I was looking for a folder on a PC at home (Vista, 32 bit) when I saw a bunch of folders with oddly formed filenames. There were 13 of them, with names and dates like this:
05/15/2010 03:34 AM2f934881647646785dbf842f86e91ec9
11/01/2009 03:24 AM3b9e7b6e4c58a68b7e71c5e3
11/03/2009 04:18 AM54693b59d80daf1421b7dda39a
10/31/2009 03:16 AM56d6fe71d579ef79995fee64834082
</pre>They all had files with the name “mpavdlta.vdm” and every time I tried to open the folder with Windows Explorer, i would get the following dialog:
I would press the “Continue” button and would have to answer “Continue” to the UAC dialog that would pop up on the screen.
Ok, so what are these files, what are they doing here, and can I remove them?
After a bit of searching, I found that they are the AntiSpyware definition files from the Microsoft Security Essentials antivirus application. That answered the first question. More precisely, they are the delta files for the antivirus definitions. There is also a mpvabase.vdm, which is the base signature file. The mpavdlta has all of the changes since the last mpvabase was downloaded. Gilham Consulting has a nice blog post that describes the various AV definition files that come with MSE.
As for how they got there, it appears to be a bug or design flaw with MSE. The last randomly named folder from MSE was dated 5/26/2010, a good three months ago. I fired up the the MSE console and it displayed that the virus definitions were current as of 8/21/2010.
My first guess was that situation was causing the vdm files and folders being created all over my C: drive has been addressed. With Windows Explorer, I went in and was able to delete most, but not all of the folders. It appears that MSE is still doing the random folder thing. But I was able to clear out most of them. So it looks like this is bug in the current release. From the various posts in the MSE forums, it appears that MS is aware of the problem, but nothing official has been posted about a resolution.
I think it’s a bit odd that MSE is storing the AV definition files in this manner. I’ve been pretty happy with how MSE is protecting my PC from virus attacks. I wouldn’t call it perfect, but it’s more than good enough for my needs. It’s a much lighter load on the system than the commercial AV solutions. I can put up with a few randomly named folders for the protection that it provides, but I would be more comfortable of the files had been shoved in a folder under %ALLUSERSPROFILE% as a default location. I’ll file this under “Nothing to see here, move along”.
