Windows 7, cardspace mystery

[kdock]

On March 1, my husband started having issues with his backup program -- it continually reported that two files did not exist. These files are in a folder named "CardSpace" and the files appear to be hidden. The date on the folder is ... March 1st.

I've googled and this seems to be part of .NET framework 3.5. To remove the folder, one simply uninstalls the framework. Unfortunately, there are no .NET installations listed in his Programs and Features list. Hence, the mystery.

I have turned off and disabled the service associated with CardSpace (an abandoned Microsoft feature -- thanks so much MSoft...). But where did this come from? Is it likely to be a malware attack of some sort? My husband is extremely careful while on-line and this seems unlikely, but...

Any light to shed? And how to remove without having the framework to uninstall?

Thanks! Kim

[viking33]

Have you checked this Black Viper site regarding Cardspace?

http://www.blackviper.com/windows-servi ... ce_Names_2" onclick="window.open(this.href);return false;

[kdock]

Thanks Bob,

Thanks for this link, but I'm not sure what to make of the info. My husband does, indeed have Win 7 Pro, but why did this suddenly become an issue on March 1, at least 9 months after starting to use his laptop? And my PC (Win 7 Pro) and my laptop (Win 7 Ultimate) do not have the CardSpace folder.

When I disabled the service, it was set to manual, but it was running. I can't tell what could possibly have started it. I'm still concerned that something is going on that we didn't intend.

Thanks, Kim

[viking33]

Thanks Bob,

Thanks for this link, but I'm not sure what to make of the info. My husband does, indeed have Win 7 Pro, but why did this suddenly become an issue on March 1, at least 9 months after starting to use his laptop? And my PC (Win 7 Pro) and my laptop (Win 7 Ultimate) do not have the CardSpace folder.

When I disabled the service, it was set to manual, but it was running. I can't tell what could possibly have started it. I'm still concerned that something is going on that we didn't intend.

Thanks, Kim

When you disable the service, you can also stop the service. There should have been a "stop" button over on the left side of the screen.

If you right click on that service, then Properties, it will bring up a screen with a tab named "dependencies." where it will check for any other services that depend on that one and vice-versa.

[kdock]

Ah. I did stop the service (though I used the highly technical term "turned off"). I will look at the dependencies.

Thanks! Kim

[kdock]

Update:

No dependencies.

I also looked in services on my own PC, and CardSpace is there, too -- disabled. I don't have the CardSpace folder, even if I turn on view hidden system files.

So I'm back to the original mystery -- Why is it there and what caused it to start?

[HansV]

Could your husband have been playing around in the Control Panel - I assume that selecting options in the Windows Cardspace control panel may start the corresponding service.
Otherwise, it's a real mystery!

[kdock]

Hi Hans,

I asked, he says no. He's not an experimenter, so I believe him. He would have asked me about CardSpace first, I think, rather than just opening the dialog. And the info that comes up when you hover over Windows CardSpace would turn him off. He believes in entering his info from scratch, every time.

In trying to get to the bottom of why the folder appeared, I did open the CardSpace dialog (searched from the Start Menu, though). There are no cards.

It's more than mysterious, it's unnerving. If he's not using it for anything (and it's now disabled), is there a way to remove it? I can't just delete the folder -- the files are system files and locked up tight. There's no program to uninstall...

Yikes, Kim

[HansV]

I don't think you can uninstall Windows Cardspace by itself - it's part of the .NET Framework, but I would strongly recommend NOT uninstalling that.

[kdock]

Well, you're undoubtedly right and so be it. But I really want to know how his CardSpace got activated!

Thanks again, Kim

[JoeP]

See this Microsoft information - Windows Cardspace. You can make a couple of guesses from the information there.

Joe

[Argus]

Well, you're undoubtedly right and so be it. But I really want to know how his CardSpace got activated!

A quick and dirty way of finding out what has been going on can be to use Search (for example in Windows Explorer) for changed files at a specific date (or between two dates). It can often provide some clues what was done, installed, changed etc. Of course, it's easier if close in time. One can also check the browser's history, if it's saved.

I had look at a XP system that got .NET Framework 3.0/3.5 installed some months ago; a couple of days after the installation there is a CardSpace folder in the non-roaming part of the user profile, i.e. Local Settings. I can only assume that I clicked on the Windows CardSpace Control Panel applet out of curiosity. More seriously, I know I have done so, but don’t remember which date.

It's hidden, but not "super-hidden", as you have noticed; however it has an "odd" owner to be in the user profile, NT AUTHORITY\NETWORK SERVICE (on an English system I assume), i.e. the Network Service Account, at least on Windows XP; one of the built-in accounts with fewer privileges than the System account and geared towards network access. It might have changed in Windows 7, I think, but the principle is the same.

My curiosity got me to try to delete the folder (remember this on a Windows XP PC), from inside the Explorer, move it to the Recycle Bin, though I knew it wouldn't be that simple; I got the usual dialogue, then after some seconds the dialogue disappeared, the result: no folder in the Recycle Bin, the folder is still there in the profile, but one of the files has gone missing. That's a new one (but then again, I usually don't delete things at random). "I'm sorry Argus, I'm afraid I can't do that, but I'll delete a random file in the folder instead."

Anyhow, back to the CP, ran the Windows CardSpace applet, closed it, and I had my little database (containing no cards) created once again with today's date (and the db.shadow reserve storage file, created at the same time as the folder and the original database file, got updated).

Finally, on a Windows 7 system, where I do know that I have not run the CP applet there was no CardSpace folder in the profile (C:\Users\<Username>\AppData\Local\Microsoft), but I just ran the CP applet and a CardSpace folder was created.

To conclude; as has been mentioned it is part of the .NET framework; the .NET framework is integrated in Windows 7; it's easy to stop the service and set it to manual, if it's running; if no cards have been created, not much there, is there?

[kdock]

I have now asked my husband if he might have accidentally opened the Windows CardSpace applet in CP. He says that he didn't even know there was a CardSpace icon in CP, but that he indeed might have done that, and simply closed it when confronted with an unfamiliar (and pretty much empty) dialog. As reported previously, there are no cards in it.

I am convinced now that no shenanigans have taken place, even on the part of my husband. Thank you Argus for clicking where I was loathe to click myself.

As for his backup program balking at the non-existent files in the folder, I've unchecked that folder from backing up. Thanks to all for your advice and links!

Best, Kim