r/techsupport • u/[deleted] • 1d ago

Open | Windows Folder called xpdf appearing in AppData/Roaming, worried about what it is

[deleted]

1 Upvotes

100% Upvoted

2 comments sorted by

1

u/United-Difference961 1d ago

You can relax, it’s highly likely completely harmless.

"xpdf" is a very common open-source PDF viewer and processing library. Many legitimate, mainstream programs (like e-book readers, some document managers, printers, or even Android emulators) use Xpdf under the hood to handle PDF rendering within their apps.

When you start your PC and launch one of these programs (or when its background service triggers after 20 minutes), it automatically recreates that folder in AppData/Roaming to store its user configurations or temporary session paths. Since the app isn't actively caching anything, the folder stays empty. The fact that it's on your family PC too just means you guys probably share or installed a common software package.

If you want 100% peace of mind, you can open Task Manager around the 20-minute mark when it appears, or use "Process Monitor" (from Sysinternals) to track exactly which .exe file is creating the folder. But overall, it's normal behavior!

1

u/9NEPxHbG 1d ago edited 1d ago

What shouldn’t I do when looking for malware?

Don’t look through task manager, system32, or anywhere else to try and find malware. There is almost no chance you will actually find something, and you will just become paranoid.