1. Forum
  2. Usenet
  3. ALT.COMP.OS.WINDOWS-10

  • Strange directory and files

    From MajorLanGod@21:1/5 to All on Tue May 23 22:34:39 2023
    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved is usually about half full (appox 1TB) Today I noticed that it almost
    completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the directory, each 216 mb. They were created at 12:00 AM today. All of them. I haven't
    tried to see what the contents are, if any, as I don't have any file dump progams on my system.
    The same thing happened a month o so ago, and I just deleted the directory
    with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes, and my system is scanned at least once a week, with nothing found.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From KenW@21:1/5 to All on Tue May 23 16:53:03 2023
    On Tue, 23 May 2023 22:34:39 GMT, MajorLanGod <lonelydad58@gmail.com>
    wrote:

    Running completely updated Window 11.

    THIS IS THE WIN 11

    alt.comp.os.windows-11


    KenW

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to MajorLanGod on Tue May 23 22:03:28 2023
    On 5/23/2023 6:34 PM, MajorLanGod wrote:
    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved is usually about half full (appox 1TB) Today I noticed that it almost
    completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the directory, each 216 mb. They were created at 12:00 AM today. All of them. I haven't tried to see what the contents are, if any, as I don't have any file dump progams on my system.
    The same thing happened a month o so ago, and I just deleted the directory with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes, and my system is scanned at least once a week, with nothing found.


    https://techcommunity.microsoft.com/t5/storage-at-microsoft/how-windows-vista-backup-uses-zip-files-to-store-backups-and-how/ba-p/423390

    "Backup splits the files among a series of zip files with a non-configurable
    maximum size of 200 MB (or smaller if the media has less than 200 MB available).
    Backup is designed to avoid splitting files across zips and media if possible."

    When the ZIPs are split, they're not split the same way that
    WinZIP would split them. To manually recovery them, you have
    to concatenate a set of them to build something that will work.
    The first file may have a ZIP header, the others are just "chunks"
    rather than also being ZIP files in a ZIP series. That is why
    the article has a little section involving concatenating some
    files.

    "copy /b disc*.mp4 disc1.mp4

    Here's what the output looks like in the command prompt window:

    DISC1_1.MP4
    DISC1_2.MP4
    DISC1_3.MP4
    DISC1_4.MP4
    DISC1_5.MP4

    1 file(s) copied.
    "

    As a result, the same ceremonies that work with ZIP
    attachments (a number of ZIP files with particular names),
    don't exactly work with these Backup files.

    You would have to check and see if you have "scheduled" backups
    or something, using the Microsoft tools. Because the "200MB files"
    detail is a hint. I can't think of any other tools that have
    a thing about "200MB files" :-)

    The directory name ? No clue on that aspect yet.

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Jeff Barnett@21:1/5 to KenW on Tue May 23 21:07:43 2023
    On 5/23/2023 4:53 PM, KenW wrote:
    On Tue, 23 May 2023 22:34:39 GMT, MajorLanGod <lonelydad58@gmail.com>
    wrote:

    Running completely updated Window 11.

    THIS IS THE WIN 11

    alt.comp.os.windows-11
    This was unhelpful or several reasons:

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal September does not.

    2. This Windows 10 list deals with many Windows 11 issues on a daily basis.
    --
    Jeff Barnett

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From T@21:1/5 to Jeff Barnett on Tue May 23 20:20:53 2023
    On 5/23/23 20:07, Jeff Barnett wrote:
    On 5/23/2023 4:53 PM, KenW wrote:
    On Tue, 23 May 2023 22:34:39 GMT, MajorLanGod <lonelydad58@gmail.com>
    wrote:

    Running completely updated Window 11.

    THIS IS THE WIN 11

    alt.comp.os.windows-11
    This was unhelpful or several reasons:

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal September does not.

    2. This Windows 10 list deals with many Windows 11 issues on a daily basis.


    1+

    W10 and W11 are so similar, I think they should
    be the same group.

