what is "cd4f11d23e3716b84c14abcfeaea" and how did it get installed?

Possible Duplicate:
Windows Updates Folders (With Strange Names) in C drive
What are these folders created on my Western Digital 2TB Mirror?

Mystery: Two nights ago, a 20GB file appeared on an almost empty non-OS drive in my computer. I did not install or download it. It has appeared in a drive I only normally use for backups. It will not let me erase it. It has the title cd4f11d23e3716b84c14abcfeaea I can open it but I can't open any of the sub folders. Here is what it looks like when I open it capture of files within mystery file made with snipping tool

Can anyone tell me if this is malicious and if so how I can remove it?

Thank you

the watchmaker

Posted 2012-02-11T11:14:13.730

Reputation: 169

possible duplicate of What are these folders created on my Western Digital 2TB Mirror? and/or Windows Updates Folders (With Strange Names) in C drive

– Ƭᴇcʜιᴇ007 – 2012-02-11T16:34:27.490

This issue is so annoying since its so difficult to google it, unless the stars align and your hash matches someone elses hash – TheLQ – 2012-02-15T21:35:24.667

What does SplashScreen.bmp look like? this can usually tell you what it is – Nate Koppenhaver – 2012-06-07T22:13:10.360

Answers

This is a security update from Microsoft, why it install to your backup drive may do with available space:

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27017

N4TKD

Posted 2012-02-11T11:14:13.730

Reputation: 979

1this is most likely correct. And you should be able to just delete it through command prompt or after a restart – Raystafarian – 2012-02-11T12:56:48.980

Sometimes MS software updates fail to remove the temporary directories created during install. You can safely remove it.

kinokijuf

Posted 2012-02-11T11:14:13.730

Reputation: 7 734

This is from file name NDP40-KB2539636 identified as a .NET 4.0 security update (KB2539636). From this, you can find the bulletin number and look it up for further ID (MS11-069)

The name of the directory is a guid assigned for the install and is where the update has been uncompressed for install.

On Windows XP, the update would create a log file with the KB2539636 identifier in your C:/Windows folder.

Any time you see these KB numbers, it's fairly easy to look up the patch and bulletin info.

As to why it's on this drive, if you look in your System Restore settings, you probably will find that System Restore is also using this drive for its backups. Any drives thus identified with free space are fair game for Windows to create a temporary direcory for use in uncompressing system updates before their application to the OS.

As a cross reference, in Windows 7 Control Panel\All Control Panel Items\Windows Update\View, update history will show an entry referencing KB2539636, its imporance, install status and day installed.

Fiasco Labs

Posted 2012-02-11T11:14:13.730

Reputation: 6 368