Originals of deleted/renamed files persist, like zombies

[Larry Sabo]

Bump! I can't believe nobody else is having this problem?

===================
I have a number of files I have deleted or renamed but the originals
all come back after going into standby (possible under other
conditions, too). I'm using Vista Home Basic, have UAC turned off and
always run as Administrator. (So, shoot me! I have off-line drive
images and critical file backups). I've Googled the problem to death
but not found this problem described elsewhere.

Any suggestions?

Larry

 

[R. C. White]

Hi, Larry.

Perhaps the reason nobody has responded is that you really haven't given us
a thread to start unraveling. :^{

Please tell us - step by step - HOW you are deleting the files. Are you
using Windows Explorer? Or the Del command in a Command Prompt window? Or
are you using the Delete command from inside a program? Which program?
Word? Excel? Photoshop?

And how are you going into standby? And which version of standby: Sleep?
Hibernate?

Give us enough details so that we have a chance to reproduce what you are
seeing. Then we should be able to confirm your observations - or to see
where the process is going off track. Just remember: You can see your
computer. We can't. All we know about it is what you tell us. So far,
that's not much.

No, we won't shoot you for turning off UAC. It's your computer and your
data. Only you know how important it is to you.

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

 

[Larry Sabo]

Thanks for your reply RC. Replies threaded below.

Hi, Larry.

Perhaps the reason nobody has responded is that you really haven't given us
a thread to start unraveling. :^{

Please tell us - step by step - HOW you are deleting the files. Are you
using Windows Explorer? Or the Del command in a Command Prompt window? Or
are you using the Delete command from inside a program? Which program?
Word? Excel? Photoshop?

I can delete or rename the files using Windows Explorer, MS Word98,
PowerDesk, FreeCommander or Xplore^2; the results are the same. They
appear to be deleted, but when I reboot (not go into standby; sorry
for the misstatement) the original files are all there, and can be
opended. They are building up and causing confusion, so I'd be
grateful to find a solution to this. Thanks for your help.

Larry

 

[R. C. White]

Hi, Larry.

Thanks for more details. But I still have questions.

I can delete or rename the files using Windows Explorer, MS Word98,
PowerDesk, FreeCommander or Xplore^2; the results are the same.

I've not used any of these except Windows Explorer, so I can't comment on
those. I do use Word 2007, but Word98 was a very long time ago and I don't
have any way to check on that.

HOW are you deleting files in Windows Explorer? I know it sounds
elementary, but that's exactly why we need. it. Do you use your keyboard's
Delete key? Or do you right-click on the file name and then click Delete on
the context menu? Do you drag the file to the Recycle Bin? To Rename a
file, do you press <F2>? Or right-click on the filename and click Rename?

Can you give us at least one sample of the filenames? Are you trying to
delete protected files? Either system files, or files that belong to some
other User? Files that you don't have permission to delete or rename? Give
us some samples.

One "I hope not" scenario is that you have a virus or other malware that
re-creates those files/folders each time you reboot. Samples of the
filenames might trigger recognition by someone here of the likely culprits.

Have you run a malware scan? Recently?

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

 

[Larry Sabo]

Hi, Larry.

Thanks for more details. But I still have questions.


I've not used any of these except Windows Explorer, so I can't comment on
those. I do use Word 2007, but Word98 was a very long time ago and I don't
have any way to check on that.

HOW are you deleting files in Windows Explorer? I know it sounds
elementary, but that's exactly why we need. it. Do you use your keyboard's
Delete key? Or do you right-click on the file name and then click Delete on
the context menu? Do you drag the file to the Recycle Bin? To Rename a
file, do you press <F2>? Or right-click on the filename and click Rename?

I think I've done all of the above, i.e. use various way to rename and
delete files. Usually I use PowerDesk to manage files; I click on the
filename, than click on the Delete icon in its toolbar, which deletes
the file without it going into the recycling bin. I have also used
<shift>+<delete key> so it doesn't go into the recycling bin, and just
the <delete> key. No difference in results.

For renaming, I use both the contect menu, but probably most often I
just click the filename twice (slowly) to select it and ready it for
editing, edit the name, then hit <Enter>. All these things give the
appearance of having worked as they should, until I reboot.

