W7: Files only visible via "Save As"

[The late XV105]

W7 Professional.

I helped a friend out today who was absolutely sure that they had downloaded some files they wanted from the web, but couldn't find them. W7 search returned 'owt even though the indexing all appeared good, so I started thinking out of the box; I had the idea that maybe they had downloaded to a "protected" folder that W7 would try to safeguard the contents of, so amongst other places I took a look in System32 using Windows Explorer. I found nothing even though all "hide" options were removed.

However... when trying to replicate what they had perhaps done, I found that their files WERE in the System32 folder but only visible in the Save As dialogue from the web browser (Chrome, though I don't think this is relevant).

My recovery method was to delete them via the Save as dialogue, open the Recycle Bin, and then Cut and Paste them from there to somewhere sensible.

This implies to me that my "protected folder" thinking was along the right lines and that perhaps there is a virtual folder where I could also have found the files?

I'm interested to learn!


Cheers,
TLXV

[hellsbrink]

That ain't a W7 "issue", that's the way that your friend has set things up (probably by accident) as it sure don't do that on my W7 setup when I use SWRIron (Chrome without the google crap), IE or Firefox..........



Oh, there is another way. Your friend has maybe opted to "run" or "open" something he has downloaded instead of actually saving it which means it will go into a weird temp folder instead of actually being saved properly.

Either way, your friend is the issue.

[green granite]

Indeed nothing to do with W7 In Chrome go to tools>options>under the bonnet and set the required location that he wants to downloads to go to.
In the 'save as' situation press upon him that he MUST set the folder he wants to save them in, not just accept the default.

[BOAC]

into a weird temp folder instead of actually being saved properly. - still does not answer XV's question as to why he could not 'see' the files?.

I must admit I have wrestled interminably with W7 to get access to files on my XP setup and after numerous goes at permissions and security, all of which failed, suddenly I got access. Just wish I knew how. It is a real pain when you want to work under the bonnet.:confused:

[hellsbrink]

It does explain things if the friend chose "open" instead of "save"

[BOAC]

My recovery method was to delete them via the Save as dialogue, open the Recycle Bin, and then Cut and Paste them from there to somewhere sensible. - does this not indicate that they 'exist' and should be findable?

[The late XV105]

Thanks BOAC. You're the only one on the track. :)

Chrome (and IE and Firefox for that matter) are all set up to download to the Downloads folder for the User in question. They manually saved to another folder but in a rush, screwed up.

My question is why files that actually exist do not display.

Try this:


Start a web browser
Open a web page
Click on a picture
Make a note of the file name or chose one of your own
Right Mouse Button "Save as" and save it to the System32 folder
Start Windows Explorer
Ensure all attribute to hide any files, system or not, are disabled (i.e. everything is visible)
Open the System32 folder
Observe that you cannot see the file you just saved
Now open a web browser again
Click on any photo and press "Save As"
Observe that in the "Save As" dialogue you CAN see you previously saved file


Cutting and Pasting to a new location from here (ie in the "Save As" dialogue) results in "The file does not exist. It may have been deleted". Yet you can see it...

Deleting the file (which moves it to the Recycyle Bin), opening the bin, and then cutting and pasting it to a new location works just fine. The file exists.

Explain please.
No lessons about Users; that's not what the post is about. :ok:

TVM,
TLXV

[hellsbrink]

My win7 doesn't allow that to be done, it tells me I do not have permissions to save to the system32 folder and offers to save the piccie to "My Pictures" instead.

Do the same with a "torrent" file, it tells me I do not have permission to save and offers to save the file to another folder.

Do the same with an executable file, it tells me I do not have permission to save and offers to save it to another folder instead.

Do the same with a pdf, I get "access denied".

In other words, I cannot download ANYTHING to the system32 folder despite running as admin, so I cannot understand how your friend managed it on Win7

[The late XV105]

Thanks, hellsbrink. That's interesting. I just replicated the observations on my own W7 installation (Fully Windows-updated W7 Professional SP1 64-bit, for the record) but can't find a set-up option to control it.

My friend's computer was logged-on as Administrator, so I logged off as my normal user and back on as Administrator too in order to replicate it.

[green granite]

In the 'save as window' click on organise and then properties, in the 'general' tab there a box which if ticked will hide the folder, Then select the 'location' tab and see where the location is set to, I can from there set the location to a folder in sys 32 (W7 pro)

[BOAC]

I don't think I understand the problem you ?guys? are having. As 'admin' I have full access to System32 and can save what I like in there - otherwise I would not be a 'full admin', now, would I!

XV - I can see the saved file with no fudging too.

W7 Pro

[The late XV105]

The Userids in question on both computers are confirmed as full Administrators.

Anyway, the plot narrows down a tad.

I now know that it is only files saved in System32 via a web browser that behave as described. Files saved via Windows Explorer remain fully visible at all times.

Both computers are using Symantec Endpoint antivirus v11 so I'll have a poke around in here looking for web protection settings that might be doing it. If they are, I'll probably leave them set once I have proven the cause - It's just that having seen the interesting behaviour, I want to know what causes it.

