Where are these jpg's coming from?

Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images, some dating back to 2013 while
others were current to within the current hour. Reviewing a sample, they
appeared to be from web pages that I may have visited, but now I'm not
so sure. After reviewing some of the images, I deleted all of them so
that the folder was empty.

With no user applications running except Outlook 2016, I walked away for
about 45 minutes. When I returned, the previously empty folder now has
two new jpg images. As I typed that last sentence, a third image just
showed up.

Where are these coming from? What are Notifications? This is completely
unrelated to web browser activity, since no web browsers are running and
this isn't a browser cache folder anyway. I'll Google more later, but
thought I'd see if anyone knows.

--

Char Jackson

Char Jackson wrote:


Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images, some dating back to 2013 while
others were current to within the current hour. Reviewing a sample, they
appeared to be from web pages that I may have visited, but now I'm not
so sure. After reviewing some of the images, I deleted all of them so
that the folder was empty.

With no user applications running except Outlook 2016, I walked away for
about 45 minutes. When I returned, the previously empty folder now has
two new jpg images. As I typed that last sentence, a third image just
showed up.

Where are these coming from? What are Notifications? This is completely
unrelated to web browser activity, since no web browsers are running and
this isn't a browser cache folder anyway. I'll Google more later, but
thought I'd see if anyone knows.

This is just a guess, but I suspect that the folder is Outlook's cached
images from HTML-based emails.

I don't use Outlook, and rarely use Windows (use Linux 99% of
the time). My Linux email client is text-based and I get SO MANY
emails that are in HTML with embedded images like logos, backgrounds,
etc. I'm thinking that's it. You said you left Outlook running. So, shut
it down, clear the folder and see what happens. Worse that could
is I'm wrong.


Stef

Char Jackson wrote:
Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images, some dating back to 2013 while
others were current to within the current hour. Reviewing a sample, they
appeared to be from web pages that I may have visited, but now I'm not
so sure. After reviewing some of the images, I deleted all of them so
that the folder was empty.

With no user applications running except Outlook 2016, I walked away for
about 45 minutes. When I returned, the previously empty folder now has
two new jpg images. As I typed that last sentence, a third image just
showed up.

Where are these coming from? What are Notifications? This is completely
unrelated to web browser activity, since no web browsers are running and
this isn't a browser cache folder anyway. I'll Google more later, but
thought I'd see if anyone knows.


The 128 bit number on the end could be a CLSID or a GUIS.

e93e2810-763d-11e2-be6b-84a6c8421a6b

Take a look for it in the Registry.

I don't think you'll find it there. It doesn't look
like it is systematically formed, whatever that number
is. It's probably just random.

Paul

On Sat, 18 Feb 2017 10:48:49 -0600, Char Jackson wrote:
Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

My computer has
C:\Users\user\AppData\Local\Microsoft\Windows
but not
C:\Users\user\AppData\Local\Microsoft\Windows\No tifications

I don't know why yours does, but at a guess it's some Microsoft
application, rather than Windows itself, that creates the JPGs you
found.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://BrownMath.com/
http://OakRoadSystems.com/
Shikata ga nai...

Char Jackson wrote:

Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images, some dating back to 2013 while
others were current to within the current hour. Reviewing a sample, they
appeared to be from web pages that I may have visited, but now I'm not
so sure. After reviewing some of the images, I deleted all of them so
that the folder was empty.

With no user applications running except Outlook 2016, I walked away for
about 45 minutes. When I returned, the previously empty folder now has
two new jpg images. As I typed that last sentence, a third image just
showed up.

Where are these coming from? What are Notifications? This is completely
unrelated to web browser activity, since no web browsers are running and
this isn't a browser cache folder anyway. I'll Google more later, but
thought I'd see if anyone knows.

http://www.swiftforensics.com/2016/0...-database.html

Maybe you installed some software that has Windows 8 as its minimum
supported OS but you installed it anyway.

You can use software to monitor file i/o, like when a file got created,
modified, deleted, or otherwise touched. One is SysInternals FileMon
(which got rolled in with RegMon into their ProcMon tool which makes it
a bit clumsier to use). You will want to define a filter to monitor
just the files in that path instead of monitoring all files.

https://technet.microsoft.com/en-us/...rnals/bb896645

If you just look at the .jpg files, might their image reveal what they
were for and what might've created them?

On 18/02/2017 21:30, Stan Brown wrote:
On Sat, 18 Feb 2017 10:48:49 -0600, Char Jackson wrote:
Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

My computer has
C:\Users\user\AppData\Local\Microsoft\Windows
but not
C:\Users\user\AppData\Local\Microsoft\Windows\No tifications

I don't know why yours does, but at a guess it's some Microsoft
application, rather than Windows itself, that creates the JPGs you
found.


