Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

The Mystery MSO Cache File - or, Free Office?


  • Please log in to reply
9 replies to this topic

#1 Al from Rochester

Al from Rochester

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 22 January 2015 - 09:21 AM

Here's a mysterious one:

 

I just ran the Security Tango (look it up if you want), and after that I noticed a folder in c:\ that I had never seen before.  It is called MSO Cache, and it contains, apparently, Microsoft Office.

 

I can't imagine that a series of virus scans would uncover a hidden Microsoft Office in my Windows 7 install but maybe it did.  Or maybe I'm being spoofed somehow.  Or maybe I'm crazy.

 

Can anyone explain what happened?



BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:46 PM

Posted 22 January 2015 - 09:26 AM

Hi Al from Rochester :)

MSOCache is a folder that contains information related to a Microsoft Office installation. See that folder as the "temp" folder that Windows used to extract the content of the Office installation and proceeded to install it. That folder is legitimate and so is its content. Here's an article with more information about it:

http://techdows.com/2009/05/what-is-msocache-how-to-remove-it-from.html

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 Al from Rochester

Al from Rochester
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 22 January 2015 - 02:01 PM

I guess I neglected to mention that I never installed Office.  That's what makes this so mysterious.  If this machine never saw a Microsoft Office disc, how did it get the Office installation files?

 

Or maybe it did.  This machine is a Dell that was re-initialized with the Dell Windows 7 re-initialization disc.  Could it be that Office was on that disc and never mentioned anywhere until this folder appeared?

 

It would be pretty funny, since I did buy Office but haven't installed it yet.



#4 dinodod

dinodod

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 22 January 2015 - 02:09 PM

I can only guess that you have an OEM disk from Dell and they usually bundle Office in it (even as trialware).  Looking at the dell website, you get Office 365 bundled automatically.

 

http://www.dell.com/us/p/inspiron-3646-small-desktop/pd?oc=fdcwnt7101h&model_id=inspiron-3646-small-desktop


Essential Tools for safe computing

https://sites.google.com/site/dinodod/pc-standards

 

Please leave a comment on anything relative and help me expand on it.

 


#5 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:46 PM

Posted 22 January 2015 - 02:24 PM

From my experience, most prebuilt computers and laptops comes with a "trial" version of Office (2010 or 2013) that works for 30 days (or 90 days) before asking for a product key to pursue the use of it. If you used the manufacturer installation DVD to reinstall Windows, then Windows, along with all the OEM software that was put in it was installed on your system, which means that Microsoft Office most likely got installed and the MSOcache folder was created. That would be my guess. Either way, I wouldn't worry about it too much since that folder is legitimate :)

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#6 Al from Rochester

Al from Rochester
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 22 January 2015 - 03:07 PM

Except of course I just might not want every programmer in the world to help himself to my disk space.



#7 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:46 PM

Posted 22 January 2015 - 03:12 PM

Well you are free to delete that folder if you want, and if you don't have Office installed on your system. I think that by default, Windows have some Office components installed (at least, for Internet Explorer), but I'm not 100% sure.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#8 Al from Rochester

Al from Rochester
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 22 January 2015 - 04:30 PM

Great!

 

This has been a very helpful exchange.  Thanks, fellas!



#9 dinodod

dinodod

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:05:46 PM

Posted 22 January 2015 - 04:37 PM

You are welcome


Essential Tools for safe computing

https://sites.google.com/site/dinodod/pc-standards

 

Please leave a comment on anything relative and help me expand on it.

 


#10 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:46 PM

Posted 22 January 2015 - 05:00 PM

No problem, have a good day Al :)


unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users