I will try using the command console to delete the files and see if
the results are different. That's the only method I haven't tried so
far.

Can you give us at least one sample of the filenames? Are you trying to
delete protected files? Either system files, or files that belong to some
other User? Files that you don't have permission to delete or rename? Give
us some samples.

Here are files that I deleted from the "Next Issue" folder, but which
re-appeared after re-booting...

0711 Bark.doc
Artists Corner by <redacted>.doc
ArtthxO7.wpd
Dear fellow community members.wpd
New Speeding Fines for Florida.doc
New Traffic Fines Now in Effed in Florida.rtf
pinemeadows.doc
Presidents Comments.doc
Social Events and Quizzes.doc

As you can imagine, trying to prepare the next issue of the newsletter
for our community association is made difficult by the presence of
material already included in a prior issue then "deleted."

One "I hope not" scenario is that you have a virus or other malware that
re-creates those files/folders each time you reboot. Samples of the
filenames might trigger recognition by someone here of the likely culprits.

I use Kaspersky version 7.0 and have a great deal of confidence in it.

Have you run a malware scan? Recently?

Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.

Thanks for your continued assistance.

Larry

 

[Larry Sabo]

I will try using the command console to delete the files and see if
the results are different. That's the only method I haven't tried so
far.

Ok, just did this, shut down and rebooted. Everything is still there!
As I deleted the files in the command console, they disappeared from
the file browser I could see outside the console window. I checked
with both PowerDesk and Windows Explorer (to be sure I wasn't seeing
an apparition of PowerDesk's cache, even though I hit F5 to refresh
the display) and all the files are still there.

Larry

 

[Larry Sabo]

Ok, just did this, shut down and rebooted. Everything is still there!
As I deleted the files in the command console, they disappeared from
the file browser I could see outside the console window. I checked
with both PowerDesk and Windows Explorer (to be sure I wasn't seeing
an apparition of PowerDesk's cache, even though I hit F5 to refresh
the display) and all the files are still there.

Larry

Ok, I booted a BartPE (UBCD4Win) and deleted the problematic files and
folders, then rebooted into Windows. They are finally GONE! Next time,
I'll try the command console from the boot menu (versus after Windows
shell starts) and see if it works.

Larry

 

[Larry Sabo]

Ok, I booted a BartPE (UBCD4Win) and deleted the problematic files and
folders, then rebooted into Windows. They are finally GONE! Next time,
I'll try the command console from the boot menu (versus after Windows
shell starts) and see if it works.

Larry

Sorry to be nattering on to myself like this, but here is more info.
The files and folders I deleted using BartPE ARE BACK! I thought they
were all gone, but I subsequently booted to Safe Mode Command Prompt
and deleted another folder, to see if that also works. On rebooting to
normal mode, it seemed to work, then a few seconds later, it, and all
the other deleted files and folders re-appeared! I opened a couple of
the file and verified, the original material is there.

Sure looks like a System restore problem at this point. I will have to
create a fresh image, turn off System restore (if I can in Vista) then
go through a few tests. That will take some time, so I'll report back
in a day or so, if not sooner.

************* IS ANYBODY FROM MICROSOFT HOME? **************

Larry

 

[Malke]

Sorry to be nattering on to myself like this, but here is more info.
The files and folders I deleted using BartPE ARE BACK! I thought they
were all gone, but I subsequently booted to Safe Mode Command Prompt
and deleted another folder, to see if that also works. On rebooting to
normal mode, it seemed to work, then a few seconds later, it, and all
the other deleted files and folders re-appeared! I opened a couple of
the file and verified, the original material is there.

Sure looks like a System restore problem at this point. I will have to
create a fresh image, turn off System restore (if I can in Vista) then
go through a few tests. That will take some time, so I'll report back
in a day or so, if not sooner.

Hi - I've been reading your posts out of curiosity and in this long
thread, I don't see where you answered R. C.'s question about exactly
*what* files are returning and whether you've done any scanning for
malware. Of course, I might have missed it so please refresh my aged
memory if you already gave those details. The only time I've seen this
behavior - and I've seen it many, many times - is when a computer is
infected with malware that respawns.

