Does anybody know, for what purporses WinXP creates undeleteable (in normal boot mode [not in safe mode]) directroy:
"C:\Program Files\xerox\nwwia".
I noticed this not only on my PC and with different WinXP versions (beta RC-2, final 2.600).

Hey Max, sorry i have no clue what it's for-
I just found your msg since i went on google and looked up "nwwia" since i too was trying to delete it- strange...
if you find out please let me know
THanks

Yup. That file is impossible to delete. Has anybody got problems deleting other files? When you try do delete the nwwia directory, it says something like 'this file is in use by another person or program'. I have that with many files on my drive. It seems to go for files that are read a lot like my MP3s. This is starting to become a large problem, as some of my temporary WAVs (600+MB) are also impossible to delete. I need help!

Like the mystery of Stonehenge. This file is a mystery surely someone has the answer.. BILL CAN YOU HEAR US

I believe this a virus and not winxp behavior. If you boot up in safe mode you can delete it, only to have it reappear as soon as you restart.

I get the same behavior from c:\Program Files\microsoft frontpage\version3.0\bin

I noticed this behavior on a winnt4.0 workstation after having installed a questionable copy of allaire homsite 4.5.

Any info is greatly appreciated!

I am not sure if it is a virus:

after scanning the harddisk I found this entry in C:\Windows\inf\xscan_xp.inf

HKLM,%Run%,"XeroxScannerDaemon",,%16422%\Xerox\NWWia\XrxFTPLt.exe
HKLM,%RunOnce%,"XeroxScannerDaemonLauncher",,%16422%\Xerox\NWWia\xrxflnch.exe

something to do with a Xerox Network Scanner ?!?

the words FTP look suspect

Let me correct some of what I said: I meant trojan and not virus. Also, the problems I had noticed started appearing around the same time that McAfee was telling me that there was a virus in:

C:\Program Files\Allaire\HomeSite 4.5\homesite45.exe\HOMESITE45.EXE

However, it couldn't detect what it was and couldn't clean it. McAfee also only detected it on boot, not after Windows was completely up and running.

trojan...not virus?...are you all there?
this definitely is not a virus...and if it was, Symantec would be on it in a day or so...this file is installed on all XP installs....I think it needs more research to figure out what it is, but either way...it's not a virus or, hahaha, a trojan...

why is that funny? trojans are not viruses.

I just found the same thing quite by accident and looked it up on Google. It is interesting that these are only a directory and a sub-directory, neither containing any files!

I am wondering if it could be a file repository, preparatory to any Xerox installations????

NAH! - why would they need that?

At any rate, it doesn't seem to be causing any problems for me. Has it for anyone else?

i've encountered the same thing but i'm not sure if it was created before or after installing downloaded software. has anyone learned more after installing firewall programs or anti-virus?

I had to reload XP home and found the file there after the reload - looks like a windows file and I'm guessing it has to do with the indexing function. Why the use of xerox, I cant guess, though...

I've just noticed that I have this xerox thing at home on XP Home, but not here at work on XP professional.

Just more food for thought.

If its Xerox does anyone think it could have to do with the Universal Plug and Play?

I did a search on google for "xerox" and "windows xp" and found some news articles regarding some sort of incompatibility between xp and xerox... something like xp installed on xerox company's computers made everything go crazy, so the company put a ban on its employees using xp on their computers.

this was supposedly during the xp beta test.

i wonder if this has anything to do with the file.

I also found a few documents that point to c:\program files\xerox\DocuShare. This is apparently an independent software. I wonder if this is what xp uses to share files among users?

just some clues i found. can't wait to solve this big mystery.

Brian

For the record, I am using XP Professional, and have the xerox\nwwia folder.

To me it looks dodgy because xerox means copy, so it could be as in 'copy all your passwords'??! Also, I have only noticed it now, about a month after installing XP. I don't think it was there at the start.

Ya know, I wrote this up as a bug when we found it in the testing lab back in RC2 testing. Anyhow, the story goes like this: Xerox has a network device that includes a scanner (plus other functions, I'm sure). The scanner has a notifier that lets folks know when their job is done, then fetches the job via FTPLite, a nice, streamlined little proggy that talks to the xerox only.
Problem is that the xerox file repository has to have some haevy rights for both OWNER CREATOR and SYSTEM, so the security permissions on the folders are set to allow the system full control, etc etc. If you right click on the folder, select properties, then security, then advanced, you can uncheck inherited permissions and take ownership of the folder, then reboot and nuke it...well, normally you'd be able to do this, but on some builds we found that the folder would be replced from the \i386\driver cache, meaning it's been "protected" by Windows File Protection, so if you delete it, it bounces right back.
It looks like a virus, but I suspect some developer got a bit overzealous about his Xerox interface, and hammered the folder in place with lots of strange security, then forgot it was on his machine that way, did the build, no one in QA caught it, and voila! In early builds of win2k, we found an entire email message that someone had left buried in a folder. The strangest things happen....
Anyhow, nothing to be alarmed about. You can delete the folder if you want, but the two folders are empty. WFP is the process watching them, so you might not be able to delete the things.
If you're worried about trojans, grab ZoneAlarm. It's free for personal use, and will detect any network traffic that is not explicitly allowed. If a Trojan were to try to talk to the outside world (or someone on the outside tried to talk to the Trojan), you'd get a nice little alert.
Cheers,
jason

This from Paul Thurrott, a windows expert... looks like the folder is just a useless and annoying nuisance.

"Both of those folders are actually installed by Windows XP and can't (at
least theoretically) be removed. The frontpage folder is for backwards
compatibility--some versions of Windows 9x included a FrontPage Express
program for Web editing and it seems that some apps rely on that folder
being there for some reason. The xerox folder is used by the imaging
software in XP, as Microsoft licensed some of the tech from Xerox. My
understanding is that it's used as scratch space."

I'm having the same problems you guys are having.....
there must be a way!!!!!!!!!
we should get microsoft to fix this.......
-Brad

i am running windows xp also and have this file.

i was wondering does anybody xp and detecting these programs trying to access the internet???

generic Host Process for win32 Services

Application gateway services

does anybody know what these are??

also windows explorer also trys to access the internet which is very fishy but i have scaned my computer with every trojan and virus detector i can think of and cant find a thing it used to try and do it with windows me.

any info anybody could give would be greatly appresiated :)

I am using Windows XP Professional and I have the xerox\nwwia directory. I found one way to delete this directory is to download Process Explorer from www.sysinternals.com. Find the object and close the handle. After that you are able to delete all these strange directories. You'll found the processes holding these objects are "winlogon" and "explorer". Two important system processes. I wonder what's Microsoft f---ing around? Note: This method does ot guarantee they won't appear again since the problem comes from somewhat kernel of Windows.

Sorry to be the bearer of bad news. This xerox directory is part of the Windows XP environment (what? we don't know yet.) It cannot be deleted because of WFP (Windows File Protection). It is neither a trojan nor a virus. It supports a function of XP. (what? we aren't really sure)
Play with XP, and you'll discover it can do alot more that access the net behind your back. (why do you suppose firewall stops only inbound, not outbound).