1

I did some reaches, and I know "Desktop.ini" and "Thumbs.db" files are hidden files for view customizations, and I know they should be safe files and I can delete them. Also, I know if I turn off "show hidden files" they will be gone (but we know they are not really gone, they are just invisible).

However, I never saw it before, until I installed a fake application. After that, almost every single file (even the subfiles) in my computer contains these two files, especially "Desktop.ini". Worse, these two files try to copy themselves to any plugin device and media. For example, when I insert a CD into my CD-ROM the system says "desktop.ini is ready to write into the CD," and almost every flash drives contain these two files after plugged into my computer.

I tried to use anti-virus software to kill and remove these two files such as Kaspersky and Mcafee, but both of them reported that my computer was good after I did a whole drive scan. But I was sure that these two files were the virus, otherwise, it would not copy them self to other file and I should see them before I installed that fake application. So, decided to reinstall my entire OS system (format the internal hard drive and reinstall again).

Now, these files are gone even I turn on "show hidden files." However, few days ago I insert a CD again, and the system still says "desktop.ini is ready to write into the CD," (but flash drives have not contained these files again after I plugged in) . So, after I turn on "show hidden files" and "Hide protected operating system files", "Desktop.ini" is showing up again (the "Thumbs.db" is in some of the files but not every file). This time, they are not in my every single file but the majority files such as "Desktop", "Downloads," and "My Documents"

Sorry, I write too much description, but it is really driving me crazy and I really want to make sure these two files are the virus or not now? If they are, how can I get rid of them? My computer is Windows 10.

2

Are these two files virusses? No. They're a byproduct of whatever you installed.

Desktop.ini is a file that contains extra information for that specific folder, such as its view settings and sort etc.

Thumbs.db is a small database containing all the thumbnails generated when you use one of the thumbnail views (thumbnails, extra large icons, large icons, medium icons, etc)

It is my conclusion that the program you installed alters explorer to show this info. You need to specify more about this fake application that you installed, but it could be a toolbar that nests itself into your explorer.

  • Thank you for answer my question, and I totally understand what you said because I did research about these two files. However, as you said if these two files are not viruses why it will copy them self to every folder and extend device like flash drive or CD in my CD-ROM? This action never happened before I installed that fake application, and I am sure that was a fake viruses application because after I installed the application, it was not what I wanted, moreover it would open a lot of commercial websites every time when I clicked a web-browser (Firefox, Chrome, and IE). – Mr. 111 Jun 6 '16 at 15:00
  • Yes, see my conclusion. This application somehow modified explorer to alter the settings on each folder, causing both files to be generated by explorer. Its a side-effect. – LPChip Jun 6 '16 at 15:02
  • I see, but how can I stop them to copy them self to others? Like, stop copy them self to my flash drives or CD in my CD-ROM? I know I can let them be "invisible", but is any way that I can stop that action? – Mr. 111 Jun 6 '16 at 15:21
  • 1
    First, understand that they are not copied. They are generated. The exact reason as to why and how to stop is hard to answer. Then again, they're not part of your original question and it would be impossible to answer on SuperUser anyway. If you had this program and you removed it, but it still does this, then the program is not 100% removed. As with any virus/spyware, if removing does not 100% solve the issue, the only thing you can do to ensure it is gone, is to reinstall windows. – LPChip Jun 6 '16 at 17:56
1

Look inside the files if you suspect a virus. Open them with a hexreader or the notepad (only) .
So far nothing you have indicated, as hard as it is to read, is abnormal.

Thumbs databases will be recreated as a cache for picture and video files thumbnails, and can be turned off computer wide , and cleaned out if desired, to assist your discovery.

Desktop.ini should contain only simple couple of lines of textlike data , defines special folders, could be found in roots of disks but not nessisarily.

If your into controlling and seeing everything, make sure your seeing all the extentions of files, so things like Desktop.ini.exe or Thumbs.db.exe would show up in a confusing way.

  • 1
    Thank you for answer my question, and I did what you said. I opened them with notepad++ and I forgot what I saw. However, now "Desktop.ini" only a few lines like "[.ShellClassInfor] LocalizaedResourceName=@%SystemRoot%\system32\shell32.dll,-21799" Is this normal? – Mr. 111 Jun 6 '16 at 15:27
  • yes. very normal – Psycogeek Jun 7 '16 at 2:48
1

I suggest turning off Microsoft's useless Hide extensions of known file types. in Folder Options under View tab.

this way you'll be able to determine if the files are malicious or not, as follows :

if the file name is Desktop.ini.exe , or anything else except Desktop.ini , then it is not the System-supplied folder configurations file , but it's indeed a virus. same goes for thumbs.db ,

showing file extensions and hidden system files if you know what you're doing is really useful because most viruses are known to hide your actual folders on a system-level(ie: mark the folders as system files) and replace them with a folder-looking application that would open your desired folder AND perform its malicious code at the same time.

  • Thank you for answer my question, and I did turning off the "Hide extensions of known file type" and yes I think that option useless. Anyway, these files do not contain any .exe extensions, they are just .ini and .db. However, just like I said I never saw them before I install that stupid fake application, and after that these files tried to copy them self to every folder and extend device like flash drive or CD in my CD-ROM, moreover, I could not delete them (after I delete, it will show up again after I restart my PC or re-plug in my flash drive). How could that possible? – Mr. 111 Jun 6 '16 at 15:13
  • It might be due to a Windows setting or program that automatically changes default layout in all folders across your system, which in its turn , forces the desktop.ini to be re-created, also thumbs.db shouldn't normally be created if there's no pictures/videos in a folder. – Abood Syr Jun 6 '16 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.