Folders
view, click down though C: \ Documents and Settings \ [my logon name] \
Local Settings, and click on Temporary Internet Files. This displays
all of the cookies and other pointers to files from visited websites,
and also puts this address in the Address bar at the top. In the
Address bar add "\Content.IE5" following the word "Files" and hit Enter
or click Go. Now you'll see Content.IE5 with all of its 8-character
randomly-named subfolders, usually about 16 to 20 of them. Unlike the
cookies and pointers in the main TIF folder, these are actual files
that had been automatically downloaded from every visited website.
These files can be opened, copied, moved, run, or otherwise
manipulated, and may be individually deleted. The file names are
similar to, but slightly different from the names in the main TIF
folder. If you're looking for something in particular, it might be
inside any of the various subfolders; sorting each subfolder by date,
type or size makes it easier to locate a specific file. Explorer
Search still won't work here; you have to do the looking yourself.

 

[Guest]

Thanks Kaream, very helpful.

It's there, but Windows Explorer won't show it to you unless you're logged
on as a different Windows User. Maybe you have to logon as the default
Administrator.

It's "normal" in the sense that unlike earlier versions, XP was
deliberately set up to make the Content.IE5 folder not only hidden but
"super-hidden", so that Windows Explorer cannot find or recognize it.
This is not in itself indicative of an infection. Presumably Microsoft
knows why Windows was changed this way, but if so, they aren't telling.

As both you and Frank Saunders indicated, what's really happening is
that only your *own* Content.IE5 folder is hidden -- you can easily see
any other Content.IE5 folders resident in the different logons in
Documents and Settings. You may or may not be able to log on in your
computer as a different user, depending on how it was set up. But it
isn't really necessary to do that; there are other methods.

The first question is whether you are trying to cover your tracks and
delete everything showing where you've been, or whether you're simply
curious to see what's there. If you're trying to wipe the slate clean,
there's gobs of info posted here in Google Groups (seemingly of varying
accuracy and utility) -- just search Groups for "Content.IE5" and start
rummaging.

Otherwise, the simplest way to access the folder is to open Folders
view, click down though C: \ Documents and Settings \ [my logon name] \
Local Settings, and click on Temporary Internet Files. This displays
all of the cookies and other pointers to files from visited websites,
and also puts this address in the Address bar at the top. In the
Address bar add "\Content.IE5" following the word "Files" and hit Enter
or click Go. Now you'll see Content.IE5 with all of its 8-character
randomly-named subfolders, usually about 16 to 20 of them. Unlike the
cookies and pointers in the main TIF folder, these are actual files
that had been automatically downloaded from every visited website.
These files can be opened, copied, moved, run, or otherwise
manipulated, and may be individually deleted. The file names are
similar to, but slightly different from the names in the main TIF
folder. If you're looking for something in particular, it might be
inside any of the various subfolders; sorting each subfolder by date,
type or size makes it easier to locate a specific file. Explorer
Search still won't work here; you have to do the looking yourself.

 

[Guest]

Thanks Frank. Very helpful.

It's there, but Windows Explorer won't show it to you unless you're logged
on as a different Windows User. Maybe you have to logon as the default
Administrator.

 

[kaream]

Glad it helped.

If my post still shows in duplicate -- I tried to delete the 2nd copy,
but it's still showing now -- I only clicked "Post" once, and have no
idea why it posted twice.

 

[kaream]

Now the duplicate post is finally gone, on the second Delete attempt.

 

[kaream]

By the way, note that Content.IE5 may not be the only folder that's
hidden inside the TIF folder. Frequently there's one or sometimes more
OLK folders, and possibly other folders. To view all of these (since
you won't know their exact names to append to the path in the Address
bar) you'll need to use a slightly different procedure, as follows:

--right-click Drive C:
--select Properties
--select Disk Cleanup
--highlight Temporary Internet Files
--select View Files

This will open a new separate window, showing *all* of the hidden
folders, including Content.IE5 and its subfolders. Interestingly,
using this method, in the second window the main TIF folder is
displayed as containing only its hidden subfolders, but not any of the
cookies and pointers shown in the initial window which displays only
the pointers. Since both windows remain open you can jump back and
forth between them.