Two mysterious directories, sometimes invisible

[Guest Anthony Buckland]

YMMV, but on my system (WinXP Media Edition with SP3),

two directories hang off C:\Documents and Settings, but are

invisible by all normal means that I can discover in Windows,

with one exception: if I go to Command Prompt and do a

"dir /ad" in Documents and Settings, they are visible.

There is one application that seems able to see them; in

Zone Alarm (lately the subject of considerable debate in

this group) -- in the Anti-virus/Anti-spyware window, go to

Advanced Options, then to Scan Targets, and they are

oddly enough visible.

 

Yes, I have hidden files and system folders set to be visible.

 

The directories are "LocalService" and "NetworkService",

one word in each case. (The other directories in Documents

and Settings, visible by every means I've tried, are All Users,

[me], Default User and Administrator.)

 

What are these two directories, and why are they so shy?

 

Thanks for any help.

[Guest Pegasus \(MVP\)]

Re: Two mysterious directories, sometimes invisible

 

 

"Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

news:eozZWLS5IHA.2544@TK2MSFTNGP04.phx.gbl...

> YMMV, but on my system (WinXP Media Edition with SP3),

> two directories hang off C:\Documents and Settings, but are

> invisible by all normal means that I can discover in Windows,

> with one exception: if I go to Command Prompt and do a

> "dir /ad" in Documents and Settings, they are visible.

> There is one application that seems able to see them; in

> Zone Alarm (lately the subject of considerable debate in

> this group) -- in the Anti-virus/Anti-spyware window, go to

> Advanced Options, then to Scan Targets, and they are

> oddly enough visible.

>

> Yes, I have hidden files and system folders set to be visible.

>

> The directories are "LocalService" and "NetworkService",

> one word in each case. (The other directories in Documents

> and Settings, visible by every means I've tried, are All Users,

> [me], Default User and Administrator.)

>

> What are these two directories, and why are they so shy?

>

> Thanks for any help.

>

 

These are profile folders required by certain system services.

They are normally hidden in order to discourage eager users

from deleting them.

[Guest Anthony Buckland]

Re: Two mysterious directories, sometimes invisible

 

 

"Pegasus (MVP)" <I.can@fly.com.oz> wrote in message

news:eFgmikS5IHA.4448@TK2MSFTNGP05.phx.gbl...

>

> "Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

> news:eozZWLS5IHA.2544@TK2MSFTNGP04.phx.gbl...

>> YMMV, but on my system (WinXP Media Edition with SP3),

>> two directories hang off C:\Documents and Settings, but are

>> invisible by all normal means that I can discover in Windows,

>> with one exception: if I go to Command Prompt and do a

>> "dir /ad" in Documents and Settings, they are visible.

>> There is one application that seems able to see them; in

>> Zone Alarm (lately the subject of considerable debate in

>> this group) -- in the Anti-virus/Anti-spyware window, go to

>> Advanced Options, then to Scan Targets, and they are

>> oddly enough visible.

>>

>> Yes, I have hidden files and system folders set to be visible.

>>

>> The directories are "LocalService" and "NetworkService",

>> one word in each case. (The other directories in Documents

>> and Settings, visible by every means I've tried, are All Users,

>> [me], Default User and Administrator.)

>>

>> What are these two directories, and why are they so shy?

>>

>> Thanks for any help.

>>

>

> These are profile folders required by certain system services.

> They are normally hidden in order to discourage eager users

> from deleting them.

>

 

....

Thanks. Why did I ask? Because Zone Alarm, which I

have been accused of selling, has a problem, of taking

an ungodly amount of time to do a virus scan, particularly

of compressed files such as .CAB and .ZIP files. On my

machine anyway, LocalService contains 1588 .ZIP files.

ZA, by default, takes every compressed file apart and

examines its components. Great, except the components

would be examined anyway on access. The virus scan can

be speeded up by excluding all compressed files from the

scan.

 

To find the folders in question, by the way, involves turning

off "Hide protected operating system files". All hail

 

"Windows XP: Inside Out" (Bott, Siechert, Stinson)

 

my faithful companion since upgrading to XP.

