Smart questions
Smart answers
Smart people
Join Tek-Tips Forums

Member Login

Remember Me
Forgot Password?
Join Us!

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips now!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

Join Tek-Tips
*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.
Jobs from Indeed

Link To This Forum!

Partner Button
Add Stickiness To Your Site By Linking To This Professionally Managed Technical Forum.
Just copy and paste the
code below into your site.

C:\Documents and Settings\LocalService\Application Data\Microsoft\Prot

skip2004 (Programmer) (OP)
8 Mar 07 13:09

C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect

I have this folder on my machine and it is causing me a wee bit of grief.

In this folder the is a file called CREDHIST and a folder called S-1-5-19

From what I can find from searching on google it seems to be a normal structure.

However, there are a load of files underneath the S-1-5-19 - I can't see them in windows explorer but my virus software (AVG Free) takes ~12 hours to scan it.

Does anyone know any more info about this folder and what it is for? Is there anyway I can reduce the amount of files in it so my virus software will work?

Thanks in advance.
BadBigBen (MIS)
8 Mar 07 14:25
SID (Security Identifier) S-1-5-19 denotes the LOKAL SERVICE ACCOUNT...

more info:

and why AVG takes up to 12hrs to scan it, I have no idea... This file and location does not exist on my standalone WS...


"If it works don't fix it! If it doesn't use a sledgehammer..."

linney (TechnicalUser)
8 Mar 07 14:44
This appears to be a normal Windows folder and files location, it is only visible while you are showing hidden an system files.

AVG can scan it in seconds without any problems on the machines I have checked.  There are only about 10 or less files involved.

This suggest that you may have some corruption in AVG which might be cured by a re-install of AVG, or there is some corruption in the folder which might be fixed by running ChkDsk to check your drive for errors. Right-click your Drive icon/ Properties/ Tools/ Error Checking.  Select both boxes.

How many files do you have in this folder?  Can other scanning programs scan that folder without any problems?
skip2004 (Programmer) (OP)
8 Mar 07 16:17
Thanks for the replies.

I have tried running a chkdsk - and re-installing AVG but to no avail.

There are thousands of files - windows explorer hangs if I try to view the files in this folder.

If I navigate to that folder in a command window and run dir /ah it lists files for ages - never waited for it to finish but there are loads of files - each 338 bytes in size.

Something doesn't seem right to me!
linney (TechnicalUser)
9 Mar 07 1:06
Me, neither.

Copy them to CD or DVD if you can.  See when they were created via Properties etc., mine go back a couple of years, but I only have a handful, yours are breeding like mice!
After they are safely backed up maybe you can delete them from the folder, and also from the clutches of System Restore, which may automatically save them, and still cause scanning problems.

How Private Keys Are Stored

I haven't read all these, but they may be worth a read?

Is it only the one user profile that is showing this obvious (to me) fault?
skip2004 (Programmer) (OP)
9 Mar 07 4:37
Thanks for your reply linney. I will try your suggestions and have a look at those links.

It only seems to be affecting the LOCALSERVICE protect folder (C:\Documents and Settings\LocalService\Application Data\Microsoft\Protect).

If I look in another folder eg. C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect then there are only a few files like on your machine.

Something is causing the files to appear - and they all seem fairly recent ie. Feb/March of this year. I don't think I have installed any software which coincides with those dates but will investigate further - I think the last piece of software I installed was SQLServer 2005 development edition - so at the moment that is the prime suspect (I may uninstall that software to see if it cures it).

Thanks for your advice.
Lemon13 (MIS)
9 Mar 07 5:47
have u checked event-viewer ?
skip2004 (Programmer) (OP)
9 Mar 07 6:26
SQL Server 2005 Reporting Services seems to be creaitng a lot of errors - I think my next step is to remove SQL Server 2005.
linney (TechnicalUser)
9 Mar 07 14:38
Handy program to know about, when strange files are being created.

FileMon for Windows v7.04
skip2004 (Programmer) (OP)
10 Mar 07 6:49
Thanks - will give that a go.

I've removed SQL Server 2005 reporting services - I'll run filemon filtering on that folder for a week or so - and if nothing accesses the files I will archive and then remove.
skip2004 (Programmer) (OP)
10 Mar 07 10:45
I've finally let windows explorer open up the folder - there are a staggering 1,122,458 files!

After removing SQL Server 2005 reporting services no more files have been created in that folder, so hopefully I have found the culprit!

I will archive and delete those files - and keep an eye on the folder to see if any more files arrive (hopefuly not!)

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members!

Back To Forum

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close