Originals of deleted/renamed files persist, like zombies

Bump! I can't believe nobody else is having this problem?

===================
I have a number of files I have deleted or renamed but the originals
all come back after going into standby (possible under other
conditions, too). I'm using Vista Home Basic, have UAC turned off and
always run as Administrator. (So, shoot me! I have off-line drive
images and critical file backups). I've Googled the problem to death
but not found this problem described elsewhere.

Any suggestions?

Larry

Hi, Larry.

Perhaps the reason nobody has responded is that you really haven't given us
a thread to start unraveling. :^{

Please tell us - step by step - HOW you are deleting the files. Are you
using Windows Explorer? Or the Del command in a Command Prompt window? Or
are you using the Delete command from inside a program? Which program?
Word? Excel? Photoshop?

And how are you going into standby? And which version of standby: Sleep?
Hibernate?

Give us enough details so that we have a chance to reproduce what you are
seeing. Then we should be able to confirm your observations - or to see
where the process is going off track. Just remember: You can see your
computer. We can't. All we know about it is what you tell us. So far,
that's not much.

No, we won't shoot you for turning off UAC. It's your computer and your
data. Only you know how important it is to you.

RC
--
R. C. White, CPA
San Marcos, TX
rc@xxxxxx
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

"Larry Sabo" <larry_sabo@xxxxxx> wrote in message
news:ccu4j3th9n7h0q74pbfpnsqga7r94d904h@xxxxxx

Thanks for your reply RC. Replies threaded below.

"R. C. White" <rc@xxxxxx> wrote:
I can delete or rename the files using Windows Explorer, MS Word98,
PowerDesk, FreeCommander or Xplore^2; the results are the same. They
appear to be deleted, but when I reboot (not go into standby; sorry
for the misstatement) the original files are all there, and can be
opended. They are building up and causing confusion, so I'd be
grateful to find a solution to this. Thanks for your help.

Larry

Hi, Larry.

Thanks for more details. But I still have questions.
I've not used any of these except Windows Explorer, so I can't comment on
those. I do use Word 2007, but Word98 was a very long time ago and I don't
have any way to check on that.

HOW are you deleting files in Windows Explorer? I know it sounds
elementary, but that's exactly why we need. it. Do you use your keyboard's
Delete key? Or do you right-click on the file name and then click Delete on
the context menu? Do you drag the file to the Recycle Bin? To Rename a
file, do you press <F2>? Or right-click on the filename and click Rename?

Can you give us at least one sample of the filenames? Are you trying to
delete protected files? Either system files, or files that belong to some
other User? Files that you don't have permission to delete or rename? Give
us some samples.

One "I hope not" scenario is that you have a virus or other malware that
re-creates those files/folders each time you reboot. Samples of the
filenames might trigger recognition by someone here of the likely culprits.

Have you run a malware scan? Recently?

RC
--
R. C. White, CPA
San Marcos, TX
rc@xxxxxx
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

"Larry Sabo" <larry_sabo@xxxxxx> wrote in message
news:0p25j39ln1mlj79utjo87hplu83c1p9cu9@xxxxxx

"R. C. White" <rc@xxxxxx> wrote:
I think I've done all of the above, i.e. use various way to rename and
delete files. Usually I use PowerDesk to manage files; I click on the
filename, than click on the Delete icon in its toolbar, which deletes
the file without it going into the recycling bin. I have also used
<shift>+<delete key> so it doesn't go into the recycling bin, and just
the <delete> key. No difference in results.

For renaming, I use both the contect menu, but probably most often I
just click the filename twice (slowly) to select it and ready it for
editing, edit the name, then hit <Enter>. All these things give the
appearance of having worked as they should, until I reboot.

I will try using the command console to delete the files and see if
the results are different. That's the only method I haven't tried so
far.
Here are files that I deleted from the "Next Issue" folder, but which
re-appeared after re-booting...

0711 Bark.doc
Artists Corner by <redacted>.doc
ArtthxO7.wpd
Dear fellow community members.wpd
New Speeding Fines for Florida.doc
New Traffic Fines Now in Effed in Florida.rtf
pinemeadows.doc
Presidents Comments.doc
Social Events and Quizzes.doc

As you can imagine, trying to prepare the next issue of the newsletter
for our community association is made difficult by the presence of
material already included in a prior issue then "deleted."
I use Kaspersky version 7.0 and have a great deal of confidence in it.
Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.

Thanks for your continued assistance.

Larry

Larry Sabo <larry_sabo@xxxxxx> wrote:
Ok, just did this, shut down and rebooted. Everything is still there!
As I deleted the files in the command console, they disappeared from
the file browser I could see outside the console window. I checked
with both PowerDesk and Windows Explorer (to be sure I wasn't seeing
an apparition of PowerDesk's cache, even though I hit F5 to refresh
the display) and all the files are still there.

Larry

Larry Sabo <larry_sabo@xxxxxx> wrote:
Ok, I booted a BartPE (UBCD4Win) and deleted the problematic files and
folders, then rebooted into Windows. They are finally GONE! Next time,
I'll try the command console from the boot menu (versus after Windows
shell starts) and see if it works.

Larry

Larry Sabo <larry_sabo@xxxxxx> wrote:
Sorry to be nattering on to myself like this, but here is more info.
The files and folders I deleted using BartPE ARE BACK! I thought they
were all gone, but I subsequently booted to Safe Mode Command Prompt
and deleted another folder, to see if that also works. On rebooting to
normal mode, it seemed to work, then a few seconds later, it, and all
the other deleted files and folders re-appeared! I opened a couple of
the file and verified, the original material is there.

Sure looks like a System restore problem at this point. I will have to
create a fresh image, turn off System restore (if I can in Vista) then
go through a few tests. That will take some time, so I'll report back
in a day or so, if not sooner.

************* IS ANYBODY FROM MICROSOFT HOME? **************

Larry

Larry Sabo wrote:
Hi - I've been reading your posts out of curiosity and in this long
thread, I don't see where you answered R. C.'s question about exactly
*what* files are returning and whether you've done any scanning for
malware. Of course, I might have missed it so please refresh my aged
memory if you already gave those details. The only time I've seen this
behavior - and I've seen it many, many times - is when a computer is
infected with malware that respawns.

So those two questions really do need to be answered next. Give a few
examples of the reappearing files and tell us the virus/malware status
of the machine. If you think the computer is clean, please tell us what
programs (and versions) you used to determine this.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Malke <notreally@xxxxxx> wrote: