Weird autodeletion of some .EXE files

[kim2000]

Hello,

I am having a weird problem with Windows XP (SP1): some .exe files are
disappearing.

Sequence:

I get two programs on CD. One of them is CoreFTPLite. The other is a
trial version of ZoneAlarm Pro (very latest version: 5.5.062). Each is
a .EXE file.

I copy both to a folder on the hard disk.

I double-click on the ZoneAlarmPro .exe file. Nothing happens; the
hourglass appears briefly and then nothing. I do so again. Nothing.

Perhaps the file is corrupted. I reboot the system. The file is no
longer there on the hard disk!

I copy the Zone Alarm Pro file again from the CD. This time I change
its compatibility setting to Windows 98. Double click. It runs and
installs Zone Alarm Pro. It wants to reboot as part of its install
process. I let it do so. Zone Alarm comes up ok and seems to have
installed ok. BUT the .EXE install file is again no longer there on the
hard disk.

The same problem with CoreFTPLite: does not run unless I run it in
Win98 compatibility mode, gets deleted each time I reboot.

Only these two programs have exhibited this problem. Other exe's work
fine.

I have checked for viruses using F-prot. System is clean.

I am the only user and have administrator rights.

Any ideas?

- Kim

 

[Pegasus \(MVP\)]

Hello,

I am having a weird problem with Windows XP (SP1): some .exe files are
disappearing.

Sequence:

I get two programs on CD. One of them is CoreFTPLite. The other is a
trial version of ZoneAlarm Pro (very latest version: 5.5.062). Each is
a .EXE file.

I copy both to a folder on the hard disk.

I double-click on the ZoneAlarmPro .exe file. Nothing happens; the
hourglass appears briefly and then nothing. I do so again. Nothing.

Perhaps the file is corrupted. I reboot the system. The file is no
longer there on the hard disk!

I copy the Zone Alarm Pro file again from the CD. This time I change
its compatibility setting to Windows 98. Double click. It runs and
installs Zone Alarm Pro. It wants to reboot as part of its install
process. I let it do so. Zone Alarm comes up ok and seems to have
installed ok. BUT the .EXE install file is again no longer there on the
hard disk.

The same problem with CoreFTPLite: does not run unless I run it in
Win98 compatibility mode, gets deleted each time I reboot.

Only these two programs have exhibited this problem. Other exe's work
fine.

I have checked for viruses using F-prot. System is clean.

I am the only user and have administrator rights.

Any ideas?

- Kim

You have a process running on your PC that deletes files which
it does not like. Run pslist.exe (downloadable from
www.sysinternals.com) to check your active processes. If you
cannot work it out, start a Command Prompt, then type this
command:

pslist > c:\pslist.txt

Now paste the contents of pslist.txt into your reply.

 

[kim2000]

You have a process running on your PC that deletes files which
it does not like. Run pslist.exe (downloadable from
www.sysinternals.com) to check your active processes. If you
cannot work it out, start a Command Prompt, then type this
command:

pslist > c:\pslist.txt

Now paste the contents of pslist.txt into your reply.

This is rather long but here goes:


PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for AMD2400:

Name Pid Pri Thd Hnd Priv CPU Time Elapsed
Time
Idle 0 0 1 0 0 0:09:51.343
0:00:00.000
System 4 8 57 235 0 0:00:06.062
0:00:00.000
smss 572 11 3 21 268 0:00:00.750
2:27:18.515
csrss 636 13 12 448 1696 0:00:06.343
2:26:58.640
winlogon 660 13 23 5676 7296 0:00:01.937
2:26:57.750
services 712 9 19 308 1860 0:00:04.437
2:26:55.281
lsass 724 9 19 291 3296 0:00:00.562
2:26:55.203
svchost 896 8 10 251 1484 0:00:00.234
2:26:48.593
svchost 940 8 77 1296 13352 0:00:11.343
2:26:48.078
svchost 1040 8 6 71 932 0:00:00.109
2:26:46.531
svchost 1064 8 15 141 1212 0:00:00.109
2:26:46.078
spoolsv 1260 8 12 129 2936 0:00:00.187
2:26:42.203
InCDsrv 1392 8 12 1591 1812 0:00:00.625
2:26:40.968
mdm 1416 8 5 78 804 0:00:00.078
2:26:39.531
SMAgent 1512 8 2 35 732 0:00:00.031
2:26:38.609
spupdsvc 1528 8 2 44 712 0:00:00.156
2:26:38.343
VC6SecS 1564 8 3 87 1360 0:00:00.078
2:26:37.500
vsmon 1624 8 18 286 5400 0:00:08.453
2:26:35.015
Explorer 1116 8 14 352 15588 0:00:24.718
2:26:10.015
gnetmous 1600 8 2 41 1028 0:00:02.437
2:26:03.125
F-StopW 1672 8 2 42 920 0:00:00.156
2:26:02.890
AtomicTime 1760 8 2 58 1180 0:00:00.031
2:26:02.593
qttask 1864 8 2 52 824 0:00:00.046
2:26:02.063
InCD 1904 8 5 146 2636 0:00:00.109
2:26:01.297
VC6Play 1940 8 8 179 4728 0:00:00.640
2:26:00.453
zlclient 1972 8 7 106 3296 0:00:01.031
2:25:59.313
msmsgs 1856 8 13 280 10340 0:00:00.531
2:25:58.735
ctfmon 1644 8 1 99 728 0:00:00.375
2:25:58.438
MMKbd 2016 8 3 111 1708 0:00:00.437
2:25:51.297
AcroTray 164 8 1 35 748 0:00:00.015
2:25:47.344
msoffice 232 8 6 257 4384 0:00:00.718
2:25:39.266
VC6Tray 412 8 1 71 1356 0:00:00.156
2:25:35.953
rundll32 912 8 1 18 1520 0:00:00.031
2:25:14.344
wuauclt 2404 8 4 130 5340 0:00:00.171
2:22:02.922
cmd 3524 8 1 32 1712 0:00:00.062
0:00:50.875
pslist 3592 13 2 80 1048 0:00:00.046
0:00:00.062

Some of the resident utils that I can see in the above are: virtual CD
6, Atomic Time, InCD (Nero), Multimedia Kbrd driver from Samsung, Zone
Alarm Pro, F-prot, Office toolbar.


