Member Avatar for regina11

I run xp and have a folder called 599330ad54d43e2b8231 and i am not sure where it came from, in the folder there is a text document called %temp%dd_msxml_retMSI.txt in this doc there are things like:

=== Logging started: 11/29/2007 0:49:40 ===
Action start 0:49:40: INSTALL.
Action start 0:49:40: LaunchConditions.
Action ended 0:49:40: LaunchConditions. Return value 1.
Action start 0:49:40: FindRelatedProducts.
Action ended 0:49:40: FindRelatedProducts. Return value 1.
Action start 0:49:40: IsPendingRebootKey.
PendingFileRenameOperations contains:
\??\C:\WINDOWS\system32\usmt\SET6D.tmp~!\??\C:\WINDOWS\system32\usmt\sysmod.dll~\??\C:\WINDOWS\system32\usmt\SET6E.tmp~!\??\C:\WINDOWS\system32\usmt\script.dll~\??\C:\WINDOWS\system32\usmt\SET6F.tmp~!\??\C:\WINDOWS\system32\usmt\migwiz.exe~\??\C:\WINDOWS\system32\usmt\SET70.tmp~!\??\C:\WINDOWS\system32\usmt\migload.exe~\??\C:\WINDOWS\system32\usmt\SET71.tmp~!\??\C:\WINDOWS\system32\usmt\migism.dll~\??\C:\WINDOWS\system32\usmt\SET72.tmp~!\??\C:\WINDOWS\system32\usmt\log.dll~\??\C:\WINDOWS\system32\usmt\SET73.tmp~!\??\C:\WINDOWS\system32\usmt\iconlib.dll~\??\C:\WINDOWS\system32\usmt\SET74.tmp~!\??\C:\WINDOWS\system32\usmt\guitrn.dll~\??\C:\WINDOWS\system32\SETFF.tmp~!\??\C:\WINDOWS\system32\pnrpnsp.dll~\??\C:\WINDOWS\system32\SET100.tmp~!\??\C:\WINDOWS\system32\p2psvc.dll~\??\C:\WINDOWS\system32\SET101.tmp~!\??\C:\WINDOWS\system32\p2pnetsh.dll~\??\C:\WINDOWS\system32\SET102.tmp~!\??\C:\WINDOWS\system32\p2pgraph.dll~\??\C:\WINDOWS\system32\SET103.tmp~!\??\C:\WINDOWS\system32\p2pgasvc.dll~\??\C:\WINDOWS\system32\SET104.tmp~!\??\C:\WINDOWS\system32\p2p.dll~
No file in package listed in PendingFileRenameOperations
Action ended 0:49:41: IsPendingRebootKey. Return value 1.

*Does anyone have any idea what this folder and text doc is and if i need to keep it?
Thank you and appreciate any help on this.

  • 3 Contributors
  • 5 Replies
  • 449 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by regina11

Dani AI

Generated

Following ’s original post and the helpful pointers from and , here is a short, practical checklist to confirm what that mysteriously-named folder is and remove it with minimal risk.

Quick verification steps

  • Open the folder and look for any .log files. Search inside them for a KB number or product string (for example "KB123456"). From a command prompt you can run:
    findstr /I "KB" *.log
  • Check installed updates: Control Panel → Add or Remove Programs, then click "Show updates" to see updates installed around the folder’s creation date.
  • See whether Windows has scheduled any rename/copy operations that reference those files (do not delete if present). From an elevated command prompt:
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations
  • Confirm no process is holding files open. Use Sysinternals Process Explorer (Find → Find Handle or DLL) or the standalone Handle utility to search for handles to that folder.

Safe removal workflow

  • Make a restore point (Start → All Programs → Accessories → System Tools → System Restore → Create a restore point) or back up the folder elsewhere first.
  • If logs and installed-updates match and there are no pending operations or open handles, rename the folder (append _OLD) and keep it for a few days. If nothing breaks, delete it normally.
  • If you cannot delete (access denied or files in use), reboot into Safe Mode and delete, or use the Recovery Console / offline tools to remove it.

Final notes

  • Scan the folder with your AV before removing if you’re unsure. If you prefer a zero-risk approach, leaving a cold, unchanged folder in the root of C: is harmless—renaming first gives an easy rollback option.