I don't have this folder
C:\Users\user\AppData\Local\Microsoft\Windows\No tifications either.
Running W7 Pro 64b.

I guess Stan is right.

Fokke

In article ,
lid says...

Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images, some dating back to 2013 while
others were current to within the current hour. Reviewing a sample, they
appeared to be from web pages that I may have visited, but now I'm not
so sure. After reviewing some of the images, I deleted all of them so
that the folder was empty.

With no user applications running except Outlook 2016, I walked away for
about 45 minutes. When I returned, the previously empty folder now has
two new jpg images. As I typed that last sentence, a third image just
showed up.

Where are these coming from? What are Notifications? This is completely
unrelated to web browser activity, since no web browsers are running and
this isn't a browser cache folder anyway. I'll Google more later, but
thought I'd see if anyone knows.

On my Win10 computer, they seem to be pictures from live tiles. I only
had a few, but I can tell most came from the Netflix tile, as they were
title cards for several shows and movies.

--
If there is a no_junk in my address, please REMOVE it before replying!
All junk mail senders will be prosecuted to the fullest extent of the
law!!
http://home.comcast.net/~andyross

On Sat, 18 Feb 2017 15:30:11 -0500, Stan Brown wrote:

My computer has
C:\Users\user\AppData\Local\Microsoft\Windows
but not
C:\Users\user\AppData\Local\Microsoft\Windows\No tifications

Same thing here; there's no Notification folder (hidden folders/files
are visible).

--
s|b

On Sat, 18 Feb 2017 15:02:58 -0600, VanguardLH wrote:

Char Jackson wrote:

Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images, some dating back to 2013 while
others were current to within the current hour. Reviewing a sample, they
appeared to be from web pages that I may have visited, but now I'm not
so sure. After reviewing some of the images, I deleted all of them so
that the folder was empty.

With no user applications running except Outlook 2016, I walked away for
about 45 minutes. When I returned, the previously empty folder now has
two new jpg images. As I typed that last sentence, a third image just
showed up.

Where are these coming from? What are Notifications? This is completely
unrelated to web browser activity, since no web browsers are running and
this isn't a browser cache folder anyway. I'll Google more later, but
thought I'd see if anyone knows.

http://www.swiftforensics.com/2016/0...-database.html

Maybe you installed some software that has Windows 8 as its minimum
supported OS but you installed it anyway.

You can use software to monitor file i/o, like when a file got created,
modified, deleted, or otherwise touched. One is SysInternals FileMon
(which got rolled in with RegMon into their ProcMon tool which makes it
a bit clumsier to use). You will want to define a filter to monitor
just the files in that path instead of monitoring all files.

https://technet.microsoft.com/en-us/...rnals/bb896645

If you just look at the .jpg files, might their image reveal what they
were for and what might've created them?

+1 on using ProcMon
Find out what's creating them, it might be malware.
Whatever they are, they are a privacy problem.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012

On Sat, 18 Feb 2017 15:02:58 -0600, VanguardLH wrote:

Char Jackson wrote:

Windows 7 Ultimate, x64

Using Everything Search, I did a search for .jpg on my C: drive. One of
the folders that came up was the following:

C:\Users\user\AppData\Local\Microsoft\Windows\No tifications\e93e2810763d11e2be6b84a6c8421a6b

That last folder is hidden and will likely be different for everyone.

That folder held 17,403 jpg images,
snip

Where are these coming from? What are Notifications?

http://www.swiftforensics.com/2016/0...-database.html

Maybe you installed some software that has Windows 8 as its minimum
supported OS but you installed it anyway.

Well, this is embarrassing! As it turns out, I had been working on a Win
7 PC for most of the day, but somehow I flipped over to a Win 8.1 system
just in time to run that Everything search. So those images are almost
certainly a result of 8.1's tiles, although I never see the tiles so I
can't be 100% sure. I'm about 99%, though.

Thanks, everyone, for the input and my apologies for the fire drill.

--

Char Jackson

On Sun, 19 Feb 2017 14:03:23 -0600, Char Jackson wrote:
Well, this is embarrassing! As it turns out, I had been working on a Win
7 PC for most of the day, but somehow I flipped over to a Win 8.1 system
just in time to run that Everything search. So those images are almost
certainly a result of 8.1's tiles, although I never see the tiles so I
can't be 100% sure. I'm about 99%, though.

Thanks, everyone, for the input and my apologies for the fire drill.


Thanks for letting us know. It's always nice to hear the solution to
a mystery.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://BrownMath.com/
http://OakRoadSystems.com/
Shikata ga nai...