So those two questions really do need to be answered next. Give a few
examples of the reappearing files and tell us the virus/malware status
of the machine. If you think the computer is clean, please tell us what
programs (and versions) you used to determine this.


Malke

 

[Larry Sabo]

Hi - I've been reading your posts out of curiosity and in this long
thread, I don't see where you answered R. C.'s question about exactly
*what* files are returning and whether you've done any scanning for
malware. Of course, I might have missed it so please refresh my aged
memory if you already gave those details. The only time I've seen this
behavior - and I've seen it many, many times - is when a computer is
infected with malware that respawns.

So those two questions really do need to be answered next. Give a few
examples of the reappearing files and tell us the virus/malware status
of the machine. If you think the computer is clean, please tell us what
programs (and versions) you used to determine this.


Malke

Malke, thanks for your reading about my problme, and suggestion. My
reply regarding what files were deleted was in
<[email protected]>.

Larry

 

[R. C. White]

Hi, Malke.

Thanks for jumping in! I know you have a lot more experience in this kind
of problem than I do.

Larry did answer my two questions yesterday. His post was at "Date: Thu, 08
Nov 2007 20:51:17 -0500", per the headers. Perhaps your message and his
"crossed in the mail".

But the filenames don't ring any bells with me, and he said he runs
Kaspersky, so I still don't have much of a clue as to what the problem is.

The only time I've seen this behavior - and I've seen it many, many
times - is when a computer is infected with malware that respawns.

I've never seen this, but then I only work on my own computer and, luckily,
have never had any significant malware. But I know that you and many other
MVPs deal with such problems regularly.

Just in case Larry's "missing" post has scrolled out of your reach, I'll
paste the whole thing, including my quoted questions, after my Sig.

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)


<paste>

Hi, Larry.

Thanks for more details. But I still have questions.


I've not used any of these except Windows Explorer, so I can't comment on
those. I do use Word 2007, but Word98 was a very long time ago and I don't
have any way to check on that.

HOW are you deleting files in Windows Explorer? I know it sounds
elementary, but that's exactly why we need. it. Do you use your keyboard's
Delete key? Or do you right-click on the file name and then click Delete
on the context menu? Do you drag the file to the Recycle Bin? To Rename a
file, do you press <F2>? Or right-click on the filename and click Rename?

I think I've done all of the above, i.e. use various way to rename and
delete files. Usually I use PowerDesk to manage files; I click on the
filename, than click on the Delete icon in its toolbar, which deletes
the file without it going into the recycling bin. I have also used
<shift>+<delete key> so it doesn't go into the recycling bin, and just
the <delete> key. No difference in results.

For renaming, I use both the contect menu, but probably most often I
just click the filename twice (slowly) to select it and ready it for
editing, edit the name, then hit <Enter>. All these things give the
appearance of having worked as they should, until I reboot.

I will try using the command console to delete the files and see if
the results are different. That's the only method I haven't tried so
far.

Can you give us at least one sample of the filenames? Are you trying to
delete protected files? Either system files, or files that belong to some
other User? Files that you don't have permission to delete or rename?
Give us some samples.

Here are files that I deleted from the "Next Issue" folder, but which
re-appeared after re-booting...

0711 Bark.doc
Artists Corner by <redacted>.doc
ArtthxO7.wpd
Dear fellow community members.wpd
New Speeding Fines for Florida.doc
New Traffic Fines Now in Effed in Florida.rtf
pinemeadows.doc
Presidents Comments.doc
Social Events and Quizzes.doc

As you can imagine, trying to prepare the next issue of the newsletter
for our community association is made difficult by the presence of
material already included in a prior issue then "deleted."

One "I hope not" scenario is that you have a virus or other malware that
re-creates those files/folders each time you reboot. Samples of the
filenames might trigger recognition by someone here of the likely culprits.

I use Kaspersky version 7.0 and have a great deal of confidence in it.

Have you run a malware scan? Recently?

Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.

Thanks for your continued assistance.

Larry
</paste>

 

[Malke]

Malke, thanks for your reading about my problme, and suggestion. My
reply regarding what files were deleted was in
<[email protected]>.

I'm sorry but clicking on that link simply opens an email mailto. Could
you please just summarize your reply, including the virus/malware bit?

