Missing Content.IE5 folder
in [Internet Explorer 6]
|
Prev: Invalid Syntax Error
Next: INTERNET EXPLORER / ACTIVEX
From: JK-of-Indy on 3 Mar 2006 03:04 I ran a rootkit scan and found that it flagged my C:\Documents and Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5 folder. Upon looking for it under Explorer I find nothing under the \Temporary Internet Files\ folder. The folder view settings are on to show hidden system files. IE works OK, but I am suspicious. I have other accounts on the same PC and they all have the Content.IE5 folder (with sub-folders). Can anyone advise 1) Is it normal to have a missing Content.IE5 folder? 2) Could this be a rootkit infection? 3) If this is abnormal, how can I correct it? Thanks. JK-of-Indy
From: Frank Saunders, MSMVP-OE on 3 Mar 2006 03:33 "JK-of-Indy" <JKofIndy(a)discussions.microsoft.com> wrote in message news:708373C9-9715-4CBE-B9C3-4B088C68C4C2(a)microsoft.com... >I ran a rootkit scan and found that it flagged my C:\Documents and > Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5 > folder. > Upon looking for it under Explorer I find nothing under the \Temporary > Internet Files\ folder. The folder view settings are on to show hidden > system files. > IE works OK, but I am suspicious. I have other accounts on the same PC > and > they all have the Content.IE5 folder (with sub-folders). > Can anyone advise > 1) Is it normal to have a missing Content.IE5 folder? > 2) Could this be a rootkit infection? > 3) If this is abnormal, how can I correct it? > Thanks. JK-of-Indy It's there, but Windows Explorer won't show it to you unless you're logged on as a different Windows User. Maybe you have to logon as the default Administrator. -- Frank Saunders, MS MVP, OE,WM Please reply in newsgroup. Do not send email!
From: kaream on 3 Mar 2006 14:24 Frank Saunders, MSMVP-OE wrote: > "JK-of-Indy" <JKofIndy(a)discussions.microsoft.com> wrote in message > news:708373C9-9715-4CBE-B9C3-4B088C68C4C2(a)microsoft.com... > >I ran a rootkit scan and found that it flagged my C:\Documents and > > Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5 > > folder. > > Upon looking for it under Explorer I find nothing under the \Temporary > > Internet Files\ folder. The folder view settings are on to show hidden > > system files. > > IE works OK, but I am suspicious. I have other accounts on the same PC > > and > > they all have the Content.IE5 folder (with sub-folders). > > Can anyone advise > > 1) Is it normal to have a missing Content.IE5 folder? > > 2) Could this be a rootkit infection? > > 3) If this is abnormal, how can I correct it? > > Thanks. JK-of-Indy > > > It's there, but Windows Explorer won't show it to you unless you're logged > on as a different Windows User. Maybe you have to logon as the default > Administrator. > > -- > Frank Saunders, MS MVP, OE,WM > Please reply in newsgroup. Do not send email! It's "normal" in the sense that unlike earlier versions, XP was deliberately set up to make the Content.IE5 folder not only hidden but "super-hidden", so that Windows Explorer cannot find or recognize it. This is not in itself indicative of an infection. Presumably Microsoft knows why Windows was changed this way, but if so, they aren't telling. As both you and Frank Saunders indicated, what's really happening is that only your *own* Content.IE5 folder is hidden -- you can easily see any other Content.IE5 folders resident in the different logons in Documents and Settings. You may or may not be able to log on in your computer as a different user, depending on how it was set up. But it isn't really necessary to do that; there are other methods. The first question is whether you are trying to cover your tracks and delete everything showing where you've been, or whether you're simply curious to see what's there. If you're trying to wipe the slate clean, there's gobs of info posted here in Google Groups (seemingly of varying accuracy and utility) -- just search Groups for "Content.IE5" and start rummaging. Otherwise, the simplest way to access the folder is to open Folders view, click down though C: \ Documents and Settings \ [my logon name] \ Local Settings, and click on Temporary Internet Files. This displays all of the cookies and other pointers to files from visited websites, and also puts this address in the Address bar at the top. In the Address bar add "\Content.IE5" following the word "Files" and hit Enter or click Go. Now you'll see Content.IE5 with all of its 8-character randomly-named subfolders, usually about 16 to 20 of them. Unlike the cookies and pointers in the main TIF folder, these are actual files that had been automatically downloaded from every visited website. These files can be opened, copied, moved, run, or otherwise manipulated, and may be individually deleted. The file names are similar to, but slightly different from the names in the main TIF folder. If you're looking for something in particular, it might be inside any of the various subfolders; sorting each subfolder by date, type or size makes it easier to locate a specific file. Explorer Search still won't work here; you have to do the looking yourself.
From: kaream on 3 Mar 2006 14:29 Frank Saunders, MSMVP-OE wrote: > "JK-of-Indy" <JKofIndy(a)discussions.microsoft.com> wrote in message > news:708373C9-9715-4CBE-B9C3-4B088C68C4C2(a)microsoft.com... > >I ran a rootkit scan and found that it flagged my C:\Documents and > > Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5 > > folder. > > Upon looking for it under Explorer I find nothing under the \Temporary > > Internet Files\ folder. The folder view settings are on to show hidden > > system files. > > IE works OK, but I am suspicious. I have other accounts on the same PC > > and > > they all have the Content.IE5 folder (with sub-folders). > > Can anyone advise > > 1) Is it normal to have a missing Content.IE5 folder? > > 2) Could this be a rootkit infection? > > 3) If this is abnormal, how can I correct it? > > Thanks. JK-of-Indy > > > It's there, but Windows Explorer won't show it to you unless you're logged > on as a different Windows User. Maybe you have to logon as the default > Administrator. > > -- > Frank Saunders, MS MVP, OE,WM > Please reply in newsgroup. Do not send email! It's "normal" in the sense that unlike earlier versions, XP was deliberately set up to make the Content.IE5 folder not only hidden but "super-hidden", so that Windows Explorer cannot find or recognize it. This is not in itself indicative of an infection. Presumably Microsoft knows why Windows was changed this way, but if so, they aren't telling. As both you and Frank Saunders indicated, what's really happening is that only your *own* Content.IE5 folder is hidden -- you can easily see any other Content.IE5 folders resident in the different logons in Documents and Settings. You may or may not be able to log on in your computer as a different user, depending on how it was set up. But it isn't really necessary to do that; there are other methods. The first question is whether you are trying to cover your tracks and delete everything showing where you've been, or whether you're simply curious to see what's there. If you're trying to wipe the slate clean, there's gobs of info posted here in Google Groups (seemingly of varying accuracy and utility) -- just search Groups for "Content.IE5" and start rummaging. Otherwise, the simplest way to access the folder is to open Folders view, click down though C: \ Documents and Settings \ [my logon name] \ Local Settings, and click on Temporary Internet Files. This displays all of the cookies and other pointers to files from visited websites, and also puts this address in the Address bar at the top. In the Address bar add "\Content.IE5" following the word "Files" and hit Enter or click Go. Now you'll see Content.IE5 with all of its 8-character randomly-named subfolders, usually about 16 to 20 of them. Unlike the cookies and pointers in the main TIF folder, these are actual files that had been automatically downloaded from every visited website. These files can be opened, copied, moved, run, or otherwise manipulated, and may be individually deleted. The file names are similar to, but slightly different from the names in the main TIF folder. If you're looking for something in particular, it might be inside any of the various subfolders; sorting each subfolder by date, type or size makes it easier to locate a specific file. Explorer Search still won't work here; you have to do the looking yourself.
From: kaream on 3 Mar 2006 14:29
Frank Saunders, MSMVP-OE wrote: > "JK-of-Indy" <JKofIndy(a)discussions.microsoft.com> wrote in message > news:708373C9-9715-4CBE-B9C3-4B088C68C4C2(a)microsoft.com... > >I ran a rootkit scan and found that it flagged my C:\Documents and > > Settings\<user>\Local Settings\Temporary Internet Files\Content.IE5 > > folder. > > Upon looking for it under Explorer I find nothing under the \Temporary > > Internet Files\ folder. The folder view settings are on to show hidden > > system files. > > IE works OK, but I am suspicious. I have other accounts on the same PC > > and > > they all have the Content.IE5 folder (with sub-folders). > > Can anyone advise > > 1) Is it normal to have a missing Content.IE5 folder? > > 2) Could this be a rootkit infection? > > 3) If this is abnormal, how can I correct it? > > Thanks. JK-of-Indy > > > It's there, but Windows Explorer won't show it to you unless you're logged > on as a different Windows User. Maybe you have to logon as the default > Administrator. > > -- > Frank Saunders, MS MVP, OE,WM > Please reply in newsgroup. Do not send email! It's "normal" in the sense that unlike earlier versions, XP was deliberately set up to make the Content.IE5 folder not only hidden but "super-hidden", so that Windows Explorer cannot find or recognize it. This is not in itself indicative of an infection. Presumably Microsoft knows why Windows was changed this way, but if so, they aren't telling. As both you and Frank Saunders indicated, what's really happening is that only your *own* Content.IE5 folder is hidden -- you can easily see any other Content.IE5 folders resident in the different logons in Documents and Settings. You may or may not be able to log on in your computer as a different user, depending on how it was set up. But it isn't really necessary to do that; there are other methods. The first question is whether you are trying to cover your tracks and delete everything showing where you've been, or whether you're simply curious to see what's there. If you're trying to wipe the slate clean, there's gobs of info posted here in Google Groups (seemingly of varying accuracy and utility) -- just search Groups for "Content.IE5" and start rummaging. Otherwise, the simplest way to access the folder is to open Folders view, click down though C: \ Documents and Settings \ [my logon name] \ Local Settings, and click on Temporary Internet Files. This displays all of the cookies and other pointers to files from visited websites, and also puts this address in the Address bar at the top. In the Address bar add "\Content.IE5" following the word "Files" and hit Enter or click Go. Now you'll see Content.IE5 with all of its 8-character randomly-named subfolders, usually about 16 to 20 of them. Unlike the cookies and pointers in the main TIF folder, these are actual files that had been automatically downloaded from every visited website. These files can be opened, copied, moved, run, or otherwise manipulated, and may be individually deleted. The file names are similar to, but slightly different from the names in the main TIF folder. If you're looking for something in particular, it might be inside any of the various subfolders; sorting each subfolder by date, type or size makes it easier to locate a specific file. Explorer Search still won't work here; you have to do the looking yourself. |