1

I recently redirected my C:\Users\Me\Appdata\Roaming folder to my e: drive (where many other folders from my profile have been redirected to for years). This way, if/when I restore an image to c:, my programs' settings can be unaffected, just as my data has been.

My question is, do many malwares infect the C:\Users\Me\Appdata\Roaming folder?

Improve this question

1 Answer 1

Reset to default
2

No more than your other user-folders. The Roaming folder is copied to the server when you log off of a networked computer, but otherwise its used the same as your other user-folders (ie AppData\Local). As such, the folder itself won’t usually contain files, but rather program-specific folders that contain files (again, usually). If you get an infection that can infect your local folder, then it can also infect your roaming folder and vice versa, depending on what it was programmed to do. Granted, some worms may specifically target the roaming folder to hitch a ride to the server, but once there, unless they are designed to specifically take advantage of a vulnerability on that server, they aren’t any really better off since permissions prevent it from accessing other files or other user’s files from accessing it.

Do you want specific statistics and numbers on the ratio of malware that targets the roaming folder? I don’t recall ever having seen such a figure specifically published, but it should be simple enough to scour any given malware-database (or other sites that analyse changes made by a file), searching for the strings AppData\Roaming to find ones that made changes to that folder.

Improve this answer
3
  • Nicely put. I'll add my anecdotal findings, in our environment we find that most malware actually ends up in the users's AppData\Local directory rather than the AppData\Roaming.
    – edusysadmin
    Commented Mar 6, 2011 at 12:35
  • You said, "nicely put", but your anecdotal findings differ from his (he said the \roaming folder is equally as likely as the \local folder to get infected). Right? (Recall I was asking how likely it is for the \roaming folder to get infected. So, for the purpose of my question, your answer is very different from his.)
    – CChriss
    Commented Mar 18, 2011 at 1:20
  • Well if one can get infected, then so can the other, however the actual distribution depends on the viruses. It could simply be that older viruses targeted the more common local directory (which is used by systems that are not on a domain controller), while more recent writers have decided to target the server instead because it gives them better access to networks in Universities and businesses (after all, virus writers have evolved from pranksters and braggers to organized, profit-motivated criminals and their viruses have evolved from in-your face “gotcha” messages to hidden rootkits).
    – Synetech
    Commented Mar 18, 2011 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .