Unable to find a fragmented file

June 6, 2012 at 18:28:46
Specs: Windows XP, 2gb
Windows defragmenter found a defragmented file that Windows search can't find.
The file is C\Windows\$NtUninstallKB16489$\14859659\U\80000032.@. Including hidden and protected files.
Does anyone know how to locate this file?

Thanks

V Sellmann


See More: Unable to find a fragmented file

Report •


#1
June 6, 2012 at 18:49:59
No one who answers here regularly is going to email you.

It's NOT a good idea to leave your email address in a post anywhere on the web - there are malicious people and malicious programs that are constantly looking for email address to abuse. You should delete it.
You can Edit any of your own posts on this web site, for a limited time, by clicking on the the Edit this message link at the bottom of your own posts.

Anyone can contact you on this web site by sending a PM - Personal Message - to your user name - you will get an email in your IN mailbox that you have a PM on this site, as well as the number of your PMs going up by one, without your email address being revealed to them, or their email address being revealed to you if they choose to send a PM to you, unless it's included in the text of the PM.
.....

Why do you need to find that file ?
It's NOT running - it can't slow down Windows.

Defrag doesn't find de-fragmented files - it checks to see if files are fragmented and if they are it attempts to make them one continuous file.

Running Defrag on the partition Windows itself was installed on cannot improve the performance of Windows any more than about 10% on modern computers, and that's temporary.

If Windows is running more than 10% slower than it once was, you have problems other than files are fragmented.
.......

$NtUninstallKB16489$\ is probably a normally hidden folder in C:\Windows, as in,
C:\Windows\$NtUninstallKB16489$\ etc.

Windows Search doesn't look for system or hidden files by default - you have to select that when you search.

To see the hidden files and folders in Windows in My Computer or Windows Explorer, you have to change default settings in Folder Options.

Control Panel - Classic view - Folder Options - View tab

Hidden Files and Folders -
Click on the circle before Show Hidden files and folder to place a dot in it.

You may also need to click on the box before Hide protected operating system files to remove the check mark

Optionally you can click on the box before Hide extensions for known file types to remove the check mark

Click on OK at the bottom of the Folder Options window
.......


By the way, if you have installed Microsoft's add on Windows Search or Windows Desktop Search, both of those have BUGS that will cause EVERYTHING in Windows XP to run slower on many people's systems.

If Windows Search or Windows Desktop Search is listed in Add or Remove Programs, I recommend that you UN-INSTALL IT !


Report •

#2
June 6, 2012 at 20:18:36
The search included hidden and protected files.
I know it's not a big deal and does nothing to the performance, just very curious why I can't locate this file, knowing that it's there somewhere.

Report •

#3
June 6, 2012 at 21:14:51
I see you, or one of the forum moderators, removed your email address. Good.

Did you ALSO enable showing those things I mentioned in Folder Options ?
I always have those enabled - I'm not sure whether Search can find them if those aren't.

Did you copy down that line by hand ?

If yes, you may not have copied it correctly

Have you looked in C:\Windows ?

The $NtUninstall,,,,,,$ folders are listed first by default there


Do you have a slowness problem in Windows ?


Report •

Related Solutions

#4
June 7, 2012 at 05:50:28
Yes, I double checked the file spelling and hidden and protected files are enabled, but this one does not show up. It's also odd that the KB number is only 5 didgets.


Report •

#5
June 7, 2012 at 07:20:46
Where did you get the line from ?
Defrag doesn't normally display messages about files, however it might if a file was found to be corrupted and/or if it can't de-frag it.

When I search the web using: KB16489
I get two pages of "hits" that seem to be mostly about the same thing.

E.g.

SRX Getting Started - Quick Setup Guide for Configuring IDP on a SRX or J-Series device
http://kb.juniper.net/InfoCenter/in...

Excerpt:

[KB16489] Show KB Properties


March 2012 Microsoft Patch Tuesday Summary
http://forums.juniper.net/t5/Securi...

Excerpts:

by aicasiano on 03-29-2012 01:33 PM

Hi Skip,

The default Recommended Policy Template is designed to be a starting point for architecting an IDP policy:

http://kb.juniper.net/InfoCenter/in...


Report •

#6
June 7, 2012 at 08:38:26
Yes, found the same thing when I googled it. Never went near that stuff.
Windows defragger does list and shows this file as being unable to defragment it.
I'm not exactly a computor novice, but this has me baffled.

Report •

#7
June 7, 2012 at 11:43:27
Update.
When searching regedit, I found the $NtUninstallKB16489 entry under H Current User/Microsoft/Internet Explorer/ExplorerBars/containing text MRU....and on the right side, 000.... and the $NtUninstallKB16489.....

Maybe this will shed some light for someone ?


Report •

#8
June 7, 2012 at 13:33:01
Please answer this !

"Where did you get the line from ?
Defrag doesn't normally display messages about files, however it might if a file was found to be corrupted and/or if it can't de-frag it."
........

"...I found the $NtUninstallKB16489 entry under H Current User/Microsoft/Internet Explorer/ExplorerBars/containing text MRU...."

Should be HKEY_CURRENT_USER....

There is nothing there in my XP installation except the (Default) line

Some of the things you find in the registry are things you have searched for.

If it's not there now in C:\Windows you can ignore that entry in the Registry


Report •

#9
June 7, 2012 at 15:04:58
When I googled " containing text MRU, the article suggested deleting the values on the right side of the registry key, which I did, rebooted, but windows defragmenter still shows and list the file as unable to defrag. Thought I had beat.
Back to square one.

Report •

#10
June 7, 2012 at 15:46:08
Just for info it looks like an uninstall file for a Windows Update, although it isn't quite right as it does not show any files (unless "80000032.@." is the file). The latter is possibly the result of your email address removal. Could re-state this path please?

MRU means "Most Recently Used". It is of little consequence because it is almost certainly a result of your search. OK this time but I would avoid deleting things in the registry otherwise an unimportant issue could become something far more serious.

Try running chkdsk /f from the Run box (it will do this on reboot) as it could you might have a minor HD discrepancy that is affecting defrag.

Always pop back and let us know the outcome - thanks


Report •

#11
June 7, 2012 at 16:20:04
Derek, ran scan disk already. The complete path is C\windows\$NtUninstallKB16489$\14859659\U\80000032.@ and 00000002.@
It's not that these files won't defrag that bothers me, it's that I can't find them :-)

Report •

#12
June 7, 2012 at 16:46:47
The file extensions ".@" are most weird so maybe that has some bearing on why they are not showing in Search. Have you tried searching *.@ ?

If you drill down the path in "Computer" can you find these two files? If not, how far can you get down the given path?

Not sure where we can go with this but maybe your answers will give some clue. It looks like corruption because as well as the strange extensions, you have a dollar sign in the KB number. EDIT - Oops, dollar sign is normal (see later). File or Folder corruption could easily cause search not to find anything there.

Just for info, the only valid KB's that show in Google (including KB16489 itself and a possible lost end number) are these:
KB16489
KB164891
KB164892
KB164893

Always pop back and let us know the outcome - thanks


Report •

#13
June 7, 2012 at 17:14:41
Thanks again Derek.
It's probably a corrupted file with parts missing. I will try your recommened search and report back. In time I will find those files :-)

Report •

#14
June 7, 2012 at 17:17:15
OK, hope you picked up my latest edits (including KB numbers) as we might have overlapped.

There are other major differences in the path beyond $NtUninstallKB16489 on my XP Home. Mine contain a single, quite different, sub folder (spuninst) with varying files. You will probably see the same with other similar ones in the same place.

Always pop back and let us know the outcome - thanks


Report •

#15
June 7, 2012 at 18:43:34
You:

"it's not that these files won't defrag that bothers me, it's that I can't find them :-)"

Myself:

"If it's not there now in C:\Windows you can ignore that entry in the Registry".... and the defrag messages

Derek:

"It looks like corruption because as well as the strange extensions, you have a dollar sign in the KB number."

The @ charcter is odd - ther'es no @ anywhere in my Windows folder except for a folder name avg@toolbar in C:\Windows\temp, but it's normal to have the dollar characters at either end of the NTUninstall..... folders, as in

C:\Windows\$NtUninstallKB16489$\......


Report •

#16
June 7, 2012 at 18:51:38
Re#15

Yes, of course there is a dollar character at the end. Looks like I somehow went off at a tangent with that - thanks for pointing it out. Have added an edit to #12.

Always pop back and let us know the outcome - thanks


Report •

#17
June 8, 2012 at 06:31:50
Gent's, I have spent a few hours this morning searching through ( my wife's ) computer, and was unable to find any trace of those fragmented files.
Enough time spent on this. I appreciate everyones effort here to help me find those files. Let's consider this case closed.
I will make a post if at some time I manage to locate those files.
Thanks again to all.

Report •

#18
June 8, 2012 at 07:17:15
It would have been interesting to know how far you got when following down the path you posted (folder by folder). I can only assume that either you hit a wall somewhere or reached the end of the path to find no *.@ files present. That process should have told you something.

Whatever, thx for popping back to let us know.

Always pop back and let us know the outcome - thanks


Report •

#19
June 8, 2012 at 08:00:43
Sorry, searching *.@ produced two ligitimate files only.

Report •

#20
June 8, 2012 at 08:32:23
I didn't mean the search, I meant following the path you gave (with Folder Options showing all files):

From My Computer you go the the "Windows" folder, then to the "$NtUninstallKB16489$ folder", then "14859659" folder, and finally the "U" folder. I wondered if you managed to get all the way (without access being blocked) and if so what you found there.

That path looks very odd compared to similar ones in my XP.

Always pop back and let us know the outcome - thanks


Report •

#21
June 8, 2012 at 08:46:59
Sorry, misunderstood. There is nothing in the windows folder reffering to this file.
Instant dead end.

Report •

#22
June 8, 2012 at 10:17:55
OK Gotcha.

Then giving up seems quite a good idea LOL.

If you feel like dabling again sometime you could boot from a Linux Live CD (I use Puppy Linux) and look inside Windows using that. Access and visibility, unlike Windows, is pretty well unrestricted.

Always pop back and let us know the outcome - thanks


Report •

#23
June 9, 2012 at 06:24:21
Update, still not able to find these two files, however happy to report that Iobit smart defrag was able to defrag those two files and they no longer show up in Windows defrager.
Tried a few of third party defraggers, but only Iobit was able to defrag them.

Report •

#24
June 9, 2012 at 11:39:05
Thanks for the update, but.....

....if they were not there in C:\Windows, all that did is remove something that made them appear to be there.


Report •

#25
June 9, 2012 at 12:51:53
Don't think so, since Iobit smart defrag also showed and listed them in C:\ Windows, but listed them as having been defragmented. The only difference is that the Windows defrager was not able to defragment those two files.

Report •

#26
June 9, 2012 at 13:03:13
Then presumably it is Windows OS that is preventing you from seeing them as folders and files in the normal way.

Always pop back and let us know the outcome - thanks


Report •

#27
June 9, 2012 at 14:23:03
"The only difference is that the Windows defrager was not able to defragment those two files."

You've said several times they weren't there in C:\Windows !

Did you actually use My Computer or Windows Explorer to look there, BEFORE you used Iobit ??


Report •

#28
June 9, 2012 at 17:35:49
Yes, of course I did.

Derek, I agree with what you said. For some reason Windows OS won't let me see or acces them.
Regardless, case closed for now.
Thanks again all.


Report •

#29
June 9, 2012 at 17:50:15
Seems it's a mild Windows screw-up which doesn't appear to affect anything else.
As you imply, it's probably best to live with it rather than risk causing a problem.


Report •

#30
June 9, 2012 at 18:51:13
"For some reason Windows OS won't let me see or acces them."

In my experience, that's NOT possible, when you have set Folder Options to show the things I mentioned.


Report •

#31
June 9, 2012 at 19:23:19
Well Tubesandwires, with my current experience it IS obviously possible, with Folder Options set to show the things you mentioned.

Report •

#32
June 10, 2012 at 09:34:41
It would be very interesting to know if Puppy Linux Live CD showed it but I accept that you probably won't want to bother. Just the same, those CD's can be a very useful tool, especially as they don't touch Windows and just run between the CD and RAM.

