0

This folder, filled with 25 .3mf files, showed up suddenly and without my consent:

(Screenshot of folder contents)

According to file/folder properties, the folder and its files were created on 16 September 2015:

(Screenshot of folder properties)

The file extension .3mf is associated with a Windows Store app called Microsoft 3D Builder, which I have never heard of before today.

WinStore.Mobile.exe (the Windows Store app) does not reveal when Microsoft 3D Builder was installed, but the file properties on C:\Program Files\WindowsApps\Microsoft.3DBuilder_10.9.6.0_x64__8wekyb3d8bbwe\Builder3D.exe show that it was installed on 16 September 2015 at 06:04:01.

On that day, my computer was powered on, but I had been away for eight hours at the time the program was installed and would not be back for another three hours.

When I checked Windows Store for Microsoft 3D Builder, I saw this notice:

This app has permission to do the following:

  • Use your webcam
  • Use your microphone
  • Access your Internet connection

So this suspicious app, Microsoft 3D Builder, was installed without my permission and presumably executed five hours later to create the "3D Objects" folder. It even has permission to use my peripherals. For all I know, it could have phoned home with information collected from my webcam and microphone!

I am not okay with this. Why was this unwanted software installed?


Other Details

  • According to my Windows Update history, the only update installed on 16 September 2015 was Definition Update for Windows Defender - KB2267602 (Definition 1.205.2644.0).
  • Event Viewer (Event Viewer (Local) » Windows Logs » System) revealed that WindowsUpdateClient started downloading an update on 16 September 2015 at 06:03:55, just six seconds before the Windows 3D Builder executable was created. (Event XML shown further below)
  • Event Viewer also revealed Installation Started: Windows has started installing the following update: 3D Builder on 16 September 2015 at 06:04:10.
  • Five seconds later: Installation Successful: Windows successfully installed the following update: 3D Builder
  • 3D Builder does not show up under "Your Apps" in my Windows Store profile, but it shows as installed when I explicitly search for it.

Upon seeing this, I unchecked "Give me updates for other Microsoft products when I update Windows." in Settings » Update & security » Windows Update » Advanced options.

Still, the folder C:\Program Files\WindowsApps\Microsoft.3DBuilder_10.9.6.0_x64__8wekyb3d8bbwe and all its contents inside look like it was created the same minute that Windows Update began "updating" 3D Builder.

Event Viewer XML

This Event Viewer entry shows that Windows Update was responsible for initiating the installation of 3D Builder, but it doesn't explain why.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
  <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" /> 
  <EventID>44</EventID> 
  <Version>1</Version> 
  <Level>4</Level> 
  <Task>1</Task> 
  <Opcode>12</Opcode> 
  <Keywords>0x8000000000002004</Keywords> 
  <TimeCreated SystemTime="2015-09-16T11:03:55.562993300Z" /> 
  <EventRecordID>3451</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="368" ThreadID="2024" /> 
  <Channel>System</Channel> 
  <Computer>Deltique-Win10</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
 <EventData>
  <Data Name="updateTitle">3D Builder</Data> 
  <Data Name="updateGuid">{1463A1FD-95AA-499F-8F4A-96B5D742D909}</Data> 
  <Data Name="updateRevisionNumber">1</Data> 
 </EventData>
</Event>
  • This is not really a question, but a statement on MS policy. Yes, MS does foist applications on users, and has been particularly obnoxious about this since Windows 8. Furthermore, some of these apps are difficult or impossible to completely remove. – DrMoishe Pippik Oct 9 '15 at 15:04
  • W10 Windows update does not require your consent any more, like it or not. – Moab Oct 9 '15 at 15:53
  • As a follow-up, the "Give me updates for other Microsoft products when I update Windows." is ineffective. On 10 March 2016 at 22:42:22, Windows Update installed an app called "Sway" under identical circumstances as Microsoft 3D Builder. This app also cannot be uninstalled using WinStore.Mobile.exe. – Deltik Mar 20 '16 at 16:40
0

Microsoft 3D Builder is a Windows 10 built-in app.

I had it all along, but the update silently triggered the creation of the 3D Objects sample folder.

Since there was no documentation on or notification about the update, I did a time range search around 16 September 2015 and found this news article by Softpedia published the same day:
Microsoft Releases Updates for Several Windows 10 Apps

Sure enough, 3D Builder was one of the updates shown in the Softpedia screenshot:

App updates in the Windows Store, via Softpedia

The Softpedia article noted that there are "no change logs", but in the version notes of 3D Builder, the publisher Microsoft Corporation wrote, "This release contains bug fixes and UI tweaks."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.