    And who cares anyway. This group is also about
    computers too.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From T@21:1/5 to MajorLanGod on Tue May 23 20:18:59 2023
    On 5/23/23 15:34, MajorLanGod wrote:
    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved is usually about half full (appox 1TB) Today I noticed that it almost
    completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the directory, each 216 mb. They were created at 12:00 AM today. All of them. I haven't tried to see what the contents are, if any, as I don't have any file dump progams on my system.
    The same thing happened a month o so ago, and I just deleted the directory with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes, and my system is scanned at least once a week, with nothing found.


    Do you "eject" the drive before pulling it out?
    If not, start.

    Do the easy stuff first:

    Highlight the directory, press shift-del. This
    will do a complete removal (no recycle bin)
    of the weird directory.

    The open a command prompt and do a
    chkdsk x: /f
    where x is the drive letter of the flash drive

    Worst case, reformat the drive

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From wasbit@21:1/5 to Jeff Barnett on Wed May 24 10:03:17 2023
    On 24/05/2023 04:07, Jeff Barnett wrote:
    On 5/23/2023 4:53 PM, KenW wrote:
    On Tue, 23 May 2023 22:34:39 GMT, MajorLanGod <lonelydad58@gmail.com>
    wrote:

    Running completely updated Window 11.

    THIS IS THE WIN 11

    alt.comp.os.windows-11
    This was unhelpful or several reasons:

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal September does not.

    2. This Windows 10 list deals with many Windows 11 issues on a daily basis.


    I read alt.comp.os.windows-11 via Eternal-September

    --
    Regards
    wasbit

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From R.Wieser@21:1/5 to All on Wed May 24 11:14:46 2023
    Jeff,

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal September does not.

    Ethernal September does now (just checked). Neodome, netfront and mixmin
    also do. Even aioe did.

    Regards,
    Rudy Wieser

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ralph Fox@21:1/5 to R.Wieser on Wed May 24 22:13:38 2023
    On Wed, 24 May 2023 11:14:46 +0200, R.Wieser wrote:

    Jeff,

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal
    September does not.

    Ethernal September does now (just checked). Neodome, netfront and mixmin also do. Even aioe did.

    Regards,
    Rudy Wieser


    Indeed.

    Eternal September started carrying alt.comp.os.windows-11 very shortly
    after that group was created. As measured by posts from Eternal
    September users to alt.comp.os.windows-11 way back in September 2021.
    For an example, see: <http://al.howardknight.net/?ID=168492107600>


    I can also confirm that Easynews and Newshosting (and all their
    resellers) also carry alt.comp.os.windows-11. These servers use
    the Highwinds Media backbone - see: <https://commons.wikimedia.org/wiki/File:Usenet_Providers_and_Backbones.svg>


    --
    Kind regards
    Ralph

    知之为知之，不知为不知，是知也

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to MajorLanGod on Wed May 24 07:09:03 2023
    On 5/23/2023 6:34 PM, MajorLanGod wrote:
    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved is usually about half full (appox 1TB) Today I noticed that it almost
    completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the directory, each 216 mb. They were created at 12:00 AM today. All of them. I haven't tried to see what the contents are, if any, as I don't have any file dump progams on my system.
    The same thing happened a month o so ago, and I just deleted the directory with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes, and my system is scanned at least once a week, with nothing found.


    It is unlikely that any other backup program does things exactly the same way as Windows ("Win7 Backup" in Control Panels) does them.

    [Picture]

    https://i.postimg.cc/7P0WL3SY/win10-backup-demo.gif

    The built-in backup consists of a couple parts (two different folders).

    The System Image backs up C: so you can restore the operating system.
    The containers are very large and have .vhdx for a file extension.

    The profile backup uses 200MB ZIP files, but it has some rules about
    when to start new ZIP files. It can back up larger files than the
    200MB size implies, by segmenting the larger file over multiple ZIPs.
    There is a kind of demo in the picture.

