Camp Holloway Discussion Forum Archive 04 - 01/01/04 to 02/10/06

I found this on a website.

Folks I found this on a website about the use of INI files to create mischief. Maybe this will help others in the future.
It is a bit of web traffic between some new guy and others. BTW I deleted the one that had a call for posting some HTML stuff.
I have also enclosed the HTML code below in quotes to keep it from doing damage. The Virus scan did not identify the culprit. I had to look at all of them.
Bob T
THE POSTINGS:
am a newbie i don't about this

i have two files appearing in my computer desktop.ini and folder.htt. i heard they are virus. how to remove them.

THE ANSWER:
DON'T DELETE THEM !!

There are too many so-called experts out there offering the wrong advice.

YES, the files that you mention CAN be infected and overwritten by a virus, and the reason for this is that they hold settings which can allow a virus to change the way your "system folders" behave, and can be useful to virus writers.

An .INI file is one that "initialises" some programme or process when it is run. Many programmes on your system save settings to their own .ini file such as the preferences you set in the user options menu, the window placement and size, etc.

Desktop .ini is found in several different folders on your computer that are registered as "System Folders". Do a Start > Find > Files or Folders and type desktop.ini.

Take the example of the "desktop.ini" file in your "C:\Windows\Favorites" system folder. It contains something like:

[.ShellClassInfo]
CLSID={1A9BA3A0-143A-11CF-8350-444553540000}

[ExtShellFolderViews]
{5984FFE0-28D4-11CF-AE66-08002B2E1262}=%windir%\web\favorite.htm

These are the unique references to your Registry where the settings for the behaviour of the folder are stored. The 2nd line on mine says that the web page that should load to display my "favorites" in the left pane of Internet Explorer is at C:\Windows\web\favorite.htm.

An .htt file is the file that will allow the folder it is placed in to display a certain way. eg. the one at C:\Windows\web, contains the code that makes up a web page (HTML) like this:

"HTML CODE DELETED by Bob Taylor”
etc.

DON'T tamper with these files unless a Virus Scan identifies them as being infected.

If you don't want to see them, then do as Sysux says to hide them.

Hope this helps.

Comment from anithanya
Date: 07/08/2003 10:39PM PDT Author Comment

My Virus Scan as identified it as infected what i should do?

Comment from Synux
Date: 07/08/2003 11:15PM PDT Comment

If they are infected they must be repaired or deleted. Those are your only choices. If you delete them you may be able to restore them from another PC (same OS) or backup (unlikely that you would have one of those particular files). This can be a sticky subject because if they are deleted and the restore process is unsuccessful then you will have to reinstall and all of this puts your data at risk so first of all back up your data then clean the files. If they aren't cleanable then delete and try to restore as indicated above. Often too, Windows will recreate necessary files upon restart. I honestly don't know how it will treat these but a reboot after deleting may be of help. Best of luck to you.

Messages In This Thread

I found this on a website.
Re: I found this on a website.