Recommended Answers

All 5 Replies

Member Avatar for Suspishio

The date and time of the folder's creation should correspond with the date when your installation was set up.

Does that check out? The folder is put there when you start crerating users on an otherwise default or OEM system.

Harmless and can be deleted.

Member Avatar for regina11

it is within about 7 days difference of the install date, does that sound right? I found an install date if nov22 and the folder was made on nov 29

Member Avatar for Suspishio

That is likely to be the date of a Windows update. Every PC I've got has a very similar file to the one you described.

Member Avatar for dos_centavos

I run xp and have a folder called 599330ad54d43e2b8231 and i am not sure where it came from, in the folder there is a text document called %temp%dd_msxml_retMSI.txt in this doc there are things like:

=== Logging started: 11/29/2007 0:49:40 ===
Action start 0:49:40: INSTALL.
Action start 0:49:40: LaunchConditions.
Action ended 0:49:40: LaunchConditions. Return value 1.
Action start 0:49:40: FindRelatedProducts.
Action ended 0:49:40: FindRelatedProducts. Return value 1.
Action start 0:49:40: IsPendingRebootKey.
PendingFileRenameOperations contains:
\??\C:\WINDOWS\system32\usmt\SET6D.tmp~!\??\C:\WINDOWS\system32\usmt\sysmod.dll~\??\C:\WINDOWS\system32\usmt\SET6E.tmp~!\??\C:\WINDOWS\system32\usmt\script.dll~\??\C:\WINDOWS\system32\usmt\SET6F.tmp~!\??\C:\WINDOWS\system32\usmt\migwiz.exe~\??\C:\WINDOWS\system32\usmt\SET70.tmp~!\??\C:\WINDOWS\system32\usmt\migload.exe~\??\C:\WINDOWS\system32\usmt\SET71.tmp~!\??\C:\WINDOWS\system32\usmt\migism.dll~\??\C:\WINDOWS\system32\usmt\SET72.tmp~!\??\C:\WINDOWS\system32\usmt\log.dll~\??\C:\WINDOWS\system32\usmt\SET73.tmp~!\??\C:\WINDOWS\system32\usmt\iconlib.dll~\??\C:\WINDOWS\system32\usmt\SET74.tmp~!\??\C:\WINDOWS\system32\usmt\guitrn.dll~\??\C:\WINDOWS\system32\SETFF.tmp~!\??\C:\WINDOWS\system32\pnrpnsp.dll~\??\C:\WINDOWS\system32\SET100.tmp~!\??\C:\WINDOWS\system32\p2psvc.dll~\??\C:\WINDOWS\system32\SET101.tmp~!\??\C:\WINDOWS\system32\p2pnetsh.dll~\??\C:\WINDOWS\system32\SET102.tmp~!\??\C:\WINDOWS\system32\p2pgraph.dll~\??\C:\WINDOWS\system32\SET103.tmp~!\??\C:\WINDOWS\system32\p2pgasvc.dll~\??\C:\WINDOWS\system32\SET104.tmp~!\??\C:\WINDOWS\system32\p2p.dll~
No file in package listed in PendingFileRenameOperations
Action ended 0:49:41: IsPendingRebootKey. Return value 1.

*Does anyone have any idea what this folder and text doc is and if i need to keep it?
Thank you and appreciate any help on this.

The Windows System32 USMT (User State Migration Tool) folder. This folder contains files to support both USMT and the File and Settings Transfer Wizard. Both tools enable user files and settings to be copied to another PC. You can use this application to transfer files and setting for Internet Explorer, Outlook Express, desktop, display, dial up and other settings via direct cable or network connections. The folder you have hanging around is from an MS Update.

You can download and run Microsoft Baseline Analyzer http://www.microsoft.com/technet/security/tools/mbsahome.mspx to validate the installation of Microsoft updates. This no doubt is a residual folder that should have been deleted after the install of one of the many updates that have been associated with USMT. I believe you can safely delete the folder.

Other folders that have this type of system generated name may have a file named something like msxml4-KB927978-enu.log - this also is a residual folder left around from the installation of MS HotFix KB92978 (MSXML Parser) installation. In any case the log file will contain the name of the HotFix (KBxxxxx) that is being applied.

Member Avatar for regina11

thank you for all the help i think i will just leave it since it isnt hurting anything either way.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.