[green granite]

What web browser is he using? The 'save as' engines in Firefox and Chrome are different to the one in IE, My earlier comments about properties referred to FireFox/Chrome.

[The late XV105]

What web browser is he using?

Chrome, GG, and so have I been using Chrome to replicate the problem, but the settings you mentioned are a kipper rouge unfortunately; the "hidden" option is disabled and the "location" is the C: \User\Download folder - which remains empty when something is saved in System32, exactly as is implied should happen from the fact that if the Chrome "Save As" dialogue is re-opened and pointed at System 32, the recently saved file can be seen - but not via Windows Explorer.

Use IE9 (the other browser on my own computer) and the same observations hold true.

Add what I wrote earlier - that saving to System 32 via Windows Explorer works fine whereas web browsers don't - and it really does seem to be something trying to protect the PC from web nasties. It's not Symantec Endpoint though; temporarily disabling it had no effect.

[BOAC]

works fine whereas web browsers don't -FF (6) does. I have not tried IE.

[green granite]

A thought occurs to me, first of all I was trying to work out why would anything save to sys32 as a default rather than the normal default of user\downloads and also hide it's self, this would be the place where a virus/trojan would want to be so I suggest he does a scan with malwarebytes and super anti-spyware followed by a scan with his virus checker just in case

[The late XV105]

Already scanned, thanks, GG. Nothing found.

From what I've been told I'm pretty sure that the System 32 directory was used because of human mistake under pressure, rushing to finish something before the Nth time of being called to the dinner table - when it would have been better to wait. Most of us have been there, so I sympathise! My money is on clicking on the wrong part of the breadcrumb at the top of the Save As dialogue and pressing "Save".

Anyway; back to the thread; I still can't work out what the trigger is. I now know though that my company laptop (W7 Enterprise 64bit) and both my and my friend's home PC (both W7 Professional 64bit) all behave the same weird way.

[The late XV105]

Although I am not using Total Commander, this (http://www.ghisler.ch/wiki/index.php/On_64-bit_Windows_versions,_some_files_and_folders_shown_by_Window s_Explorer_are_not_shown_by_Total_Commander!) thread held the answer to my question.

My original thought about a "virtual" folder isn't far from the truth:

On a Windows 64-bit operating system (which the three installations of W7 used in investigations all are), any request by a 32-bit application (which the web browsers in use all are) to save a file in System32 will instead be invisibly redirected to SysWOW64. The file will still appear to be in System32 when queried by a 32 bit application, but in fact it isn't there; it's in SysWOW64. In relational database terms, the 32-bit application is behaving as if querying a view that joins two tables rather than directly acting on an underlying table or tables.

Sure enough, if I open C: \Windows\SysWOW64 using Windows Explorer (which is 64-bit of course on a 64-bit version of Windows), I see the files even though they were saved to C: \Windows\System 32.

[green granite]

Interestingly I was playing about with the W7 snipping tool earlier to answer a query, now normally I just right click the snipped image and paste it into Irfanview to re-size it etc and then save it from there, but tonight I right clicked on the image and clicked on 'save as' and it wanted to save it in sys32. It was easy enough to change the target folder but for the unwary not so good. I presume it's because the snipping tool exe is located in that folder.

Good bit of detective work by the way,

[M.Mouse]

I am glad there are others like me who are like a dog with a bone when confronted with a strange problem.

Interesting W7 behaviour.

[The late XV105]

Thank you Both.

"Dog" and "Bone" is actually an understatement when I get stuck in to something! :)

[The late XV105]

Postscript:

Despite my friend's certain belief that they mistyped the location they wanted to save in and four separate malware tools (Symantec Endpoint, malwarebytes, super anti-spyware, and Ad-aware) all indicating a clean system, I'm now not so sure, green granite.

Today came the observation that Symantec's Network Threat Protection was disabled and wouldn't re-enable. The message given was "signature files out of date". Indeed they were, which was odd as the machine is set up to use Live Update. A manual Live Update failed to reach Symantec though, which wasn't correct as my laptop reached the Live Update address perfectly when I tried in parallel. I directed Matey to the hosts file but nothing dodgy was in there to cause a redirect or a block. Hmmmm.

Pondering about this, I received a call to say that Symantec AV tamper protection had just been triggered whilst the machine was unattended.

"Enough" cried I, and directed how to restore to the system image that was taken a week ago. Success. Easy peasy, and all is now cushty again. Thank heavens that at least some of my friends listen to advice (take a regular system image, in this case) and hopefully I now have an evangelist to help promote the worth of this to others! :)

[green granite]

Well done, what concerned me was the apparent inability to change the target location

Despite my friend's certain belief that they mistyped the location they wanted to save in

Why type the location? It's much quicker and less prone to a typo to click on the desired location in the bit on the left hand side of the 'save as' window.

[The late XV105]

To be really correct; they clicked the breadcrumbs at the top of the Save As dialogue to choose the folder - or so they thought - and then over-typed the file name with what they wanted to use.

[green granite]

Ah! ok understood. :ok: