The Case of the Phantom Desktop Files
A few weeks ago, my wife mentioned that she sometimes saw files in her desktop folder that didn’t appear on the actual desktop. She brought it up not only because she was confused by the discrepancy, but because she wanted to move some of these phantom files to other folders and wanted to delete others. I had no idea what she was talking about (which was usually the case when she described her computer troubles), so I told her that the next time she saw these mysterious files, to call me to look at it.
A few days later I got home from work and she greeted me excitedly at the door and explained that the problem reoccurred and that she had left a window open showing the elusive files. I rushed to the kitchen computer with anticipation, not even bothering to greet the dogs on the way, and surveyed the situation. She had a maximized IE window open with a full row of tabs for her open emails (I don’t think she ever closes an email window). An IE “Choose a File” dialog box was in the foreground listing the files in her desktop folder, which she had opened by clicking the attachment button in the email editor. The dialog looked like this:
I minimized IE to view the desktop background and sure enough, several of the files visible in the dialog, such as the “Maui Feb. 08” folder and the CIMG13xx JPG files, were missing. I opened an Explorer window and navigated to her desktop folder to see if the files would show up there, but they were missing there as well:
I’d never seen that behavior before. I knew this was a job for Process Monitor. Since my wife doesn’t keep the Sysinternals tools on her system (sad, but true), I ran it directly from the network using the Sysinternals Live address, \\live.sysinternals.com\tools\procmon.exe. With Process Monitor recording activity, I closed and reopened the Choose File dialog from the email editor and then I search for “CIMG”, a portion of the file name for many of the files present in the Choose File dialog, but not in the Explorer view of the desktop. The first hit was a directory enumeration operation with the file names showing as results in the Details column on the far right:
The files were located in her profile under \Appdata\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Daryl\Desktop. This Virtualized is directory created by IE7 when run in Protected Mode (PMIE), which is the default mode on Windows Vista and Windows Server 2008.
PMIE uses Integrity Levels, introduced in Vista and Server 2008, to limit the file system and registry locations to which code running in IE can modify to a subset of those writeable by the user account in which IE executes. As I described in an earlier blog post, the sandbox defined by locations labeled with Low Integrity, the level at which PMIE executes and of the objects that PMIE can modify, allow PMIE to save favorites and temporary files, like the IE cache and browsing history. However, PMIE cannot modify other locations in a user’s account, like documents folders and per-user autostart locations in the registry and file system, because they have an integrity level of Medium. That prevents drive-by-download malware that might infect the IE process from establishing a persistent presence.
In order to preserve backward compatibility with legacy code, such as ActiveX controls and Browser Helper Objects, that might be coded to write to locations outside of the sandbox, PMIE implements shims that intercepts file and registry operations and redirects ones that got outside the sandbox to the Virtualized directory within it.
To see if that was what was happening here, I examined the stack trace of the virtualized operation highlighted above by right-clicking on the line and choosing Stack. The stack showed that Acredir.dll was intercepting the operation and executing redirection functions:
Double-clicking on the line in the stack trace opens the module properties dialog, which shows that the DLL is the “Windows Compatibility DLL”, thus confirming this was part of PMIE’s sandbox implementation:
I had been familiar with PMIE’s virtualization, but I’d never seen files virtualized on the desktop, so it had not been obvious to me that was what was causing the discrepancy. Process Monitor revealed the cause, so now all I was left with was cleaning up the virtualized files. Most users don’t realize that you can move and delete files from within a file browse dialog, so I took the opportunity to show my wife how she can manage virtualized files from the email editor’s attachment dialog if she came across them again. We deleted the files she didn’t want and moved the pictures out to her photo library folders.
The case was closed. As a bonus, my wife was impressed at the ease with which I’d figured out the source of the phantom files and even more impressed that I wrote the tool I used to solve it. She’d also gotten an in depth look at PMIE’s virtualization and integrity levels, but I think in the end my lecturing on those subjects actually subtracted points.
Incidentally, you’ll almost certainly see files and directories if you look at the PMIE Virtualized folder in your profile, because even routine operations within IE result in redirection. Here you can see thumbnail cache files that the shell’s file browsing dialog creates when you use it from within IE. Normally, the shell stores thumbnail cache files in your profile, but PMIE can’t write to that location so the shim virtualizes it:
Comments
Anonymous
February 03, 2009
> As a bonus, my wife was impressed at the ease with which I’d figured out the source of the phantom files and even more impressed that I wrote the tool I used to solve it. Yeah, but what about the dogs?Anonymous
February 03, 2009
The comment has been removedAnonymous
February 03, 2009
Phileosophos has clearly misunderstood the situation. The files do not show up in the Desktop because they are NOT located in the desktop. They're located in the virtualized directory, somewhere hidden so that the user won't be bothered by them. Only to IE do the files appear to be in the Desktop. This is the whole point of having the backwards compatibility shim in the first place. The files must appear to the ActiveX control as though they were in the Desktop, so that the control will be able to find the file. The general problem with almost-but-not-quite-seamless compatibility shims in Windows is that some vendors end up relying on them for years. I vote with my money by avoiding these types of programs (Quicken being the classic example), but most users don't know and don't care. Sometimes even Microsoft programs fall into this category. Frankly, I think the only way to deal with this is to have a place to see every shim applied for every program on your system. But then, Microsoft has always treated partners and OEMs with kid gloves (especially after the antitrust suit). And so the ecosystem continues to be a quality jungle ...Anonymous
February 03, 2009
The comment has been removedAnonymous
February 03, 2009
Interesting reading as always. I'm thinking the "phantom" files might have come from some webmail attachment downloads or similar, but just guessing. Maybe an ActiveX helper control for doing just that. I think you forgot to add in a link: "As I described in an earlier blog post [link]"Anonymous
February 03, 2009
The comment has been removedAnonymous
February 03, 2009
The comment has been removedAnonymous
February 03, 2009
"I had no idea what she was talking about (which was usually the case when she described her computer troubles)..." "...I think in the end my lecturing on those subjects actually subtracted points." Join the club, Mark. We have a secret handshake and discounts with local retailers. Awesome post as always.Anonymous
February 04, 2009
Ahh! Well there you go. I have this exact behaviour on my work lap-top when looking at the directory structure through SharePoint's multiple-file-upload interface. I've never really been bothered trying to fix it (as I'm usually in the middle of something when I notice it).Anonymous
February 04, 2009
This is the reason why I don't like Vista. It tries to be easy, but finally has so much complexity, that it's mostly annoying. I really don't like the "I-see-a-file-but-it-is-not-where-it-is-supposed-to-be"-virtualization-thing. Conclusion: I am going to switch to Mac soon.Anonymous
February 04, 2009
"my wife was impressed at the ease with which I’d figured out the source of the phantom files and even more impressed that I wrote the tool I used to solve it." ....Does your wife not realise just how much of a big deal you are? Or what you actually do? We all love your tools and your posts are always enlightening, highlighting just how little some of us actually know! Awesome as always and I can't wait for Amazon to deliver your latest book to me!Anonymous
February 04, 2009
Actually, the case isn't closed, I don't think users have to see this issue show up... Will this be fixed in the future?Anonymous
February 04, 2009
Don't use IE. Problem solved. That "Virtualized" directory does not exist on my Vista machine (on which I use Firefox).Anonymous
February 04, 2009
The comment has been removedAnonymous
February 05, 2009
I've had the opposite problem that's extremely frustrating. I used a third-party PDF printer. It would put PDFs in a virtualized folder for My Documents. Imagine the fun when you go to your "real" documents folder and then NOT find the pdfs you printed! I switched to another pdf driver that doesn't do that.Anonymous
February 06, 2009
I've had problems with .exe's from a .rar unzipped (unrar'd?) to the desktop - problems deleting them. Is this related? I've also unzipped a .exe by dragndrop from winrar to the desktop and not seen it, but it showed up in explorer. Maybe winrar and win7 don't get along. So what did the dogs think?Anonymous
February 06, 2009
