1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Can't remove or delete

Discussion in 'Windows XP' started by natb3, Jul 14, 2006.

Thread Status:
Not open for further replies.
Advertisement
  1. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    I have a folder called "shared" which has 3 folders which won't delete. Two of the folders renamed themselves to "xxxxxxxxxxxxxxxxxxx....etc". I tried various utilities in safe mode but I still can't get rid of these files. I also used my antivirus checker & various spyware removal programs but they claim that no infection was found. Although my computer seems to be working OK I'd still like to remove this folder with these stubborn files that simply can't be removed.

    If anyone has had similar problems or have any suggestions please help. I've been to various websites and tried various freeware programs but none have worked so far. Thanks to anyone who can help.

    Natb
     
  2. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    What is the error that you get? Does it state that xxxxxxx is in use by another app? If so, you can download a free app called unlocker (google it) and that is a pretty effective app at removing stuff. If you feel that you are infected, you can always post a hijcack this logfile, as below:

    Please do this:

    · Click here to download HJTsetup.exe
    · Save HJTsetup.exe to your desktop.
    · Doubleclick on the HJTsetup.exe icon on your desktop.
    · By default it will install to C:\Program Files\Hijack This.
    · Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
    · Put a check by Create a desktop icon then click Next again.
    · Continue to follow the rest of the prompts from there.
    · At the final dialogue box click Finish and it will launch Hijack This.
    · Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    · Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    · Come back here to this thread and Paste the log in your next reply.
    · DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

    Be patient and an security expert will be along to assist you with this shortly.
     
  3. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    :) Thank you Valis for your suggestions. :)

    Shortly after I posted I went to delete the folder and it worked!
    Before posting I spent about 2 hours in safe mode and went through at least 6 utilities but none seemed to work. Then later I tried again (after windows XP booted normally) and I was able to delete the files. I suppose one of the programs I used must have worked but required a reboot into normal mode to be able to remove them. Anyway thanks for your info. If I have another problem I'll post again.

    Natb
     
  4. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    excellent, glad something worked. You can mark this thread solved under the thread tools at the upper right if you are satisfied.

    v
     
  5. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    I thought the problem was solved because the folder "shared" was deleted. However, a few hours later, I noticed a file on my computer called "xxxxxxxx".
    I opened it and to my surprise I saw the same 3 fiolders that could not be deleted. Therefore I used Hijack This to scan only and I'm putting the results below:


    Logfile of HijackThis v1.99.1
    Scan saved at 7:15:38 PM, on 07/14/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
    C:\ZoneAlarm6\zlclient.exe
    C:\Program Files\TuneUp Utilities\MemOptimizer.exe
    C:\NortonGoBack\GBTray.exe
    C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\WINDOWS\system32\crypserv.exe
    C:\EPSON\ESM2\eEBSVC.exe
    C:\ewido.security\ewidoctrl.exe
    C:\ewido.security\ewidoguard.exe
    C:\NortonGoBack\GBPoll.exe
    C:\WINDOWS\SYSTEM32\GEARSEC.EXE
    C:\ProShowProducer\ScsiAccess.exe
    C:\WINDOWS\System32\svchost.exe
    C:\SYSTEM~3\MXTask.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\SYSTEM~3\mxtask.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\mozilla_firefox\firefox.exe
    C:\shared\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.imdb.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.spies.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    R3 - Default URLSearchHook is missing
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\acrobat7\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot14\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [RCScheduleCheck] C:\RecoveryCommander\RCSCHED.EXE -CHECK
    O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\ZoneAlarm6\zlclient.exe"
    O4 - HKCU\..\Run: [TuneUp MemOptimizer] C:\Program Files\TuneUp Utilities\MemOptimizer.exe autostart
    O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
    O4 - HKCU\..\Run: [FUIClearHis] C:\FreshDevices\FreshUI\freshui.exe 0 1 2 3 4 5 8 9 10 11 12 13 14 15 16
    O4 - Global Startup: Norton GoBack.lnk = C:\NortonGoBack\GBTray.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\ACTIVE~1\inetrepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ACTIVE~1\inetrepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\ACTIVE~1\inetrepl.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - file://C:\eMule-plus\emule.47a\eMule\Incoming\Ulead Video Toolbox 2 Home Edition With Serial\Ulead Video Toolbox 2 Home Edition\setup.exe
    O18 - Protocol: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - (no file)
    O18 - Filter: text/html - {994D478A-45D0-4DB4-AE77-288B1E346E99} - (no file)
    O19 - User stylesheet: (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: COM+ Alerter Service - Unknown owner - C:\WINDOWS\system32\altsvc.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
    O23 - Service: EpsonBidirectionalService - Unknown owner - C:\EPSON\ESM2\eEBSVC.exe
    O23 - Service: ewido security suite control - ewido networks - C:\ewido.security\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\ewido.security\ewidoguard.exe
    O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\NortonGoBack\GBPoll.exe
    O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe (file missing)
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - Unknown owner - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe (file missing)
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: ScsiAccess - Unknown owner - C:\ProShowProducer\ScsiAccess.exe
    O23 - Service: SystemSuite Task Manager - V Communications, Inc. - C:\SYSTEM~3\MXTask.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

    If you can tell me what the problem is & how to solve it i'd appreciate it very much cause I'm quite puzzled. Thanks very much.

    natb
     
  6. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    did you try the unlocker application? I am not qualifed (yet) to read hjt logfiles; having said that, I am learning it, and I can state that any p2p file sharing service is simply asking for trouble, and you never want to have more than one antivirus going, so I need to ask if you are actively using Ewido, or just as a scanner. I fly AVG, but Ewido shows in my HJT log as I scan regularly with it.

    Let me know if you need a link to unlocker, as I mentioned it's a pretty beefy app, for it's dinky size.

    v
     
  7. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    speaking of which, you can most likely mark this unsolved as well as marking it 'solved'. ;)
     
  8. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    I tried unlocker and at least 5 other similar tools but this mystery remains unsolved. By the way how exactly do I mark this UNSOLVED? The thread tools doesn't seem to show anything that says unsolved. Thanks for any help anyone can provide here. This remains among one of my "unsolved mysteries"!!????????

    Natb
     
  9. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    what happened with unlocker? what was the error? I've not met a file that that app could'nt get rid of.

    What is the exact name and location of the file, i.e. c:\stuff\files\undeletable.dll or whatever it is.

    Have you tried renaming it? If that didn't work, have you tried renaming it in safe mode?

    v
     
  10. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    When I tried Unlocker and other utilities, it didn't report any errors that I'm aware of. However, nothing seems to delete the folder. The folder is named "xxxx.xxxx" and is located alphabetically on the hard drive. It has 3 folders inside
    "xxxxxxxxxxx.....", "xxxx.xxxx" and "DVDXCopy Platinum 4.0.3.8". These files seem seem to be permanently cemented on my computer. They cannot be removed or deleted with utilities, reboots, safe mode, unlocker, my antivirus program nor with antispyware software that I've tried. The big question is "WHY????". That's the mystery that knowone has yet solved (and I'd like to know exactly how to mark this UNSOLVED cause I don't see a way to do this). Again I'd like to thank you kindly for your time reading this and trying to help.

    Natb
     
  11. ozrom1e

    ozrom1e

    Joined:
    May 15, 2006
    Messages:
    11,849
    Do you shut down your computer or leave it running all the time?
     
  12. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    is it literally named xxxxxxx.xxxx, or are you just protecting your name? A lot of files are deemed system files, such as my documents, and won't be deleted regardless. 'Alphabetically on my hard drive' tells me nothing.

    Click the red exclamtion point on the upper right hand of the first thread to request a moderator to mark this unsolved.

    v
     
  13. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    Those xxx's are the EXACT names of the files as I posted. Sorry but I can't find a red exclamation to mark this UNSOLVED. Where exactly is it?

    Natb
     
  14. natb3

    natb3 Thread Starter

    Joined:
    Apr 21, 2002
    Messages:
    34
    Occasionally I've left it on overnight to complete downloads. Generally I shut it off.

    Natb
     
  15. valis

    valis Moderator

    Joined:
    Sep 24, 2004
    Messages:
    77,588
    if you look at any post, it has a dark blue title bar that has the date, time, title (if any), and clear on the right, the post number, and a red triangle. Click that red triangle to request that this be marked UNsolved.

    something is wrong if the folders are marked like that. I'd wait for a security expert to parse your hjt logfile.

    Can you remove the dvdxcopy from your add/remove program list?
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Solved Can't remove
  1. BML
    Replies:
    6
    Views:
    713
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/483133

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice