What is {127D0A1D-4EF2-11D1-8608-00C04FC295EE} folder

[Patrick]

I ran a spyware detection program called Spy Killer and
it reports that a folder named {127D0A1D-4EF2-11D1-8608-
00C04FC295EE}is an adware related folder/file created by
Brillant Digital for the Kazaa program. I have two
instances of the above folder. One is under
Windows\system32\catroot and the other is under
Windows\system32\catroot2. The folder under catroot2 has
a file in it called catdb. I am running Win XP Pro. I
have never installed Kazaa on this PC. I have deleted
both instances of the folder but the folder recreates
itself after I reboot. Please advise if this file is
actually a Windows created folder or is in fact an adware
related folder.

Thanks!

 

[Drew Cooper [MSFT]]

They're really system-created folders. They can be used during file
signature verification. "catdb" is a catalog database. A catalog in this
sense is a group of detached signatures (the .cat files on your Windows CD).
Those are the default directories for catalogs that are added when
CryptCATAdminAddCatalog is called with a NULL first parameter.

It could be possible for malware to install catalogs if it were running as a
privileged user, but the directories are created by the OS itself.

 

[Patrick]

Thanks for clearing that up Drew. Looks like Spy Killer
is not a very good Program if it is reporting falsely.

Patrick

-----Original Message-----
They're really system-created folders. They can be used during file
signature verification. "catdb" is a catalog database. A catalog in this
sense is a group of detached signatures (the .cat files on your Windows CD).
Those are the default directories for catalogs that are added when
CryptCATAdminAddCatalog is called with a NULL first parameter.

It could be possible for malware to install catalogs if it were running as a
privileged user, but the directories are created by the OS itself.
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

I ran a spyware detection program called Spy Killer and
it reports that a folder named {127D0A1D-4EF2-11D1- 8608-
00C04FC295EE}is an adware related folder/file created by
Brillant Digital for the Kazaa program. I have two
instances of the above folder. One is under
Windows\system32\catroot and the other is under
Windows\system32\catroot2. The folder under catroot2 has
a file in it called catdb. I am running Win XP Pro. I
have never installed Kazaa on this PC. I have deleted
both instances of the folder but the folder recreates
itself after I reboot. Please advise if this file is
actually a Windows created folder or is in fact an adware
related folder.

Thanks!

.