Interesting way to solve the multi-integrity level & backwards compat...gawd...the things MS goes through to preserve backwards compat for some apps...it's torturous. Have seen various solutions, for directories in "well-known" locations (desktop on win, /tmp on unix)... SGI IRIX did something similar on the multi-level OS back in the 90's with /tmp. Every app expected to use it as a scratch space, but users were separated by virtual walls -- so to user progs, they all saw /tmp, but the os multiplexed them to /tmp/<privilege-level+label>. Linux is just now adding something similar -- the ability to virtually merge multiple directories -- so read-contents appear like one big dir, but private files and writes go to another private dir...but user will always see the public dir+their own private dir.... Not sure of the details, as I saw the summary notes on the last kernel release. Interesting how security issues from the 80's in the DOD are just now getting to the consumer market 20-30 years later...Anonymous
February 06, 2009
Phileosophos + 1 Had I been a Vista user I would find this behavior counter-intuitive, regardless how much sense the implementation makes. Good thing I did not upgrade to Vista. Will wait for Windows 7, hopefully this problem (it is a bug, not a feature) will be fixed by then.Anonymous
February 07, 2009
i thought one of the implemented features of virtualized folders was that Windows will present a unified view of the files when i browse to the "real" folder. So if i save an image on my desktop: it will be saved on my desktop. Is this not the case? Are files downloaded using IE lost to the user? Is that the intended behaviour? i can barely explain the idea of folders to friends and family - let alone a folder that eats your files.Anonymous
February 09, 2009
Sounds like a terrible overlook of usability imo, until which files get "virtualized" is clearly defined. Are normally downloaded files stuck into the virtualized storage area? Or only files which are related to 3rd party ActiveX controls?Anonymous
February 09, 2009
If a website launches a Java applet in IE7 PMIE mode on Vista then does IE further sandbox the applet i.e. on top of the security framework which the java runtime implements. ThanksAnonymous
February 09, 2009
Nice article, as always. There seem to be a number of methods of associating folders into a single view now. quote: I think in the end my lecturing on those subjects actually subtracted points. /quote I completely relate. I lose those same points nearly every day. :)Anonymous
February 10, 2009
Is this only on Windows Vista without SP1..i have X64 SP 1 installed...and i can save things to e.g. the desktop because of the ieuser.exe thats running at medium IL and is the RPC Server for the IL Low iexplore.exe to serve for things like copy things to the PC...etc....P.S. PMIE is enabled......Anonymous
February 10, 2009
What I don't get is how these files got into the virtualized drive in the 1st place. Also, is there any way to clean virtualized drives?Anonymous
February 10, 2009
While a very intelligent (and actually secure) way to do things, it's counter-intuitive. I understand why MS would choose this, but like Vista's UAC, the implementation is horrible. Like Mark's wife, it seems that the files are missing. Mark, many of the users on this blog, and myself could probably figure it out or at least find the "missing" files, but typical users probably wouldn't. They would just assume Vista lost their files or it's a bug or it's their computer. They wouldn't say "oh, this is good"...they don't even know it's a security mechanism. Well designed, Microsoft, but horribly implemented.Anonymous
February 11, 2009
hi Mark, became a fan of your approach and mindset, through your blog. The dedication and love I see in you, is something I would like to have too. primary reason for writing; is to let you know that the titles you choose are simply awesome, generates interest, old English style, and tells it wont be tough reading it. :) All best! :) Kamlesh ChandraAnonymous
February 11, 2009
Hello. This post reminds me a problem we have with few of our pcs (out of about few hundreds). Windows XP Pro, computers joined to a domain and some of them have troubles with refreshing the desktop (users have to right-click and choose refresh button). We investigated this issue for few months, checked most of our IT infrastructure, reinstalled, rejoined to a domain and found nothing... maybe you guys have any ideas? Best regards.Anonymous
February 12, 2009
Microsoft should have devised a new icon treatment or type-prefix to flag these to the user, along with mouse-over help. Why another layer of obscurity? To Microsoft's customers this is nothing more than a bug.Anonymous
February 12, 2009
Implementation of virtual folders is a problem! I almost think that this is the Microsoft's lawyer-ly approach to technology:
- Put in a very secure way to do things you want to do -- like save a file from a Web site.
- Implement same in the quickest style possible -- even highly experienced technical users have to use tools to find out what is happening.
- Since implementation is inconvenient for users, tell them: you can turn off protected mode (or UAC or ...) as a "solution."