Thanks,


Malke

 

[Larry Sabo]

I'm sorry but clicking on that link simply opens an email mailto. Could
you please just summarize your reply, including the virus/malware bit?

Thanks,


Malke

Sorry Malke; here is an extract of what I replied...

HOW are you deleting files in Windows Explorer? I know it sounds
elementary, but that's exactly why we need. it. Do you use your keyboard's
Delete key? Or do you right-click on the file name and then click Delete on
the context menu? Do you drag the file to the Recycle Bin? To Rename a
file, do you press <F2>? Or right-click on the filename and click Rename?

I think I've done all of the above, i.e. use various way to rename and
delete files. Usually I use PowerDesk to manage files; I click on the
filename, than click on the Delete icon in its toolbar, which deletes
the file without it going into the recycling bin. I have also used
<shift>+<delete key> so it doesn't go into the recycling bin, and just
the <delete> key. No difference in results.

For renaming, I use both the contect menu, but probably most often I
just click the filename twice (slowly) to select it and ready it for
editing, edit the name, then hit <Enter>. All these things give the
appearance of having worked as they should, until I reboot.

I will try using the command console to delete the files and see if
the results are different. That's the only method I haven't tried so
far.

Can you give us at least one sample of the filenames? Are you trying to
delete protected files? Either system files, or files that belong to some
other User? Files that you don't have permission to delete or rename? Give
us some samples.

Here are files that I deleted from the "Next Issue" folder, but which
re-appeared after re-booting...

0711 Bark.doc
Artists Corner by <redacted>.doc
ArtthxO7.wpd
Dear fellow community members.wpd
New Speeding Fines for Florida.doc
New Traffic Fines Now in Effed in Florida.rtf
pinemeadows.doc
Presidents Comments.doc
Social Events and Quizzes.doc

As you can imagine, trying to prepare the next issue of the newsletter
for our community association is made difficult by the presence of
material already included in a prior issue then "deleted."

One "I hope not" scenario is that you have a virus or other malware that
re-creates those files/folders each time you reboot. Samples of the
filenames might trigger recognition by someone here of the likely culprits.

I use Kaspersky version 7.0 and have a great deal of confidence in it.

Have you run a malware scan? Recently?

Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.
===================== </quote> =====================

 

[Malke]

Sorry Malke; here is an extract of what I replied...

(my snippage)

Here are files that I deleted from the "Next Issue" folder, but which
re-appeared after re-booting...

0711 Bark.doc
Artists Corner by <redacted>.doc
ArtthxO7.wpd
Dear fellow community members.wpd
New Speeding Fines for Florida.doc
New Traffic Fines Now in Effed in Florida.rtf
pinemeadows.doc
Presidents Comments.doc
Social Events and Quizzes.doc

Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.

Thank you so much, Larry. The files certainly seem like normal,
non-malware files. And while it doesn't catch some non-viral malware, I
do like Kaspersky. While of course I can't see your computer, this
doesn't seem like malware-related activity.

I must admit to being stumped. It does sound like something is running
that is replacing those files, something like a Norton Ghost or the
like. I have not seen anything like what you are experiencing on my
Vista box and I can certainly understand that you are frustrated. The
only other thing I can suggest is that you try a clean boot so that
nothing else is running and see if you can delete the files permanently
then (you will probably do two clean boots, booting back into one after
you restart the machine after deleting the files). That would rule out
any third-party programs protecting that directory.

How to perform a clean boot in Vista and XP -
http://support.microsoft.com/kb/331796


Malke

 

[Larry Sabo]

[snip]

Thank you so much, Larry. The files certainly seem like normal,
non-malware files. And while it doesn't catch some non-viral malware, I
do like Kaspersky. While of course I can't see your computer, this
doesn't seem like malware-related activity.

I must admit to being stumped. It does sound like something is running
that is replacing those files, something like a Norton Ghost or the
like. I have not seen anything like what you are experiencing on my
Vista box and I can certainly understand that you are frustrated. The
only other thing I can suggest is that you try a clean boot so that
nothing else is running and see if you can delete the files permanently
then (you will probably do two clean boots, booting back into one after
you restart the machine after deleting the files). That would rule out
any third-party programs protecting that directory.

How to perform a clean boot in Vista and XP -
http://support.microsoft.com/kb/331796


Malke

The problem is solved, and I am embarrassed to reveal the cause. I
have Synchback SE set to periodically mirror a number of directories
and files between drives, including the directory containing the files
and folders that refused to stay deleted. The settings I had used,
called for files missing from the destination to be replaced with
copies from the source, and vice versa, which is the essence of
synchronization. I've changed that to do nothing for files missing
from the source, which makes it a backup, not synchronization, job.
<Blush>

I apologize for wasting so much of your time RC and Malke. Hopefully,
someone else will benefit from my error, should they google this
thread.

Cheers,
Larry

 

[R. C. White]

Hi, Larry.

No apology required. We've all done stuff like that - more than once.
(Well, I have. Maybe Malke hasn't.)

And thanks for the report back. Maybe we can remember that next time some
user has a similar mysterious problem.

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

[snip]

Thank you so much, Larry. The files certainly seem like normal,
non-malware files. And while it doesn't catch some non-viral malware, I
do like Kaspersky. While of course I can't see your computer, this
doesn't seem like malware-related activity.

I must admit to being stumped. It does sound like something is running
that is replacing those files, something like a Norton Ghost or the
like. I have not seen anything like what you are experiencing on my
Vista box and I can certainly understand that you are frustrated. The
only other thing I can suggest is that you try a clean boot so that
nothing else is running and see if you can delete the files permanently
then (you will probably do two clean boots, booting back into one after
you restart the machine after deleting the files). That would rule out
any third-party programs protecting that directory.

How to perform a clean boot in Vista and XP -
http://support.microsoft.com/kb/331796


Malke

The problem is solved, and I am embarrassed to reveal the cause. I
have Synchback SE set to periodically mirror a number of directories
and files between drives, including the directory containing the files
and folders that refused to stay deleted. The settings I had used,
called for files missing from the destination to be replaced with
copies from the source, and vice versa, which is the essence of
synchronization. I've changed that to do nothing for files missing
from the source, which makes it a backup, not synchronization, job.
<Blush>

I apologize for wasting so much of your time RC and Malke. Hopefully,
someone else will benefit from my error, should they google this
thread.

Cheers,
Larry

 

[Malke]

The problem is solved, and I am embarrassed to reveal the cause. I
have Synchback SE set to periodically mirror a number of directories
and files between drives, including the directory containing the files
and folders that refused to stay deleted. The settings I had used,
called for files missing from the destination to be replaced with
copies from the source, and vice versa, which is the essence of
synchronization. I've changed that to do nothing for files missing
from the source, which makes it a backup, not synchronization, job.
<Blush>

I apologize for wasting so much of your time RC and Malke. Hopefully,
someone else will benefit from my error, should they google this
thread.

Ah *hah*!!! So I *was* right - something third-party was running in the
background doing this. No apology is necessary; you didn't waste my time
and the fact that you were gracious enough to post back with the answer
completely justifies any time I spent on this anyway. Believe it or not,
something like this may come up again and you helped me learn about it.

Besides, we all make goofs. Mine are usually forgetting to plug
something in. ;-)

So I'm glad you got it solved and thanks for being brave about posting back.

Cheers,


Malke

 

[Larry Sabo]

Ah *hah*!!! So I *was* right - something third-party was running in the
background doing this. No apology is necessary; you didn't waste my time
and the fact that you were gracious enough to post back with the answer
completely justifies any time I spent on this anyway. Believe it or not,
something like this may come up again and you helped me learn about it.

Besides, we all make goofs. Mine are usually forgetting to plug
something in. ;-)

So I'm glad you got it solved and thanks for being brave about posting back.

Cheers,


Malke

Thanks again, Malke and RC.

On an exam, where I had written "I don't know" as my answer, the
teacher commented: "Don't tell people of your ignorance; let them
guess! I have no problem exposing my ignorance, even if it does make
me look stoopid occasionally.

Cheers,
Larry

 

[gh]

For some reason I can't start a new thread so I am replying to this one.
Here is my problem:
I have 2 files in different folders that have the same name, and I want to
paste both those files with the same name into a new folder. However, it
won't let me copy both into a new folder because the 2nd one will always ask
to "replace the existing file with the same name" which was the first one.
Is there a way to turn this setting off so I can paste both, or is there a
way to add an extension to the 2nd file so its not the same name?

Thanks,
--
gh

Hi, Larry.

No apology required. We've all done stuff like that - more than once.
(Well, I have. Maybe Malke hasn't.)

And thanks for the report back. Maybe we can remember that next time some
user has a similar mysterious problem.

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

[snip]

Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.

Thank you so much, Larry. The files certainly seem like normal,
non-malware files. And while it doesn't catch some non-viral malware, I
do like Kaspersky. While of course I can't see your computer, this
doesn't seem like malware-related activity.

I must admit to being stumped. It does sound like something is running
that is replacing those files, something like a Norton Ghost or the
like. I have not seen anything like what you are experiencing on my
Vista box and I can certainly understand that you are frustrated. The
only other thing I can suggest is that you try a clean boot so that
nothing else is running and see if you can delete the files permanently
then (you will probably do two clean boots, booting back into one after
you restart the machine after deleting the files). That would rule out
any third-party programs protecting that directory.

How to perform a clean boot in Vista and XP -
http://support.microsoft.com/kb/331796


Malke

The problem is solved, and I am embarrassed to reveal the cause. I
have Synchback SE set to periodically mirror a number of directories
and files between drives, including the directory containing the files
and folders that refused to stay deleted. The settings I had used,
called for files missing from the destination to be replaced with
copies from the source, and vice versa, which is the essence of
synchronization. I've changed that to do nothing for files missing
from the source, which makes it a backup, not synchronization, job.
<Blush>

I apologize for wasting so much of your time RC and Malke. Hopefully,
someone else will benefit from my error, should they google this
thread.

Cheers,
Larry

 

[Richard Urban]

You can not have two files with the same name in a single folder. Rename one
of the files.

--

Regards,

Richard Urban
Microsoft MVP Windows Shell/User

For some reason I can't start a new thread so I am replying to this one.
Here is my problem:
I have 2 files in different folders that have the same name, and I want to
paste both those files with the same name into a new folder. However, it
won't let me copy both into a new folder because the 2nd one will always
ask
to "replace the existing file with the same name" which was the first one.
Is there a way to turn this setting off so I can paste both, or is there a
way to add an extension to the 2nd file so its not the same name?

Thanks,
--
gh

Hi, Larry.

No apology required. We've all done stuff like that - more than once.
(Well, I have. Maybe Malke hasn't.)

And thanks for the report back. Maybe we can remember that next time
some
user has a similar mysterious problem.

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP
(Running Windows Live Mail 2008 in Vista Ultimate x64)

[snip]

Not a full scan lately. The automatic "Startup" scan runs with each
startup; KAV catches things as they try to run or as files are
downloaded or "touched"; its Event log shows it to be up-to-date, and
active. It updates definitions every 3-4 hours or so. I haven't tried
checking for root kits but KAV does this to some extent, I believe.

Thank you so much, Larry. The files certainly seem like normal,
non-malware files. And while it doesn't catch some non-viral malware, I
do like Kaspersky. While of course I can't see your computer, this
doesn't seem like malware-related activity.

I must admit to being stumped. It does sound like something is running
that is replacing those files, something like a Norton Ghost or the
like. I have not seen anything like what you are experiencing on my
Vista box and I can certainly understand that you are frustrated. The
only other thing I can suggest is that you try a clean boot so that
nothing else is running and see if you can delete the files permanently
then (you will probably do two clean boots, booting back into one after
you restart the machine after deleting the files). That would rule out
any third-party programs protecting that directory.

How to perform a clean boot in Vista and XP -
http://support.microsoft.com/kb/331796


Malke

The problem is solved, and I am embarrassed to reveal the cause. I
have Synchback SE set to periodically mirror a number of directories
and files between drives, including the directory containing the files
and folders that refused to stay deleted. The settings I had used,
called for files missing from the destination to be replaced with
copies from the source, and vice versa, which is the essence of
synchronization. I've changed that to do nothing for files missing
from the source, which makes it a backup, not synchronization, job.
<Blush>

I apologize for wasting so much of your time RC and Malke. Hopefully,
someone else will benefit from my error, should they google this
thread.

Cheers,
Larry