Strange folders in root (C:\) directory

[Ron]

I have been accumulating a number of strangely named folders in my root
directory. Most seem to be associated with Windows Defender updates. They
are named, for example, 0cfa465b0ae071019c6c2d60ae and contain several files,
one of which is a .ini file that has to do with Defender.

Other machines which have Windows defender are not accumulating these folders.

Some research suggests that these are temporary installation folders which
should have been deleted following an installation -- but that is not
happening.

I can delete them with a convoluted procedure, but I'd rather they not be
there at all.

MS Support tells me this is "normal" and I should just "hide" them if I
don't want to see them. I find this hard to believe.

At last count, before I deleted a bunch, there were over 30 of these folders.

Any thoughts would be appreciated.

 

[mikeyhsd]

it is possible the other computer that did not have them, had them hidden.



(e-mail address removed)



I have been accumulating a number of strangely named folders in my root
directory. Most seem to be associated with Windows Defender updates. They
are named, for example, 0cfa465b0ae071019c6c2d60ae and contain several files,
one of which is a .ini file that has to do with Defender.

Other machines which have Windows defender are not accumulating these folders.

Some research suggests that these are temporary installation folders which
should have been deleted following an installation -- but that is not
happening.

I can delete them with a convoluted procedure, but I'd rather they not be
there at all.

MS Support tells me this is "normal" and I should just "hide" them if I
don't want to see them. I find this hard to believe.

At last count, before I deleted a bunch, there were over 30 of these folders.

Any thoughts would be appreciated.

 

[Ron]

I suppose anything is possible. But the one's on my computer are not being
set up as "hidden", and the other computer had the option set to show hidden
files.

Do you have Defender installed? And do you have a large number of these
strangely named folders?

 

[Bill Sanderson]

Are you sure this is Defender related? What's the filename?

I've seen such folders associated, I believe, with .NET updates--but I
haven't noticed them with Defender updates.

XP, or Vista?

 

[Ron]

As I mentioned, the folder name is 0cfa465b0ae071019c6c2d60ae

It contains three files named as_delta.ini, mpasdlta.vdm and mpsigstub.exe

The contents of the .ini file:

; MpSigStub INI Configuration File

;----------------------------------------------------
; Configuration Section
;
; This section specifies parameters for the stub
;----------------------------------------------------
[Parameters]
PATCH_FULL_ENGINE=0

;----------------------------------------------------
; Products Section
;
; These sections specify the products that are to
; be updated.
;----------------------------------------------------
[WD]
PRODUCT_NAME=Windows Defender
PRODUCT_CONFIG_ROOT_KEY=SOFTWARE\Microsoft\Windows Defender
PRODUCT_MIN_VERSION_DEFAULT=1.1.1592.0


That folder was downloaded last week. I just got another folder today named
C:\ac74ce66a3f4d60fb9681d8771

The three files it contains are the same, and the as_delta.ini file is
identical.

--ron

 

[Ron]

I forgot to mention -- XP Pro SP2

Are you sure this is Defender related? What's the filename?

I've seen such folders associated, I believe, with .NET updates--but I
haven't noticed them with Defender updates.

XP, or Vista?

 

[Bill Sanderson]

Thanks - that's clearly Defender related then. What other real-time
protection are you running? I wonder if something else is preventing these
folders from being removed as they should be in the course of a normal
install?

A good test might be to download something else which comes with a .MSI
install file, and see if it does the same thing.

 

[Ron]

Thanks, Bill.

I recall that there was one folder that contained similar files, but the
..ini file referred to the Malicious Software Removal Tool. So rather than
being related solely to Windows Defender, perhaps it is a problem related to
the "Windows Update Agent".

I would I locate "somethiing else which comes with a .MSI install file"?