Always pop back and let us know the outcome - thanks


Report •

#33
June 10, 2012 at 10:03:10
Derek, where can I get or download that CD, and then how is it used ?

Report •

#34
June 10, 2012 at 14:55:01
As you are probably not too interested in running Linux itself I recommend Puppy 4.3.1 - which is an old version that doesn't normally save anything on the HD. This is the direct link to the file - just swipe it and copy it into your browser:
ftp://ftp.nluug.nl/pub/os/Linux/distr/puppylinux/puppy-4.3.1/pup-431.iso

Download the file and "Save" it somewhere on the HD rather than running it.
It is an "image" file (.iso) so you don't just put that onto the CD. Look at your burning software and somewhere or other there is almost always a feature to burn a CD from an image. Nero, for example, can do this, as do many freebies.

Once you have created the CD you boot the system with it by inserting the CD the drive then restarting the computer. Unless you have already set your CD drive ahead of the HD then it won't see it. This is the only slightly tricky part, you have to go into BIOS and set (either temporarily or semi-permanently) the CD drive as the first boot drive. I leave mine set that way and it doesn't noticeably slow the boot up.

There's a little bit of setting up first time (rather obvious things like language, monitor resolution etc). It should then come up with a Linux desktop. Your drives will appear at bottom left. This runs purely from the CD and RAM. It doesn't alter Windows, so that will be back to normal when you boot without the CD.

It will allow you to peer inside your drives (all single click) but not affect them unless you deliberately make changes to them or for some reason ask it to delete something. A very good use for this disk, is dragging and dropping your important files onto a flash drive if Windows won't boot - especially before appling a risky fix.
You can even get online with it if you set it up.

I'm pretty sure that version 4.3.1.has never had an "install" option - you clearly "don't want that" if offered. It does allow you to make saves (changes) back to the CD when you shut down - if the CD is not finalized. This will save you setting it up again each time you use it.

Don't let all these words (too many) put you off - it is quite a simple process really.


Report •

#35
June 10, 2012 at 15:31:57
Thanks Derek.
I may give it a try if I get really bored lol.

Out for now.


Report •

#36
June 11, 2012 at 17:20:08
Just in case you pop back, by pure fluke I happened to spot this February post on here. It rang bells immediately, so you are not totally alone it seems:
http://www.computing.net/answers/se...

Not very conclusive, or "exactly" the same symptoms, but the best guess seemed to be the 'Zero access rootkit'. It might therefore be wise to "at least" run your AV scans and the freebie MalwareBytes. The latter often finds what AV's miss.


Always pop back and let us know the outcome - thanks


Report •

#37
June 11, 2012 at 18:30:34
How interesting Derek.. much appreciated.
Have discovered that my wife's laptop must have been infected with something as it is somewhat screwed up. I finally found this file as well, and you won't believe how.
When I placed a check mark into the " Hide protected operating systems files"
voila and there it was. Have no idea how windows got this thing reversed.
When I uncheck this function the folder disappears ... go figure huh.
Just like the other person, so far I have not been able to delete this folder either with a couple of delete on reboot programs.
Other than that her laptop is working fine, so I don't think I will start over and reformat.

Report •

#38
June 11, 2012 at 18:49:09
Very weird that hide/unhide reversal. Seems odd enough to wonder if something might be lurking. Just for info, one of the most popular root kit finders is "TDSSKiller" (freebie). It is also kept updated.

Report •

#39
June 11, 2012 at 19:08:09
So far have tried TDDSKiller, Malwarebytes, Housecall,Emsisoft and her installed McAfee.
Nothing found.

Report •

#40
June 12, 2012 at 09:48:54
Goodness knows. Maybe the rootkit idea was incorrect, or perhaps there was something lurking at one time, which has since gone - a remnant perhaps.

Not the first computer mystery I have encountered and it probably won't be the last.


Report •

#41
June 12, 2012 at 10:15:14
Yup, malware can really srew up a computer and deleting or removing malware will also sometimes remove files which only reinstall can fix.
Gonna leave as is, since everything else is working fine.

Report •

Ask Question