Strange Chinese Folders in Windows Explorer Jumplist
I've noticed recently that oftentimes there are strange Chinese (unicode) characters on my Windows Explorer jump list. When attempting to browse to these folders they come up as non existent (therefore I cannot get any security information on who owns them). I have no idea how they got there, and I fear maybe there is some sort of rootkit on my machine. Unfortunately, I am using Windows 7 64bit and thusly rootkit revealer does not even run. I've always been someone who is overly paranoid about security on my machines. I don't run anything that isn't trusted/signed, I manually double check updates on Tuesdays to make sure nothing was missed, running MSE, and scan religiously with both it and MalwareBytes. I havn't had the slightest sign that I may have gotten pinged with something nasty so it makes me wonder if it isn't just a strange handling of unicode. I do have symbolic links on my desktop to files on another drive and I did notice some discernable English text at the end of the filenames that looked like the last half of some of those symbolic linked folders. I'm hoping it's just a unicode issue and not some Chinese mega rootkit botnet thing, any ideas?
March 28th, 2011 8:02am

Anyone, please?
Free Windows Admin Tool Kit Click here and download it now
March 30th, 2011 3:11am

Did you install Autocad version English Japanese?
May 30th, 2011 11:16am

The answer can be found on: http://www.reddit.com/r/AskReddit/comments/fvfuj/reddit_i_found_a_weird_link_to_an_unknown_folder/c1sy33b I've posted a summary of the answer below: I had this file on my computer as well. If it's what i suspect you have VLC and use it to play DVD discs on your computer. For me, the file itself resided in: C:\users<username>\appdata\roaming\microsoft\windows\recent items I couldn't open the files directly in windows since they were trying to point to c:\users<username>\desktop\ and which do not exist. However, booting up in linux and opening the .lnk file in a hex editor showed references to dvd://E:\ and dvd://F:\ respectively. I recognized this as how VLC references DVD's in a disc drive. Somehow or another, appears/modified time is updated when playing from drive E: and appears/modified time is updated when playing from F:. I tested this with multiple DVD's from different vendors etc. Seems to happen with them all. If I uncheck "Save recently played items" in VLC preferences (and restart VLC), the files are no longer created when playing dvd's from either drive. The latest nightly build of 1.2.0 seems to have fixed the problem for me. Download here: http://nightlies.videolan.org/build/win32/backup/trunk-20110321-1826/vlc-1.2.0-git-20110321-1826-win32.exe Then goto '%AppData%\Microsoft\Windows\Recent' and Delete the chinese character .lnk Shortcuts Right click windows explorer on your start bar and remove those chinese character files from the Frequent list by right clicking them if they're still there. They shouldn't appear for you again. You are absolutely correct. I was able to repeat the creation of this link by deleting all recently saved items and playing a dvd. Checked the "AppData...\Recent Items" and sure enough the link came back. This was with VLC 1.1.9 My solution was to simply limit the number of recently saved items to 0 as I didn't use that feature anyway. This was found by right click Taskbar>Properties>StartMenu>Customize. The option is at the bottom called "Jump List"
Free Windows Admin Tool Kit Click here and download it now
July 7th, 2011 7:34am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics