Multiple System Files in Win XP Home

[TwistEdFish]

Greetings All,
Today while doing a clean up on my system I started roaming around looking for things that didn't appear to be normal. Upon stepping into my windows/system32 folder I came across something that not only looked abnormal but to me was just plain freaky. MANY of the system files have multiple consecutively numbered copies.

I have taken a screen shot and will post it with this post. I am also pasting a basic copy of my dxdiag results to show my system stats to better assist with any needed information.

------------------
System Information
------------------
Time of this report: 1/8/2009, 11:34:52
Machine name: TWISTEDFISH
Operating System: Windows XP Home Edition (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.080814-1236)
Language: English (Regional Setting: English)
System Manufacturer: Dell Inc.
System Model: Dimension XPS
BIOS: Phoenix ROM BIOS PLUS Version 1.10 A05
Processor: Intel(R) Pentium(R) 4 CPU 3.20GHz (2 CPUs)
Memory: 3070MB RAM
Page File: 472MB used, 3977MB available
Windows Dir: C:\WINDOWS
DirectX Version: DirectX 9.0c (4.09.0000.0904)
DX Setup Parameters: Not found
DxDiag Version: 5.03.2600.5512 32bit Unicode

What I am wondering if anyone can assist with some much needed information is,
How this would happen?
Is it normal?
How I can repair it?

Thank You All very much in advance for any and all information towards solving this issue.

 

[TwistEdFish]

I forgot to ask,
Is it possible that it is safe to delete all the numbered versions of the files without harming the system?

If they are numbered does that mean they are exact copies of the original?

 

[Bobbye]

How this would happen?
Is it normal?
How I can repair it?

FYI: What is a system32 folder?
The System32 folder and its subfolders contain the core operating system files for your Windows XP installation.

Please do this:
Control Panel> Folder Options> View tab> UNCHECK 'show hidden files & folders'> Apply> OK.

It seems you're thinking what you see in the System32 folder is 'bad' and you should remove those files. DON'T.

If you are concerned, run the malware cleaning here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Then attach the three logs. They will point to any files that should NOT be in System 32 folder.

People get into trouble removing files when they have no idea what they are for and if they should be on the system!

 

[TwistEdFish]

Actually Bobbye I turned on the option to show hidden files and folders I prefer it that way as it does make it easier to find things I am looking for, I am in no way a complete computer noob.

I must first ask in reference to your response, Did you look at the screen shot I attached to the post it explains what I'm asking far better than any words ever could? I'm not questioning if the files should be there at all simply WHY are there 6 exact copies of each file?

As far as malware goes I use Uniblue Power suite 2009 + Spyeraser + DriveRescue 2009. All just upgraded from the original versions, this suite of system utilities keeps malware and other unwanted files off the system.

If anyone could please take a look at the Screen shot I have attached to my original post and reply to questions in that post regarding that screen shot and the situation I asked about I'd appreciate it.

 

[Bobbye]

Did you look at the screen shot I attached to the post it explains what I'm asking far better than any words ever could?

Yes, I did. I wouldn't have replied had I not.

I turned on the option to show hidden files and folders I prefer it that way as it does make it easier to find things I am looking for

You may think it's easier but it is also a good way to see and delete files you should not. Exposing the hidden files and folders can and often does cause unexplained crashes of Windows Explorer. My thought is that the more experienced a user is, the more the user would understand the dangers of having all the hidden files and folders exposed all the time.

[WHY are there 6 exact copies of each file?/QUOTE]
I can't answer that and neither can anyone else who views your image. It would first require viewing the file properties, including the create and modify dates and secondly, establishing if they actually are dups. And if they are, back to your question- WHY?

That is not something that can be answered from here. WE cannot determine if they are exact dups and we cannot determine if they are, why they have been created.

You might also take in this:

You might think parlaying this technology into a full antispyware product would be relatively simple, but apparently you'd be wrong. Uniblue's utterly dismal SpyEraser 1.1 is the proof.
http://www.pcmag.com/article2/0,2817,2091004,00.asp

As for security protection, Uniblue’s PowerSuite 2009 combines RegistryBooster, SpeedUpMyPC and DriverScanner. It doe NOT have an antivirus program nor a firewall.

So you have no antivirus program running, only one spyware program which is not highly rated and no firewall. This is taking into account what you said you had to

malware and other unwanted files off the system.

I'd be happy to have others view your image, but I doubt they will be able to give you the answers you're looking for.

 

[TwistEdFish]

As far as the modify dates and file size for the files in question they are visible in the screen shot. I fully understand the difficulty in such a situation which is why I am hoping for more to view the image in hopes someone who has seen the same situation before will see it and comment on any information they may have gathered on the subject.

I forgot to mention in the last post about security, I also use Windows Live OneCare. I recently installed it to replace the resource hog I used for many years in ZoneAlarm Internet security suite. I also use the latest HJT to scan if something isn't acting right.

I have absolutely no problems with my PC being slow or crashing which I'd like to think comes from my preventative measures through the years Which brings me full circle back to the original problem of this post.
The files in question even though showing as being modified as far back as 8/12/2004 have never before shown themselves during my cleaning and exploring yet the Show hidden files and folders option has been turned on since the first day I brought this system home

I do recall the article in PCMag about spyware 1.1 and did not use it at that time I use the latest version which I do believe to be 2.0.1 or something close to that, slightly improved over the old hack and slash version they first released and far from perfect but they are working on it. My surfing practices keeps my system pretty clean of spyware as it is and only keep Spyeraser around as it came free with my purchase of the powersuite. My choice if i were to use a spyware removal at all times would be Spyware doctor.

 

[kimsland]

[WHY are there 6 exact copies of each file?

I can't answer that and neither can anyone else who views your image. It would first require viewing the file properties, including the create and modify dates and secondly, establishing if they actually are dups. And if they are, back to your question- WHY?

That is not something that can be answered from here. WE cannot determine if they are exact dups and we cannot determine if they are, why they have been created.

Just had a look at the pic

I fully understand the concern about affecting system files here
But this what I'd personally do

Create a new folder, call it something like DupFile
Move all the numbered (copy of) system files to it
Restart

Again I hear the warnings
But pretty sure they're not malware, they are just copies

 

[TwistEdFish]

Kimsland, Let me start by saying Thank You so VERY MUCH for the suggestion to resolve this!

I have done exactly as you suggested and created a folder in the form of c:\temp\dupe_file_storage and moved all the numbered versions of the files to that folder FYI over 295mb of them when complete. I rebooted 5 times after doing so and not only did the system boot flawlessly it booted about 50% faster than usual.

A quick explination of what I did!
Using Windows Explorer as opposed to My Computer I opened to the c:\windows\system32 folder and used the RIGHT CLICK > SEARCH feature to find all files with (2) in the file name, 292 of them were found. In the search results window I used the menu selection of EDIT>SELECT ALL then using right click and hold, I drug those files to the newly created folder for storage and selected MOVE HERE from the pop up menu.

I repeated the above process in the search window using the option to Change file name or keywords and changed it to (3), Then repeated again for each consecutive number up to (10) each time dragging the files to the newly created storage folder as mentioned above.

After completing this I checked on the situation that had started me looking around to begin with which was multiple versions of the Add or Remove Programs and Bluetooth Devices icons in the Control panel. That issue was resolved by this also which of course wasn't a serious problem to the system just annoying to see.

Again Thank You for the Suggestion and I hope anyone that may find this issue can use this thread to assist in resolving it in the future.

 

[kimsland]

WHY are there 6 exact copies of each file?

Because you had System and hidden files showing normally
Someone (you?) has Selected all, then either accidentally (or intensionally) moved the mouse slightly, which has then created (1) copies (this then must have been repeated (with the same files still highlighted)

Please delete that backup folder
Run CCleaner

And you're done

 

[TwistEdFish]

Greetings Kimsland,
I know that could and does happen in certain situations, But the fact that it was not every file in the folder that was duped or even a group of them that were not separated by other non duped files makes me think that is not the cause of this. I'm beginning to think this had something to do with the original install of SP3 since it failed to complete its install multiple times before finally completing successfully.

Although I had never gone in to check on the folder or even opened my control panel in a very long time since the install of SP3 to notice the multiple instances of the different icons until Yesterday when I discovered it so it could have very well been this way for quite some time.

Regardless of all that the issue has been resolved and thank you again for the suggestion.

I have also switched all of my 3rd party system utilities to those recommended here at TechSpot in an attempt to keep things such as this from happening in the future.

 

[Bobbye]

Thank you for the assistance kimsland.

 

[gbhall]

TwistEdFish, I think you may have identified yet another big problem with SP3. I would ask others who have suffered from failed SP3 installs to check for the same problem, and I will remember to advise anyone else to check for it if they say they have poor performance or masses of lost space after an SP3 install.

All in all, this SP3 has been just about the worst experience of service packs from MS there has ever been, fortunately only for a limited number of people. 95% or so have had no problem apparently.

I might also suggest you should look in the registry to see if all those extra (2),(3),... files are recorded there too, which might cause no obvious problem, but will certainly bloat your registry.

 

[kimsland]

SP3 has been working perfectly on thousands of users computers including mine
Ironically one of the ideas for SP3 was to speed up a users computer, which I believe it does.

Normally I inform all users to always do all Windows updates (including Service Packs) for their security and better system maintenance

Thankfully SP3 has been selling with all new Windows Xp CDs for a long time now.
XP Pro: http://www.newegg.com/Product/Product.aspx?Item=N82E16832116515

XP Home: http://www.newegg.com/Product/Product.aspx?Item=N82E16832116511