The Case of the Phantom Desktop Files

re: The Case of the Phantom Desktop Files

Chris Quirke — Thu, 27 Jan 2011 15:30:30 GMT

It's a bit disturbing that a web site is attempting to drop files on the desktop; that's the sort of thing one usually expects from Chrome or Safari, but I'd hope IE would not allow that - as indeed IE8 on modern Windows doesn't, thanks to the virtualization, shims etc.

Would IE6 on XP have allowed those files to be dropped on the "real" desktop?

re: The Case of the Phantom Desktop Files

Christian — Tue, 28 Sep 2010 10:36:11 GMT

Sth like this happened to me on a removable media (USB Flash) and a trojan virus. The exe was hidden, did not appear in the Explorer (despite the fact that I have set it to SHOW the hidden files...) and was only visible when I "dir"-ed:

dir Z:\*exe /A:H

I've tried to delete it with no luck... :(

Finally I formatted the disk and checked my system just to be somewhat sure...

So, if you know what could cause sth like this or how to fix it (using a better way) in the future, it would be great! :D

I will try your RootKit Finder soon too. :)

re: The Case of the Phantom Desktop Files

B. Smith — Mon, 13 Sep 2010 20:03:42 GMT

Wow, thanks for the advice. You're great with computers, though not with animals and women.

re: The Case of the Phantom Desktop Files

James Bray — Tue, 25 May 2010 14:59:18 GMT

"As a bonus, my wife was impressed at the ease with which I’d figured out the source of the phantom files and even more impressed that I wrote the tool I used to solve it."

Surely she must have slight inkling of your level of Geek cred :-) Hell, I'd certainly advertise it...

/me wonders why he's still single :-)

re: The Case of the Phantom Desktop Files

Elod Kironsky — Mon, 22 Feb 2010 15:19:22 GMT

We've experienced this problem in our company lately so I started to investigate it with the great Sysinternals tools from Mark. The only problem is, that this virtualization of PMIE is permanent, e.g. the acredir.dll hooks will re-direct all write attempt to the Virtualized folder. This doesn't make any sense, because this virtualization is used only for write attempts and not for reading!!! Also if you actually grant write rights for IE to the desired folder, it will still write to the Virtualized folder!!! This is IMHO incorrect. The only function I found to handle such redirection is AcRedirSetEnabled() and AcRedirSetEnabledForCurrentThread() exported from acredir.dll. But I have very little documentation for these functions. Alternatively you should be able to use CreateFile from ntdll.dll.

re: The Case of the Phantom Desktop Files

Tapxe — Tue, 21 Jul 2009 06:06:07 GMT

I had this problem a few weeks back as well... I solved it very easily. Right-click->properties (or file-> properties from a pdf or something) then cut and paste. Done...

(well, i guess figuring out exactly why it happened is sort of interesting)

re: The Case of the Phantom Desktop Files

Gordon Edwards — Sun, 07 Jun 2009 09:38:19 GMT

Very interesting. I use W2K Pro SP4 (Yeah, I know, but don't you got to love it?) and sometimes the offspring put up a new desktop direct from their E:\ folders without bothering to make it into a .bmp blah blah... When they log off, often you can see old wallpapers flash up and disappear. I've always cured this by invading their privacy and making bmp's in the WINNT folder where they belong. But it's comforting to learn something of the virtualisation which dogs even older software!

re: The Case of the Phantom Desktop Files

Comet — Tue, 02 Jun 2009 23:08:48 GMT

If the "Desktop" view in Explorer, etc., would concatenate the user's virtualized Desktop with the user's real desktop (and, I suppose, the All Users real desktop), then the unified view would not confuse the user; they wouldn't care if the files were stored in the virtual location or in the actual location. As somebody mentioned, it would be good if the virtualized file icons had some type of indicator, similar to the shortcut arrow's usage.

re: The Case of the Phantom Desktop Files

Chris, Happy still using WindowsME — Sun, 19 Apr 2009 21:56:44 GMT

Quote from Luigi D. Sandon: "I too agree that MS should stop to put too much emphasis on "compatibility". Windows should be compatible with well written applications, and should begin to stop those written without following the rules."

The point is that these ActiveX objects WERE written following the rules in force at the time. It is Microsoft who changed the rules, for good reason, but Microsoft now has a duty to honour the correct operation of existing ActiveX components.

The way forward is to inform the User. When an old style ActiveX control acts in this way, an information balloon should explain to the User, with clickable [+] and [-] to expand for a more or less detailed explanation. Don't forget information balloons can be invasive. Give balloons the abillity to be minimized so they can be read more thoroughly at a more appropriate time. Better still, give information balloons their own archive area.

Inform the User. Don't interrupt them. Don't confuse them.

how is the delete operation handled

andi — Tue, 07 Apr 2009 11:01:49 GMT

Does the legacy application "see" the existing, non-virtual files? I think the answer is yes.

If it does, how does vista solve the delete file operation for a legacy application?