- If they later complain that they were hacked, tell them that THEY chose to turn off the secure way to do things. So, is there a way to mark "approved" controls as safe permanently, so they can function intuitively? PMC
Anonymous
February 12, 2009
I'm wondering if the reason that the user can see these files is that like in Windows XP/2003, the Explorer view was changed to show all hidden files and folders and System files. Most admins that I know turn this non-default view on for ease of administration and troubleshooting, but it can cause all kinds of issues when a non-tech users can see and manipulate these files, JUST LIKE MAKING ALL USERS MACHINE ADMINS CAN.Anonymous
February 12, 2009
The comment has been removedAnonymous
February 12, 2009
i agree - the user should never be aware of this. and nobodys wife should ever be forced to use process monitor ;)Anonymous
February 13, 2009
This isn't an IE bug or a Windows bug. This is a security breach in an add-on to IE, which IE & Vista are handling fairly gracefully. Windows 7 won't solve it, because it's not Microsoft's error. On IE and Windows end, it is a feature, it is not a bug. The ActiveX control or BHO that saved these to the desktop need to be fixed. If they want write permissions to the desktop, then they should install a user-rights broker.Anonymous
February 13, 2009
I good an great and you saved the day. Buthow do you keep all these files purged? since moving to vista unless I write an elaboatre script I can't use robocopy to basic backups of the user directory because of the virtualization directory. Robocopy gets stuck on this with a never ending diectory structure. Any better ideas.Anonymous
February 13, 2009
I can't stand that endless recursion of dirs, it really plays havoc when searching for something through a command window, as the name gets too long for Windows to process. As for the strange desktop behavior, I noticed early on that sometimes files that WERE on the desktop are mysteriously gone next time I log on. I've also had other weird things happen in Vista, like my desktop is arranged way differently than I left it. I put it back, and then sometimes it does the same thing. Sometimes not.. My wife has noticed the same occurences a few times as well. That's Microsoft for you!Anonymous
February 14, 2009
The comment has been removedAnonymous
February 14, 2009
The comment has been removedAnonymous
February 14, 2009
Now that Mr. Russinovich works at Redmond at least it can inform the guys who designed such a mechanism how they are just baffling users. That's a perfect example of a bad techie solution that doesn't work in the real world. I too agree that MS should stop to put too much emphasis on "compatibility". Windows should be compatible with well written applications, and should begin to stop those written without following the rules.Anonymous
February 16, 2009
The comment has been removedAnonymous
February 18, 2009
Well, someone once said that someday computers would be as easy to use as a telephone. I think that day has finally arrived. Whenever I am forced to use a phone that isn't my own cell, I usually don't have the slightest idea how to use it.Anonymous
February 18, 2009
Related question: I am concerned that the concept of "libraries" in WIndows 7 is going to create similar confusion perhaps. Have you looked to see what is happening there? People are used to files and folders (even novices to computers) and this may make the "location" of a picture or document become even more difficult to understand.Anonymous
February 19, 2009
The comment has been removedAnonymous
February 20, 2009
Is there a way to stop the desktop.ini file from showing up everywhere?Anonymous
February 20, 2009
I have the same problem about desktop.ini file as well, it invades all my folders and desktop and most of files with "MY" words on it became inaccessible... So anyone for u can tell us this? And also why "Error 08x80070052 keeps popping up every time i want to copy a file to USB's? which it never happened before untildesktop.ini invades my filesAnonymous
February 21, 2009
Interesting. It looks like it's bug in a "Open Dialog" window. If you do drag&drop into this window, it asks for the UAC confirmation. But if you copy a file with ctrl+c/ctrl+v - it will be just dropped there and appears then in a "virtualized" folder.Anonymous
February 21, 2009
I would say even more. The behaviour of the "open file" dialog in case of PMIE is REALLY strange. If you try to remove a virtualized file, the conf. dialog appears under the "open file" dialog. To access it, you have to move the "open file" a bit. All tests have been done on WinVista x64 SP1 with all latests updates from Windows UpdateAnonymous
February 23, 2009
The comment has been removedAnonymous
February 23, 2009
Any reason you didn't just r-click and Open File Location to see it was in the virtualized folder?Anonymous
February 24, 2009