    I tried File History, but when visiting the drive letter I put
    them on, they seem to be stored as ordinary files. They're likely
    done with VSS somehow, but exactly how, I haven't figured that out.
    In any case, they don't seem to be 200MB files particularly.

    *******

    Start looking around C: or in Task Manager, for some third-party
    stuff you've forgotten about.

    The directory name was obfuscated for some purpose, like privacy.
    Once you figure out what tool did it (maybe look in Taskschd.msc),
    that will make it easier to research the obfuscation of the directory
    name.

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Burns@21:1/5 to Jeff Barnett on Wed May 24 11:55:21 2023
    Jeff Barnett wrote:

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal September does not.

    Actually E-S was one of the first servers to carry the group.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From KenW@21:1/5 to All on Wed May 24 06:48:29 2023
    On Tue, 23 May 2023 21:07:43 -0600, Jeff Barnett <jbb@notatt.com>
    wrote:

    On 5/23/2023 4:53 PM, KenW wrote:
    On Tue, 23 May 2023 22:34:39 GMT, MajorLanGod <lonelydad58@gmail.com>
    wrote:

    Running completely updated Window 11.

    THIS IS THE WIN 11

    alt.comp.os.windows-11
    This was unhelpful or several reasons:

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal >September does not.

    2. This Windows 10 list deals with many Windows 11 issues on a daily basis.
    OK


    KenW

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ken Blake@21:1/5 to All on Wed May 24 07:55:39 2023
    On Tue, 23 May 2023 21:07:43 -0600, Jeff Barnett <jbb@notatt.com>
    wrote:

    On 5/23/2023 4:53 PM, KenW wrote:
    On Tue, 23 May 2023 22:34:39 GMT, MajorLanGod <lonelydad58@gmail.com>
    wrote:

    Running completely updated Window 11.

    THIS IS THE WIN 11

    alt.comp.os.windows-11
    This was unhelpful or several reasons:

    1. Many (most?) mail list servers don't carry that group; e.g., Eternal >September does not.

    Yes, it does.


    2. This Windows 10 list deals with many Windows 11 issues on a daily basis.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to Paul on Wed May 24 16:18:58 2023
    On 5/24/2023 7:09 AM, Paul wrote:
    On 5/23/2023 6:34 PM, MajorLanGod wrote:
    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved is
    usually about half full (appox 1TB) Today I noticed that it almost
    completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the directory, >> each 216 mb. They were created at 12:00 AM today. All of them. I haven't
    tried to see what the contents are, if any, as I don't have any file dump
    progams on my system.
    The same thing happened a month o so ago, and I just deleted the directory >> with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes, and my >> system is scanned at least once a week, with nothing found.


    It is unlikely that any other backup program does things exactly the same way as Windows ("Win7 Backup" in Control Panels) does them.

       [Picture]

        https://i.postimg.cc/7P0WL3SY/win10-backup-demo.gif

    The built-in backup consists of a couple parts (two different folders).

    The System Image backs up C: so you can restore the operating system.
    The containers are very large and have .vhdx for a file extension.

    The profile backup uses 200MB ZIP files, but it has some rules about
    when to start new ZIP files. It can back up larger files than the
    200MB size implies, by segmenting the larger file over multiple ZIPs.
    There is a kind of demo in the picture.

    I tried File History, but when visiting the drive letter I put
    them on, they seem to be stored as ordinary files. They're likely
    done with VSS somehow, but exactly how, I haven't figured that out.
    In any case, they don't seem to be 200MB files particularly.

    *******

    Start looking around C: or in Task Manager, for some third-party
    stuff you've forgotten about.

    The directory name was obfuscated for some purpose, like privacy.
    Once you figure out what tool did it (maybe look in Taskschd.msc),
    that will make it easier to research the obfuscation of the directory
    name.

    Another possibility that comes to mind, is Windows Easy Transfer
    and USMT materials. Maybe they are an earlier instance of a ZIP
    based thing ? The size of the materials (even though ZIPped),
    may correspond to the size of the user profile (home directory).

