OLKCD or OLKB8 subdirectories of Temporary Internet Files

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

At my company many of us have a hidden subdirectory named one of the above.
We cannot access the files via Windows Explorer, but can see them when we get
an attachment via email. It seems to be the default for saving attachments.

I have found a way to get there by doing a search on the drive and using the
shortcut to get to the directory. I have deleted those files, all of which
came through my email and were accidentally saved to that directory.

But I'm suspicious. What is it? Why is it in temporary internet files?
Why can't I see it through Windows Explorer? Why, when I do a search on the
Internet, I can find other references to that subdirectory? Is it something
created by maliciousware?
 
At my company many of us have a hidden subdirectory named one of the above.
We cannot access the files via Windows Explorer, but can see them when we get
an attachment via email. It seems to be the default for saving attachments.
Click to expand...

Only one such file? Interesting. In my TIF I have a subdirectory called,
"Content.IE5". It contains four randomly named folders, using an eight
character alpha/numeric string:

E:\Temporary Internet Files\Content.IE5\698XENU9
E:\Temporary Internet Files\Content.IE5\8F8NWX2J
E:\Temporary Internet Files\Content.IE5\AG49BBAX
E:\Temporary Internet Files\Content.IE5\EU36PP6C

Actually, I saw more on one of my computers; but just deleted them and
rebooted. First boot of Windows after deletion and there are only four
folders in TIF\content.ie5.
I have found a way to get there by doing a search on the drive and using the
shortcut to get to the directory. I have deleted those files, all of which
came through my email and were accidentally saved to that directory.
Click to expand...

I can't navigate to E:\Temporary Internet Files\Content.IE5\ in the view
pane, but I can see it in the folders pane, and view the contents when I
select one of the folders.
But I'm suspicious. What is it?
Click to expand...

MS Internet Explorer cache.
Why is it in temporary internet files?
Click to expand...

They are temporary files.
Why can't I see it through Windows Explorer?
Click to expand...

One of the MVPs probably has the gory details, but it is something about
the way that the Windows file system works.
Why, when I do a search on the Internet, I can find other
references to that subdirectory?
Click to expand...

"Can find", or "can't find"? It is a subject which comes up regularly in
the GRC newsgroups (news.grc.com).
Is it something created by maliciousware?
Click to expand...

The folders are created by Windows. The content may harbor malicious items,
but those should be cleared by AV programs. They will be cleared if you
boot to DOS mode and delete the folders. Windows will just create new
folders the next time that you boot normally.
 
Thanks. I moved all my files out and put them elsewhere and did the same to
a co-worker who apparently wanted to get at the content. I must be getting
way too suspicious these days, huh?
 
 
Folders named OLKxx, where xx seems to vary from one system to another,
are created by Outlook when you open an attachment. It needs someplace to
store the file so it can be passed to the program that will actually open
it. The files are supposed to be deleted when the attachment is closed
but that doesn't always happen, especially if the message is closed with
the attachment still open.

The folder is usually located in Temporary Internet Files, which is a
system folder. The Windows search function doesn't look into folders with
the system attribute. There's nothing malicious going on here -- unless
you regard Outlook itself as malicious.


Lambi000 said:
At my company many of us have a hidden subdirectory named one of the above.
We cannot access the files via Windows Explorer, but can see them when we get
an attachment via email. It seems to be the default for saving attachments.
Click to expand...
 
Thanks. I moved all my files out and put them elsewhere and did the same to
a co-worker who apparently wanted to get at the content. I must be getting
way too suspicious these days, huh?
Click to expand...

Just because you are paranoid doesn't mean that "they" aren't out to get
you! ;)

I am not sure what there is to see of any interest in the cached files. I
periodically sweep that folder just to keep the disk space optimized. I
also put it on its own partition to facilitate such sweeping. Worst comes
to worse, I can reformat that partition, and not lose anything of
importance.
 
Back
Top