I am having a problem with Phantom Download Files In Both Windows 7 Build 7000 And WS2008R2 Build 7000, Any Suggestions?Anonymous
February 24, 2009
I am unable 2 either run, move. or delete the files in the windows 7 Build 7000 and WS2008R2 Build 7000 Downloads Folders.Anonymous
February 25, 2009
The comment has been removedAnonymous
February 25, 2009
Nevermind, I found the problem with my Windows 7 Installation, the read only option was turned on 4 the Downloads Folder got turned on after my Upgrade Install from Vista 2 Windows 7 Beta 1.Anonymous
February 28, 2009
The comment has been removedAnonymous
February 28, 2009
Losing files from the desktop it is a very serious and annoying problem or issue. I have fixed this thing by using jv16 PowerTools 2009, an application made to optimize Microsoft Windows without losing any key information from your computer (a registry cleaner that has also the option of back-up-ing all the files and settings). I recommend this product to all of you, and i really hope that you will try it and it will show results.Anonymous
March 02, 2009
The comment has been removedAnonymous
March 05, 2009
The comment has been removedAnonymous
March 06, 2009
Don't use IE. Problem solved. That "Virtualized" directory does not exist on my Linux machine (on which I use Epiphany).Anonymous
March 13, 2009
It is right. Some files, folders and settings from our computer can disappear, at a random basis. In order to not encounter these kinds of problems or issues on your computer, an IT user will need to have some additional programs downloaded and installed on their computer (like a registry cleaner or/and a Windows Optimizer such as jv16 PowerTools 2009).Anonymous
March 15, 2009
The comment has been removedAnonymous
March 16, 2009
Great work as usual Mark and your wife. Mark since you play BF2142. Could you please do a 'Case of the crashing Bf2142 Server'. It must bug you as much as it does me and thousands of other brothers in arms. ThanksAnonymous
March 16, 2009
@Dave Johnson - we all want to know. Which of the three do you use?Anonymous
March 20, 2009
The comment has been removedAnonymous
March 23, 2009
The comment has been removedAnonymous
April 02, 2009
After reading the fact that it was IE showing this files and the screenshots showing it was Vista, I immediately knew it was because of file virtualization. I don't need no fancy tools; like Raymond I can use my psychic debugging powers. :PAnonymous
April 03, 2009
The comment has been removedAnonymous
April 07, 2009
Does the legacy application "see" the existing, non-virtual files? I think the answer is yes. If it does, how does vista solve the delete file operation for a legacy application?Anonymous
April 19, 2009
The comment has been removedAnonymous
June 02, 2009
If the "Desktop" view in Explorer, etc., would concatenate the user's virtualized Desktop with the user's real desktop (and, I suppose, the All Users real desktop), then the unified view would not confuse the user; they wouldn't care if the files were stored in the virtual location or in the actual location. As somebody mentioned, it would be good if the virtualized file icons had some type of indicator, similar to the shortcut arrow's usage.Anonymous
June 07, 2009
The comment has been removedAnonymous
July 20, 2009
I had this problem a few weeks back as well... I solved it very easily. Right-click->properties (or file-> properties from a pdf or something) then cut and paste. Done... (well, i guess figuring out exactly why it happened is sort of interesting)Anonymous
February 22, 2010
We've experienced this problem in our company lately so I started to investigate it with the great Sysinternals tools from Mark. The only problem is, that this virtualization of PMIE is permanent, e.g. the acredir.dll hooks will re-direct all write attempt to the Virtualized folder. This doesn't make any sense, because this virtualization is used only for write attempts and not for reading!!! Also if you actually grant write rights for IE to the desired folder, it will still write to the Virtualized folder!!! This is IMHO incorrect. The only function I found to handle such redirection is AcRedirSetEnabled() and AcRedirSetEnabledForCurrentThread() exported from acredir.dll. But I have very little documentation for these functions. Alternatively you should be able to use CreateFile from ntdll.dll.Anonymous
May 25, 2010
The comment has been removedAnonymous
September 13, 2010
Wow, thanks for the advice. You're great with computers, though not with animals and women.Anonymous
September 28, 2010
The comment has been removedAnonymous
January 27, 2011
It's a bit disturbing that a web site is attempting to drop files on the desktop; that's the sort of thing one usually expects from Chrome or Safari, but I'd hope IE would not allow that - as indeed IE8 on modern Windows doesn't, thanks to the virtualization, shims etc. Would IE6 on XP have allowed those files to be dropped on the "real" desktop?