.rrr file; What is it?

[Guest]

Found the following file, floating free within my Windows directory:

s-1-5-21-1004336348-1708537768-854245398-1003.rrr and another one with the
added extension .log (which was empty).

This file seems to be a record of various types of actions taken on my PC.
How did dit get there? What is it? Should I be concerned about it? Can I
remove both? Have moved both files to my desktop for the moment.

 

[Gordon]

Found the following file, floating free within my Windows directory:

s-1-5-21-1004336348-1708537768-854245398-1003.rrr and another one with the
added extension .log (which was empty).

This file seems to be a record of various types of actions taken on my PC.
How did dit get there? What is it? Should I be concerned about it? Can I
remove both? Have moved both files to my desktop for the moment.

This value is called a SID, or Security Identifier. It's a number that is
used by Windows to uniquely identify the user, even if the account is
renamed.

When the RID (relative identifier, the last group of digits in the SID) is
1000 or higher, you're looking at an account or group that is not built into
the system.

Have you deleted any groups or accounts from your system recently?

It's probably a local account that has been deleted or that
the original domain isn't available- the normal behaviour of the ACL UI
(security tab) is to display the SID when the name can't be looked up.

 

[Tom Willett]

From Google:

Could it be: Rhapzodé Resource Repository

Rhapzodé is a compiler for Microsoft PowerPoint which enables authors to
create, manage and securely distribute their PowerPoint presentations. A
Rhapzodé Resource Repository (.RRR) file contains all the meta data for a
project. It is an XML compliant file which manages how a compiled PowerPoint
is created. An .RRR file contains no content, just directives and pointers
to content.


| Found the following file, floating free within my Windows directory:
|
| s-1-5-21-1004336348-1708537768-854245398-1003.rrr and another one with the
| added extension .log (which was empty).
|
| This file seems to be a record of various types of actions taken on my PC.
| How did dit get there? What is it? Should I be concerned about it? Can I
| remove both? Have moved both files to my desktop for the moment.
| --
| CEC4

 

[Guest]

Tom, Thanks. This sounds more like it -- there are references in it to
PowerPoint. But, no dates that I can work out, so don't know how old it is.
Have deleted both anyway in the meantime since posting. Hope things won't
bomb out because of it; haven't opened a PowerPoint file recently, so might
check that one out tonight!

 

[Guest]

Hi Gordon,
Just as a follow-up to my reply to Tom, today I have accessed RegEdit to
look for something else (a program folder, to delete it). Looked under HKEY
USERS category (just for a look-see exploratory) and came across a listing of
various S-1-etc keys. I clicked onto the one listed below (minus the .rrr)
and it had the choice that one comes across in other areas, ie AppEvents,
Control Panel, etc. These lists show the key on its own and one with
-Classes tagged on the end.

The thing I don't like about looking at such information is that one can't
right-click onto it to find a Properties dialog box that could tell you what
it might be. So, I have left it there. On this basis, I have to say that
most likely your reply is the correct one. I can't speak with any authority
as I am not a programmer.

I bought my laptop second-hand and, based on what you say in your post, most
likely your comments relate to the previous owner, and when the PC was
configured for me some things were not cleaned up properly. Have found one
or two other programs under HKEY LOCAL MACHINE Software that I would say also
relate to the previous owner; those folders are empty. I am a standalone and
have only one account.