[Guest Pegasus \(MVP\)]

Re: Two mysterious directories, sometimes invisible

 

 

"Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

news:OMNhUIV5IHA.5052@TK2MSFTNGP03.phx.gbl...

>

> "Pegasus (MVP)" <I.can@fly.com.oz> wrote in message

> news:eFgmikS5IHA.4448@TK2MSFTNGP05.phx.gbl...

>>

>> "Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

>> news:eozZWLS5IHA.2544@TK2MSFTNGP04.phx.gbl...

>>> YMMV, but on my system (WinXP Media Edition with SP3),

>>> two directories hang off C:\Documents and Settings, but are

>>> invisible by all normal means that I can discover in Windows,

>>> with one exception: if I go to Command Prompt and do a

>>> "dir /ad" in Documents and Settings, they are visible.

>>> There is one application that seems able to see them; in

>>> Zone Alarm (lately the subject of considerable debate in

>>> this group) -- in the Anti-virus/Anti-spyware window, go to

>>> Advanced Options, then to Scan Targets, and they are

>>> oddly enough visible.

>>>

>>> Yes, I have hidden files and system folders set to be visible.

>>>

>>> The directories are "LocalService" and "NetworkService",

>>> one word in each case. (The other directories in Documents

>>> and Settings, visible by every means I've tried, are All Users,

>>> [me], Default User and Administrator.)

>>>

>>> What are these two directories, and why are they so shy?

>>>

>>> Thanks for any help.

>>>

>>

>> These are profile folders required by certain system services.

>> They are normally hidden in order to discourage eager users

>> from deleting them.

>>

>

> ...

> Thanks. Why did I ask? Because Zone Alarm, which I

> have been accused of selling, has a problem, of taking

> an ungodly amount of time to do a virus scan, particularly

> of compressed files such as .CAB and .ZIP files. On my

> machine anyway, LocalService contains 1588 .ZIP files.

> ZA, by default, takes every compressed file apart and

> examines its components. Great, except the components

> would be examined anyway on access. The virus scan can

> be speeded up by excluding all compressed files from the

> scan.

>

> To find the folders in question, by the way, involves turning

> off "Hide protected operating system files". All hail

>

> "Windows XP: Inside Out" (Bott, Siechert, Stinson)

>

> my faithful companion since upgrading to XP.

 

Neither of these profile folders should contain much data, in particular

not personal data such as .zip files. What are these .zip files?

[Guest Anthony Buckland]

Re: Two mysterious directories, sometimes invisible

 

 

"Pegasus (MVP)" <I.can@fly.com.oz> wrote in message

news:e%23DctQX5IHA.408@TK2MSFTNGP06.phx.gbl...

>

> "Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

> news:OMNhUIV5IHA.5052@TK2MSFTNGP03.phx.gbl...

>>

>> "Pegasus (MVP)" <I.can@fly.com.oz> wrote in message

>> news:eFgmikS5IHA.4448@TK2MSFTNGP05.phx.gbl...

>>>

>>> "Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

>>> news:eozZWLS5IHA.2544@TK2MSFTNGP04.phx.gbl...

....

>>>> ..."LocalService" and "NetworkService";

>>>> What are these two directories, and why are they so shy?

>>>>

>>>> Thanks for any help.

>>>>

>>>

>>> These are profile folders required by certain system services.

>>> They are normally hidden in order to discourage eager users

>>> from deleting them.

>>>

>>

>> ...

>>...[My] virus scan can

>> be speeded up by excluding all compressed files from the

>> scan.

>>

>> To find the folders in question, by the way, involves turning

>> off "Hide protected operating system files". All hail

>>

>> "Windows XP: Inside Out" (Bott, Siechert, Stinson)

>>

>> my faithful companion since upgrading to XP.

>

> Neither of these profile folders should contain much data, in particular

> not personal data such as .zip files. What are these .zip files?

....

 

Excellent question.

 

In localservice\local settings\temporary internet files\content IE5

are four directories, each with an 8-character alphameric name

with no discernible meaning. Taken together, the four names

_could_ be a license number or installation key for something

(not the current Zone Alarm), so I won't quote them. Each of the

four directories contains 395 to 400 .zip files with names of the

two forms (drum roll):

 

av.signatures.patch-nnnn[1]

or

vet.signatures.patch-nnnnn[1]

 

where "nnnn" or "nnnnn" is a 4 or 5-digit number, ascending

by modified date, with dates from April 2006 to June 2008.

I strongly suspect that they are Zone Alarm virus and

possibly spyware database updates, and will follow that up

on Zone Alarm's forum.

 

Why in heck's name they would squirrel these files away in

this peculiar way is beyond me. Failing to delete them,

though, is a comprehensible human error. Recently, I did a

superclean-supercomprehensive-wipeoutalltraces

deinstall of Zone Alarm using the gurus' advice on the

ZA forum, and clearly it didn't catch these files (the

deinstall was needed to jump from a really old release

of ZA to the modern day).

 

Thanks for your help, and for your patience in reading

the above.

[Guest Pegasus \(MVP\)]

Re: Two mysterious directories, sometimes invisible

 

 

"Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

news:eU663oe5IHA.832@TK2MSFTNGP05.phx.gbl...

>

> "Pegasus (MVP)" <I.can@fly.com.oz> wrote in message

> news:e%23DctQX5IHA.408@TK2MSFTNGP06.phx.gbl...

>>

>> "Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

>> news:OMNhUIV5IHA.5052@TK2MSFTNGP03.phx.gbl...

>>>

>>> "Pegasus (MVP)" <I.can@fly.com.oz> wrote in message

>>> news:eFgmikS5IHA.4448@TK2MSFTNGP05.phx.gbl...

>>>>

>>>> "Anthony Buckland" <anthonybucklandnospam@telus.net> wrote in message

>>>> news:eozZWLS5IHA.2544@TK2MSFTNGP04.phx.gbl...

> ...

>>>>> ..."LocalService" and "NetworkService";

>>>>> What are these two directories, and why are they so shy?

>>>>>

>>>>> Thanks for any help.

>>>>>

>>>>

>>>> These are profile folders required by certain system services.

>>>> They are normally hidden in order to discourage eager users

>>>> from deleting them.

>>>>

>>>

>>> ...

>>>...[My] virus scan can

>>> be speeded up by excluding all compressed files from the

>>> scan.

>>>

>>> To find the folders in question, by the way, involves turning

>>> off "Hide protected operating system files". All hail

>>>

>>> "Windows XP: Inside Out" (Bott, Siechert, Stinson)

>>>

>>> my faithful companion since upgrading to XP.

>>

>> Neither of these profile folders should contain much data, in particular

>> not personal data such as .zip files. What are these .zip files?

> ...

>

> Excellent question.

>

> In localservice\local settings\temporary internet files\content IE5

> are four directories, each with an 8-character alphameric name

> with no discernible meaning. Taken together, the four names

> _could_ be a license number or installation key for something

> (not the current Zone Alarm), so I won't quote them. Each of the

> four directories contains 395 to 400 .zip files with names of the

> two forms (drum roll):

>

> av.signatures.patch-nnnn[1]

> or

> vet.signatures.patch-nnnnn[1]

>

> where "nnnn" or "nnnnn" is a 4 or 5-digit number, ascending

> by modified date, with dates from April 2006 to June 2008.

> I strongly suspect that they are Zone Alarm virus and

> possibly spyware database updates, and will follow that up

> on Zone Alarm's forum.

>

> Why in heck's name they would squirrel these files away in

> this peculiar way is beyond me. Failing to delete them,

> though, is a comprehensible human error. Recently, I did a

> superclean-supercomprehensive-wipeoutalltraces

> deinstall of Zone Alarm using the gurus' advice on the

> ZA forum, and clearly it didn't catch these files (the

> deinstall was needed to jump from a really old release

> of ZA to the modern day).

>

> Thanks for your help, and for your patience in reading

> the above.

 

VET is an anti-virus program. "AV" probably relates to some

other anti-virus program.