The Computer Oracle

Why do I have two desktop.ini files on my windows 8 desktop?

--------------------------------------------------
Rise to the top 3% as a developer or hire one of them at Toptal: https://topt.al/25cXVn
--------------------------------------------------

Music by Eric Matyas
https://www.soundimage.org
Track title: Life in a Drop

--

Chapters
00:00 Why Do I Have Two Desktop.Ini Files On My Windows 8 Desktop?
00:25 Accepted Answer Score 34
01:07 Answer 2 Score 0
01:20 Answer 3 Score 1
04:28 Thank you

--

Full question
https://superuser.com/questions/825143/w...

--

Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...

--

Tags
#windows #desktop #malware

#avk47



ACCEPTED ANSWER

Score 34


One of them is in the “All Users” profile (%PUBLIC%\Desktop). One of them is in your profile (%USERPROFILE%\Desktop). They are both hidden system files. If you want them to disappear, you’ll have to set Windows Explorer to hide them. This is also the default setting.

To change this setting, open Control Panel, search for “Folder Options”, open it. In the “View” tab, find “Hide protected operating system files”.

Nothing “malware” about this, this is perfectly normal behavior.




ANSWER 2

Score 1


Destop.ini twice: Possible

Why you see two desktop.ini in this case is particular and already explained, the two files are in different folders which are merged by Windows Explorer. I you look at the properties of these files (right click | Properties), you'll see their actual locations.

Any files or folder appearing twice: Yes too, demonstration

This remark and this question have no answer:

I don't think that it is possible to keep same named files into a single directory. Is this any malware or anything harmful for my PC?

This is also the topic of Why do I see two desktop.ini files on my Windows Desktop? which was closed as a duplicate of the question here. So I think it could be interesting to add some information.

Don't blindly trust what you see in Explorer, because all it displays has been processed before being shown to you, and you need to be aware of this possibility. In addition of merging the content of folders for display, Explorer doesn't necessarily show actual names. For example let's say I have a folder my_folder with this content viewed with the command prompt:

enter image description here

I'll create a desktop.ini file in my_folder. The quickest way is to customize the folder e.g. "to show documents" (right click | Properties | Customize). In addition of creating a desktop.ini file, it also sets the attribute R on the folder, which is mandatory for any desktop.ini to be taken into account. Now just open desktop.ini in Notepad, the current content is:

[ViewState]
Mode=
Vid=
FolderType=Documents

showing the folder has been customized to Documents template. I'm changing the content to this:

[.ShellClassInfo]
LocalizedResourceName=any_name

[LocalizedFileNames]
a.txt=anyname
b.txt=anyname

After saving the configuration file, this is what is shown in Explorer:

enter image description here

Both the folder name and the files names have been altered. The actual names are not changed. The command prompt still shows:

enter image description here

If I copy the files into the subfolder, they return to their actual names, because currently there is no configuration file to continue the renaming.

What that tells is information in Explorer is heavily processed in order to trick the user, for reasons

  • Which can be justified, e.g. translating special filenames like Desktop to local names. E.g. I'm a French user, and Desktop will be translated to Bureau. This can be useful, but also creates a lot of problems, as the translated name is not valid everywhere, e.g. in the command prompt or when reading the filesystem with another OS, but also sometimes in Explorer itself.

  • Or which can be questionable, e.g. redirecting the user to another folder without telling them, or even opening an URL instead of a file. This default behavior can create vulnerabilities, and has been exploited since years by hackers.

Such possibilities of "customization" are used to push ads to the user or to redirect them to vendors. The result, whether it is called "active link" or "desktop gadget" (clocks or weather apps) is known as creating vulnerabilities, and it can help malware to resist to removal tools.

Many users like me prefer to see the hidden files like desktop.ini in Explorer, as their appearance with no reason can be an indication of something gone wrong.

More: Desktop.ini as a post-exploitation tool




ANSWER 3

Score 0


You can have two files of the same name, but if you move them around it might mess up their icons as they both will start moving