Hope this helps you in resolving my problem.

Thanks.

- Kim

 

[Pegasus \(MVP\)]

This is rather long but here goes:


PsList 1.26 - Process Information Lister
Copyright (C) 1999-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for AMD2400:

Name Pid Pri Thd Hnd Priv CPU Time Elapsed
Time
Idle 0 0 1 0 0 0:09:51.343
0:00:00.000
System 4 8 57 235 0 0:00:06.062
0:00:00.000
smss 572 11 3 21 268 0:00:00.750
2:27:18.515
csrss 636 13 12 448 1696 0:00:06.343
2:26:58.640
winlogon 660 13 23 5676 7296 0:00:01.937
2:26:57.750
services 712 9 19 308 1860 0:00:04.437
2:26:55.281
lsass 724 9 19 291 3296 0:00:00.562
2:26:55.203
svchost 896 8 10 251 1484 0:00:00.234
2:26:48.593
svchost 940 8 77 1296 13352 0:00:11.343
2:26:48.078
svchost 1040 8 6 71 932 0:00:00.109
2:26:46.531
svchost 1064 8 15 141 1212 0:00:00.109
2:26:46.078
spoolsv 1260 8 12 129 2936 0:00:00.187
2:26:42.203
InCDsrv 1392 8 12 1591 1812 0:00:00.625
2:26:40.968
mdm 1416 8 5 78 804 0:00:00.078
2:26:39.531
SMAgent 1512 8 2 35 732 0:00:00.031
2:26:38.609
spupdsvc 1528 8 2 44 712 0:00:00.156
2:26:38.343
VC6SecS 1564 8 3 87 1360 0:00:00.078
2:26:37.500
vsmon 1624 8 18 286 5400 0:00:08.453
2:26:35.015
Explorer 1116 8 14 352 15588 0:00:24.718
2:26:10.015
gnetmous 1600 8 2 41 1028 0:00:02.437
2:26:03.125
F-StopW 1672 8 2 42 920 0:00:00.156
2:26:02.890
AtomicTime 1760 8 2 58 1180 0:00:00.031
2:26:02.593
qttask 1864 8 2 52 824 0:00:00.046
2:26:02.063
InCD 1904 8 5 146 2636 0:00:00.109
2:26:01.297
VC6Play 1940 8 8 179 4728 0:00:00.640
2:26:00.453
zlclient 1972 8 7 106 3296 0:00:01.031
2:25:59.313
msmsgs 1856 8 13 280 10340 0:00:00.531
2:25:58.735
ctfmon 1644 8 1 99 728 0:00:00.375
2:25:58.438
MMKbd 2016 8 3 111 1708 0:00:00.437
2:25:51.297
AcroTray 164 8 1 35 748 0:00:00.015
2:25:47.344
msoffice 232 8 6 257 4384 0:00:00.718
2:25:39.266
VC6Tray 412 8 1 71 1356 0:00:00.156
2:25:35.953
rundll32 912 8 1 18 1520 0:00:00.031
2:25:14.344
wuauclt 2404 8 4 130 5340 0:00:00.171
2:22:02.922
cmd 3524 8 1 32 1712 0:00:00.062
0:00:50.875
pslist 3592 13 2 80 1048 0:00:00.046
0:00:00.062

Some of the resident utils that I can see in the above are: virtual CD
6, Atomic Time, InCD (Nero), Multimedia Kbrd driver from Samsung, Zone
Alarm Pro, F-prot, Office toolbar.


Hope this helps you in resolving my problem.

Thanks.

- Kim

I don't think anyone other than you can resolve your problem. We
can only give you hints.

I don't know anything about vc6secs, vc6play, v6tray and AtomicTime.
I would run msconfig.exe, disable them, then check if the problem still
occurs.

vprot is also very high on my list of suspects, especially because it is
a virus scanner. Disconnect your machine from the Internet to prevent
infection, disable vprot, then check if the problem is still around.

Ultimately I would even uninstall ZoneAlarm. I do not know the
product well - can it delete files?

As you see, you need to divide things further and further until
you have isolated the problem. You can rest assured that the
files are deleted by something you installed (or allowed to be
installed), not by WinXP itself. Your task is to find the culprit.

 

[kim2000]

Hello Pegasus,

I don't know anything about vc6secs, vc6play, v6tray and AtomicTime.
I would run msconfig.exe, disable them, then check if the problem still
....

As you see, you need to divide things further and further until
you have isolated the problem. You can rest assured that the
files are deleted by something you installed (or allowed to be
installed), not by WinXP itself. Your task is to find the culprit.

Ok. I will try that. First I'll see whether the problem occurs when I
boot in safe mode.

Give me a couple of days to test out all combinations and I'll be back
here.

Thanks,

Kim