Kirbycap Posted May 16, 2021 ID:1457185 Share Posted May 16, 2021 Hey, I'm unsure if this is the right part of the forum to post this. But it goes like this I just went onto to check my drives and in my recovery partition I found an ''desktop.ini''. Should that be there or could this be some sort of malware, I have scanned with ADS-Spy/Alternate Data Stream Spy and it showed that the desktop.ini was ''Cached-Tiles'' and 200~ bytes. But when I opened it in notepad it was completely empty. Link to post Share on other sites More sharing options...
kevinf80 Posted May 16, 2021 ID:1457199 Share Posted May 16, 2021 (edited) Hello Kirbycap and welcome to Malwarebytes, Desktop.ini is a file that determines the way a folder is displayed by Windows. These files can be found in any folder on your computer, as long as that folder has a custom appearance set for it. Desktop.ini files control things like the icon used for that folder and its localized name. They only show their presence when the option to "Hide Files and Folders" is changed to "Unhide" It is possible to delete desktop.ini files, if a change is made to the concerning folder's layout it will be regenerated automatically. Since deleting system files is not generally advised, a better option is usually to hide system files/folders instead. The following link shows how to show hidden files/folders, to rehide just reverse the show option: https://support.microsoft.com/en-gb/help/14201/windows-show-hidden-files Thank you, Kevin.. Edited May 16, 2021 by kevinf80 Link to post Share on other sites More sharing options...
Kirbycap Posted May 16, 2021 Author ID:1457215 Share Posted May 16, 2021 Hey, I tried to doing what that guide said but i'm still seeing this Desktop.ini, I rebooted my pc to see if it worked but it didn't work. But there is one thing confusing me I can open the desktop.ini in notepad but it is empty but the ''Recovery'' has an customized icon. Link to post Share on other sites More sharing options...
Kirbycap Posted May 16, 2021 Author ID:1457217 Share Posted May 16, 2021 8 minutes ago, Kirbycap said: Hey, I tried to doing what that guide said but i'm still seeing this Desktop.ini, I rebooted my pc to see if it worked but it didn't work. But there is one thing confusing me I can open the desktop.ini in notepad but it is empty but the ''Recovery'' has an customized icon. I could double click on it and it opened Notepad could that be a problem, But anyways I tried right clicking on it and went into properties and at the bottom it said ''Attributes: Read-only or Hidden''. If I chose hidden it disappeared. But i'm wondering why didn't Microsofts own troubleshoot work? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 16, 2021 Root Admin ID:1457228 Share Posted May 16, 2021 Hello @Kirbycap if you've followed the advice of those articles then you should not be able to see a desktop.ini file. Let's go ahead and get some logs though to double-check and see what's going on with the machine Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well. Thank you Link to post Share on other sites More sharing options...
Kirbycap Posted May 16, 2021 Author ID:1457236 Share Posted May 16, 2021 Hey, it's an urgent situation I guess. I watched an video how to download it but it didn't want to download on my desktop ''cause I didn't have administrator access'' so it went somewhere else me being completely confused. So I found it but then I deleted it then some minutes later I found out that I had to rename it to Uninstall.Exe will this destroy my pc? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 16, 2021 Root Admin ID:1457259 Share Posted May 16, 2021 You don't want to rename it. You want to keep the name please. FRST.EXE or FRST64.EXE Renaming it will uninstall and delete it from your system. We don't want to delete it we want to run it to get the logs please. Link to post Share on other sites More sharing options...
Kirbycap Posted May 17, 2021 Author ID:1457295 Share Posted May 17, 2021 6 hours ago, AdvancedSetup said: You don't want to rename it. You want to keep the name please. FRST.EXE or FRST64.EXE Renaming it will uninstall and delete it from your system. We don't want to delete it we want to run it to get the logs please. Oh sorry if I was unclear, I installed FRST in the wrong location which I at the time thought it was desktop, but it showed my username and said that I didn't have administrator access to download it on the desktop so it re-directed to just the downloads folder. After that I saw the program pop up with the scan button but it wasn't on the desktop so I uninstalled it without uninstall.exe. Damn.. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 17, 2021 Root Admin ID:1457301 Share Posted May 17, 2021 You need to be logged in and using an account that has Admin rights. Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well. Thank you Link to post Share on other sites More sharing options...
Kirbycap Posted May 17, 2021 Author ID:1457302 Share Posted May 17, 2021 Hey, Thing is I was logged in with an administrator account I have fixed that problem now. 1 minute ago, AdvancedSetup said: You need to be logged in and using an account that has Admin rights. Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well. Thank you Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 17, 2021 Root Admin ID:1457303 Share Posted May 17, 2021 Okay, if you're sure I'll go ahead and close your topic then. If you do decide you need further help please let us know. Take care and have a good week Cheers Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 17, 2021 Root Admin ID:1457304 Share Posted May 17, 2021 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts