C:\Documents and Settings\LocalService\Application Data\Microsoft\Prot

[skip2004]

C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect

I have this folder on my machine and it is causing me a wee bit of grief.

In this folder the is a file called CREDHIST and a folder called S-1-5-19

From what I can find from searching on google it seems to be a normal structure.

However, there are a load of files underneath the S-1-5-19 - I can't see them in windows explorer but my virus software (AVG Free) takes ~12 hours to scan it.

Does anyone know any more info about this folder and what it is for? Is there anyway I can reduce the amount of files in it so my virus software will work?

Thanks in advance.

 

[BadBigBen]

SID (Security Identifier) S-1-5-19 denotes the LOKAL SERVICE ACCOUNT...

more info:

http://support.microsoft.com/kb/163846

and why AVG takes up to 12hrs to scan it, I have no idea... This file and location does not exist on my standalone WS...


Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[linney]

This appears to be a normal Windows folder and files location, it is only visible while you are showing hidden an system files.

AVG can scan it in seconds without any problems on the machines I have checked. There are only about 10 or less files involved.

This suggest that you may have some corruption in AVG which might be cured by a re-install of AVG, or there is some corruption in the folder which might be fixed by running ChkDsk to check your drive for errors. Right-click your Drive icon/ Properties/ Tools/ Error Checking. Select both boxes.

How many files do you have in this folder? Can other scanning programs scan that folder without any problems?

 

[skip2004]

Thanks for the replies.

I have tried running a chkdsk - and re-installing AVG but to no avail.

There are thousands of files - windows explorer hangs if I try to view the files in this folder.

If I navigate to that folder in a command window and run dir /ah it lists files for ages - never waited for it to finish but there are loads of files - each 338 bytes in size.

Something doesn't seem right to me!

 

[linney]

Me, neither.

Copy them to CD or DVD if you can. See when they were created via Properties etc., mine go back a couple of years, but I only have a handful, yours are breeding like mice!
After they are safely backed up maybe you can delete them from the folder, and also from the clutches of System Restore, which may automatically save them, and still cause scanning problems.

How Private Keys Are Stored

http://www.microsoft.com/technet/pr...rv/reskit/distrib/dsck_efs_mkqd.mspx?mfr=true

I haven't read all these, but they may be worth a read?

http://www.google.com/search?q=Appl...ox&ie=UTF-8&oe=UTF-8&sourceid=ie7&rlz=1I7GGLG

http://groups.google.com/groups/search?q=Application+Data\Microsoft\Protect&qt_s=Search+Groups

Is it only the one user profile that is showing this obvious (to me) fault?

 

[skip2004]

Thanks for your reply linney. I will try your suggestions and have a look at those links.

It only seems to be affecting the LOCALSERVICE protect folder (C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect).

If I look in another folder eg. C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect then there are only a few files like on your machine.

Something is causing the files to appear - and they all seem fairly recent ie. Feb/March of this year. I don't think I have installed any software which coincides with those dates but will investigate further - I think the last piece of software I installed was SQLServer 2005 development edition - so at the moment that is the prime suspect (I may uninstall that software to see if it cures it).

Thanks for your advice.

 

[Lemon13]

have u checked event-viewer ?

 

[skip2004]

SQL Server 2005 Reporting Services seems to be creaitng a lot of errors - I think my next step is to remove SQL Server 2005.

 

[linney]

Handy program to know about, when strange files are being created.

FileMon for Windows v7.04

http://www.microsoft.com/technet/sysinternals/utilities/Filemon.mspx

 

[skip2004]

Thanks - will give that a go.

I've removed SQL Server 2005 reporting services - I'll run filemon filtering on that folder for a week or so - and if nothing accesses the files I will archive and then remove.

 

[skip2004]

I've finally let windows explorer open up the folder - there are a staggering 1,122,458 files!

After removing SQL Server 2005 reporting services no more files have been created in that folder, so hopefully I have found the culprit!

I will archive and delete those files - and keep an eye on the folder to see if any more files arrive (hopefuly not!)