29

When I try to delete one of these two shortcuts, a message appears saying, "If you remove this file, Windows or another program may no longer work correctly."! I don't think that it is possible to keep same named files into a single directory. Is this any malware or anything harmful for my PC?

0

3 Answers 3

34

One of them is in the “All Users” profile (%PUBLIC%\Desktop). One of them is in your profile (%USERPROFILE%\Desktop). They are both hidden system files. If you want them to disappear, you’ll have to set Windows Explorer to hide them. This is also the default setting.

To change this setting, open Control Panel, search for “Folder Options”, open it. In the “View” tab, find “Hide protected operating system files”.

Nothing “malware” about this, this is perfectly normal behavior.

7
  • 2
    can you be more specific please, what's their exact role and purpose? i analyzed their content but didn't fully understand what they actually do.
    – user373230
    Oct 12, 2014 at 11:25
  • 5
    By default, they contain information on where to get the icon and localized folder name. On regular folders, where the “Customize” tab is available in their properties, these settings are stored in desktop.ini too. Here’s some more (albeit old) info.
    – Daniel B
    Oct 12, 2014 at 11:31
  • 6
    They aren't critical at all – the message when deleting is the same for all hidden system files. I usually delete them because they make my desktop look untidy. :)
    – ntoskrnl
    Oct 12, 2014 at 18:10
  • 2
    @johnsmith That should be a question of its own, not a comment on another question.
    – Mr Lister
    Oct 12, 2014 at 20:31
  • 4
    @ntoskrnl It’s likely they’ll appear again. You might also lose the folder icons and names (on non-English systems) if you delete them. Setting Explorer to hide protected system files is a better solution. You don’t need them every day, after all.
    – Daniel B
    Oct 12, 2014 at 20:55
0

You can have two files of the same name, but if you move them around it might mess up their icons as they both will start moving

0

Destop.ini twice: Possible

Why you see two desktop.ini in this case is particular and already explained, the two files are in different folders which are merged by Windows Explorer. I you look at the properties of these files (right click | Properties), you'll see their actual locations.

Any files or folder appearing twice: Yes too, demonstration

This remark and this question have no answer:

I don't think that it is possible to keep same named files into a single directory. Is this any malware or anything harmful for my PC?

This is also the topic of Why do I see two desktop.ini files on my Windows Desktop? which was closed as a duplicate of the question here. So I think it could be interesting to add some information.

Don't blindly trust what you see in Explorer, because all it displays has been processed before being shown to you, and you need to be aware of this possibility. In addition of merging the content of folders for display, Explorer doesn't necessarily show actual names. For example let's say I have a folder my_folder with this content viewed with the command prompt:

enter image description here

I'll create a desktop.ini file in my_folder. The quickest way is to customize the folder e.g. "to show documents" (right click | Properties | Customize). In addition of creating a desktop.ini file, it also sets the attribute R on the folder, which is mandatory for any desktop.ini to be taken into account. Now just open desktop.ini in Notepad, the current content is:

[ViewState]
Mode=
Vid=
FolderType=Documents

showing the folder has been customized to Documents template. I'm changing the content to this:

[.ShellClassInfo]
LocalizedResourceName=any_name

[LocalizedFileNames]
a.txt=anyname
b.txt=anyname

After saving the configuration file, this is what is shown in Explorer:

enter image description here

Both the folder name and the files names have been altered. The actual names are not changed. The command prompt still shows:

enter image description here

If I copy the files into the subfolder, they return to their actual names, because currently there is no configuration file to continue the renaming.

What that tells is information in Explorer is heavily processed in order to trick the user, for reasons

  • Which can be justified, e.g. translating special filenames like Desktop to local names. E.g. I'm a French user, and Desktop will be translated to Bureau. This can be useful, but also creates a lot of problems, as the translated name is not valid everywhere, e.g. in the command prompt or when reading the filesystem with another OS, but also sometimes in Explorer itself.

  • Or which can be questionable, e.g. redirecting the user to another folder without telling them, or even opening an URL instead of a file. This default behavior can create vulnerabilities, and has been exploited since years by hackers.

Such possibilities of "customization" are used to push ads to the user or to redirect them to vendors. The result, whether it is called "active link" or "desktop gadget" (clocks or weather apps) is known as creating vulnerabilities, and it can help malware to resist to removal tools.

Many users like me prefer to see the hidden files like desktop.ini in Explorer, as their appearance with no reason can be an indication of something gone wrong.

More: Desktop.ini as a post-exploitation tool

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .