Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone recognise this suspicious folder that sits on my C drive?

The folder sits on my C drive at C:\cacde6d0fd849a939328ab\ The name obviously looks like a hash/encryption/or junk text.

The folder has the following contents: enter image description here

Do you recognise these files and know if they are benign parts of windows or malicious program files?

What makes me suspicious is that the folder and all its files are locked and cannot be deleted and because of the root folder name. I am aware that sometimes when Windows is uninstalling a program and the uninstallation is interupted that these kinds of folders can remain and have exe's in it by the name of htstub.exe (or something similar). Is this folder something similar, ie, benign?

share|improve this question

closed as off-topic by tylerl, Adi, Gilles, Xander, NULLZ Aug 4 '13 at 14:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – tylerl, Adi, Xander, NULLZ
If this question can be reworded to fit the rules in the help center, please edit the question.

Please, DO NOT CROSS-POST.....… – Terry Chia Aug 4 '13 at 4:13
Take a look at the splash screen. If you recognize the logo you're ok otherwise use the SetupUtility you highlight to uninstall it. There are many reason why a vendor would choose a hash-like folder name, if it were malware it would find a better place to hide. – rath Aug 4 '13 at 5:33

Just googled for NDP40-KB2840628 and it gave: MS13-052: Description of the security update for the .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: July 9, 2013. Further, the download size of the patch file at Microsoft Website is indeed 17.3 MB in size which corresponds to the one shown in your screenshot. If you need further evidence, run the setup file and it should be signed by Microsoft. The Verified Publisher field would show Microsoft Corporation.

Malware don't hide itself in the root of a drive and it won't have a size of 17 MB. And it won't be signed by the Microsoft code signing server (unless off course it is the Flame which was indeed sized at around 20 MB and part of it was signed by the spoofed Microsoft certificate!). But if this is indeed Flame then you are up against NSA!!!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.