Any idea what this is? CLSID_StartMenuPathCompleteProviderFolder

TenneR · 13 Oct 2022

I'm not sure where to post this, but as it's a security concern, I'll try here.

After turning on my PC this morning, I immediately noticed an icon on my desktop - looks like a magnifying glass and can only Cut, Create Shortcut or Delete.

The icon is CLSID_StartMenuPathCompleteProviderFolder.

I'm not sure where this came from and how it was created. I haven't installed anything, other than restarted for Windows 10 21H1's cumulative update yesterday (KB5018410).

I've scanned my desktop containing that icon with MS Defender - nothing found.

Is this anything to be concerned about?

Any know how it may have come about and ended up on my desktop?

Thanks.

- - - Updated - - -

I should add that I've just tried deleting it.

Shift + Delete removes it immediately without further prompts, but it reappears after refreshing the desktop!

Also, the icon doesn't show when I look in the Desktop folder, but is only visible on the desktop itself?

Should I stop using my PC?

Paul Black · 13 Oct 2022

Hello @TenneR,

TenneR said:

I haven't installed anything, other than restarted for Windows 10 21H1's cumulative update yesterday (KB5018410).

I've scanned my desktop containing that icon with MS Defender - nothing found.

I should add that I've just tried deleting it.

Shift + Delete removes it immediately without further prompts, but it reappears after refreshing the desktop!

Also, the icon doesn't show when I look in the Desktop folder, but is only visible on the desktop itself?

As a start,

[1] Right-Click the Icon and select Properties, post a screenshot.

> How to Upload and Post Screenshots and Files at Ten Forums

[2] Have you got a System Restore Point PRIOR to this appearing that you can try ?
[3] You could also download MalewareBytes and run a scan.
[4] Have you run ANY PS commands ?
[5] Did you create a System Image PRIOR to installing the Cumulative Update ?

Also,

System Specifications - To go in your Profile:

Please update your system specifications [ System AND Hardware ] by editing your profile. It will allow us to give you more specific advice and help.

> How to Fill in your System Specs at Ten Forums.

Thanks.

TenneR · 13 Oct 2022

Thanks Paul.

I'm currently on version 19043.2130.

I haven't created a system image nor system restore point.

I also haven't ran any PS commands but might install MWB later.

I'm unable to provide any details on Properties, as when I right click on the icon, I'm only presented with Cut, Create Shortcut and Delete options.

Thanks.

- - - Updated - - -

Well, I've powered down the PC earlier.

Powered back on and that icon no longer shows.

Is this just a blip / glitch - not sure what to make of it.

Anyone else had random CLSID icons appear on their desktop?

Paul Black · 13 Oct 2022

Hello @TenneR,

TenneR said:

Well, I've powered down the PC earlier.

Powered back on and that icon no longer shows.

Is this just a blip / glitch - not sure what to make of it.

I have heard of this happening many times in the past. I think that it is probably related to the fact that Windows runs certain background cleanup tasks periodically, and when you performed a Restart, it ran a cleanup on the Caches etc for example.

I don't think that it will return, but IF it does, we can perform further diagnostics and investigation.

I hope this helps.

TenneR · 13 Oct 2022

Thanks Paul - do you think it's safe to continue using the PC as normal?

Paul Black · 13 Oct 2022

Hello @TenneR,

TenneR said:

Thanks Paul - do you think it's safe to continue using the PC as normal?

Yes, I think so, I would.

You could of course create a System Image as a backup.

I hope this helps.

TenneR · 13 Oct 2022

Thanks Paul. I imaged onto another disk - installed & ran MWB and that came up with nothing.

I also ran a full scan of the Windows installation with MS Defender; that also came back fine.

The only thing I don't understand is why I've lost around 5gb along the way.

I created rescue media USB with Macrium Reflect v8 and booted into Win PE via USB. Initially noticed on cloned image when I logged on; also noticed the same when I hooked the original disk back up.

Anyone with any ideas?

- - - Updated - - -

Just wondering - is there a possibility of that missing 5gb be used as a hidden partition?

Is that even possible for malicious software to create that partition in the background?

I suppose if it wanted to do something in the background, it would have done so from the get go and not raise suspicions with unidentified icon on desktop?