Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Please help? Strange folder appeared on desktop after upgrading to the new Windows Live Messenger


  • Please log in to reply
9 replies to this topic

#1 Sway

Sway

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:08:45 PM

Posted 15 March 2009 - 07:39 PM

Hi all,

Basically, the problem is: when I upgraded to the new version of Windows Live Messenger (2009) a folder called "WindowsLiveMessenger" appeared on my desktop. Inside it is something called Transport0.log which contains the text:

"23:10:11.031 4F4:27C ADVCED :: Module:Transport DLL-version:3.5.6872.0 Retail Adv:0" (I think the numbers at the beginning change sometimes, maybe the time or something :flowers: )

I can delete this folder if I close WLM, but the next time I run WLM it just appears again.

I asked for help on the Windows Live site and received an e-mail which told me to check for spyware and gave me instructions on how to uninstall and reinstall WLM including doing the following:

The following commands delete files that are used when you sign in and the Contacts Cache folders.

i. Click Start, click Run, type %USERPROFILE%\Application Data\Microsoft\ and then press Enter. Delete the IdentityCRL folder.

ii. Click Start, click Run, type %ALLUSERSPROFILE%\Application Data\Microsoft\ and then press Enter. Delete the IdentityCRL folder.

iii. Click Start, click Run, type %USERPROFILE%\Local Settings\Application Data\Microsoft\ and then press Enter. Delete the Windows Live Contacts folder.


and

Click Start, click Run, type CMD, and then press ENTER to open the command window.

b. Type the following commands exactly as they appear below. Press ENTER after typing each command to execute the command.



Note: In some case you may encounter the error that the key does not exist. If you have typed the command correctly, this may be because the key has already been removed earlier or does not exist on your machine.



REG DELETE "HKLM\Software\Microsoft\Windows Live\Messenger' /f

REG DELETE HKCU\Software\Microsoft\MSNMessenger /f

REG DELETE "HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared" /f

REG DELETE HKCU\Software\Microsoft\IdentityCRL /f



I did all of this but when I reinstalled WLM next time, the folder came back. I know it's not such a massive problem but arghhhh I want it to go away! lol

I'm on XP Pro, Version 2002, SP3 apparently.

Any ideas?

Thanks!! :thumbsup:

BC AdBot (Login to Remove)

 


#2 OldGrumpyBastard

OldGrumpyBastard

  • Members
  • 781 posts
  • OFFLINE
  •  
  • Location:"Way South of 'da Bridge"
  • Local time:03:45 PM

Posted 15 March 2009 - 07:47 PM

Did you take their advice and check for malware? Deleting the registry keys should have fixed this provided there are no traces of malware hiding some place deep and dark inside your system...I would suggest posting a new topic here:

http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

Follow their expert advice in checking that you don't have something like that going on...
Does this look like an OldGrumpyBastard or what?

#3 Sway

Sway
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:08:45 PM

Posted 15 March 2009 - 08:10 PM

Thanks for the reply.

I ran ad-aware, would that not have done the job or is that something else?

#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,318 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:45 PM

Posted 16 March 2009 - 07:20 AM

Ad aware is a bit outdated. You can use Malwarebytes Antimalware, which is a good free on-demand malware scanner.

By the way, WLM 2009 is known for its bugs (dont know for sure, but still beta??). I find it running fine, but have tried two days to make it run on a friends PC, after which I installed WLM 8, it simply wouldnt work.

Edited by elise025, 16 March 2009 - 07:23 AM.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 Sway

Sway
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:08:45 PM

Posted 16 March 2009 - 07:15 PM

Could it be malware if this folder (and file) appears only when I install and run the new WLM? I mean, I can delete it if I close WLM but it just comes back next time I run WLM.

:thumbsup:

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,318 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:45 PM

Posted 17 March 2009 - 02:14 AM

It could be (I am still amazed by the things that prove to be malware ;) ), that is why it would be a good thing to do a scan. I recommend using Malwarebytes Antimalware.
http://download.cnet.com/3001-8022_4-10804...b4ebdf8667d355c

After downloading, install it, update it and run a quick scan and see if it comes up with something.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 Sway

Sway
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:08:45 PM

Posted 18 March 2009 - 08:01 PM

The only things it found on a full scan were:

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.


So no, it's not malware I guess.

Windows Live help have since suggested that I uninstall WLM and reinstall again, after using Windows Installer CleanUp Utility.

This didn't work either.

The Windows Live help guy, apparently called Mike, said:

From the screenshot you provided to us, please know that the transport0.log is one of Windows Live Messenger logs that stored on your computer in My Received files folder under My Documents. The Transport0.log supposedly not stored from your Desktop under Windows Live Messenger folder it should stored in you're my Received files folder.


I USED to have My Received Files set to put things on my desktop, but have since changed it to My Documents after the folder appeared. The silly folder still appears on my Desktop anyway.

Does anyone have any other ways I can get rid of it? :thumbsup:

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,318 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:45 PM

Posted 19 March 2009 - 03:02 AM

Uuh, maybe you should check this out, go in the WLM menu to tools and then to options. Go to the File transfer tab and look what path is specified under "save received files in this folder". This should be C:\Documents and Settings\%username%\My Documents\My Received Files
Just a guess, but sincerely I think its just one of the prgram-bugs

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 Sway

Sway
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:08:45 PM

Posted 19 March 2009 - 02:41 PM

Yeah, it is set to that, like I said.

A few other people seem to have had this problem, judging from a google search, but there's no advice that works on how to get rid of it.

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,318 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:45 PM

Posted 20 March 2009 - 04:48 AM

Sorry, Sway, I red the content of your previous post only half it seems, bit of double advice.
Since you mentioned you had received files on your desktop, if you changed the location after you downloaded the 2009 version, maybe you can download your previous WLM (8.???), install it, make sure received files is in my documents or whereever you like, and after that try an upgrade again. Just a guess...

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users