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From MajorLanGod@21:1/5 to Ralph Fox on Wed May 24 20:20:55 2023
    Ralph Fox <-rf-nz-@-.invalid> wrote in news:romr6i5j21vnaa009m1b2cif0gennfeud1@4ax.com:

    I can also confirm that Easynews and Newshosting (and all their
    resellers) also carry alt.comp.os.windows-11. These servers use
    the Highwinds Media backbone - see: <https://commons.wikimedia.org/wiki/File:Usenet_Providers_and_Backbones
    .svg>



    This was a nice digression, but does anyone have any idea about my original question?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Stan Brown@21:1/5 to Ralph Fox on Thu May 25 10:50:59 2023
    On Wed, 24 May 2023 22:13:38 +1200, Ralph Fox wrote:
    Eternal September started carrying alt.comp.os.windows-11 very shortly
    after that group was created.


    As did news.individual.net, if memory serves. In any case, it's there
    now.

    Windows 10 and Windows 11 have some things in common, but there are
    quite a few differences. I disagree with whoever felt there should be
    only one newsgroup for the two of them.

    --
    Stan Brown, Tehachapi, California, USA https://BrownMath.com/
    Shikata ga nai...

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From MajorLanGod@21:1/5 to MajorLanGod on Tue Jun 13 05:10:52 2023
    MajorLanGod <lonelydad58@gmail.com> wrote in news:XnsB00DB2CF5D7D3lonelydad58.gmail.co@85.12.62.225:

    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved
    is usually about half full (appox 1TB) Today I noticed that it almost completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the
    directory, each 216 mb. They were created at 12:00 AM today. All of
    them. I haven't tried to see what the contents are, if any, as I don't
    have any file dump progams on my system.
    The same thing happened a month o so ago, and I just deleted the
    directory with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes,
    and my system is scanned at least once a week, with nothing found.


    OK, I have confirmed that these iiles come from Eraser (The Eraser
    Project). I currently have it erasing a drive using the 'free space' option
    and those files have sown up again. I now know that I can waid till Eraser finishes and then just delete them all.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From MajorLanGod@21:1/5 to MajorLanGod on Tue Jun 13 18:41:05 2023
    MajorLanGod <lonelydad58@gmail.com> wrote in news:XnsB00DB2CF5D7D3lonelydad58.gmail.co@85.12.62.225:

    Running completely updated Window 11. This is the second time this has
    shown up.
    I have a couple of external USB drives on my laptop. The one involved
    is usually about half full (appox 1TB) Today I noticed that it almost completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the
    directory, each 216 mb. They were created at 12:00 AM today. All of
    them. I haven't tried to see what the contents are, if any, as I don't
    have any file dump progams on my system.
    The same thing happened a month o so ago, and I just deleted the
    directory with no visible ill effects.

    Anyone have any idea where thhis is coming from. I run Malwarebytes,
    and my system is scanned at least once a week, with nothing found.

    I have confirmed that Eraser (The EEraser Project) is the source of the
    mystery files. I ran Eraser aain yesterday, using the Free Space option,
    and the files showed up again. So npw I know the source and how to deal
    with the results

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Burns@21:1/5 to MajorLanGod on Thu Dec 14 04:03:54 2023
    MajorLanGod wrote:

    I have a couple of external USB drives on my laptop. The one involved
    is usually about half full (appox 1TB) Today I noticed that it almost completely full, and this weird directory has shown up. Here is the
    directory nameL eGzewu8d ghi5YgCfC. There are 1,319 files in the
    directory, each 216 mb. They were created at 12:00 AM today.

    Are you sure it's a genuine 1TB device? Sounds like the sort of
    behaviour you get when a fake device "overflows" the smaller amount of
    actual space it has got ...

    Have you got space on another drive to backup the contents and test it?

    <https://h2testw.en.lo4d.com/windows>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)