[chinofeliz]

Hi everyone. I don't know anyone can help me with this ...

A couple of days ago I posted a message on the forum asking help for deleting one single file in my computer (under <User> My Document\My University Studies). It turned out to be just some sort of association to a Powerpoint I had in the folder before and I tried all the methods but it's still there.

Anyway, this friend of mine (he's a real computer wizz I don't wanna put him down) he was trying to help as well. And he sent me a file called "deltree.exe" and asked me to copy it under Windows C: and try the deltree command in DOS to delete the "My University Studies" folder. Which I did.

But the command apparently worked on anything in My Documents but that stubborn file, it stayed.

Now here's the weird thing - some really important files that I've been saving to new folders under My Document they are just wiped! Totally, the only thing that stayed is the "My University Studies" folder which hosts the undeleteable file.

AND, I just discovered that this happens everytime I go to run SuperCleaner 2.84's "AutoClean" function. I attached the pictures of what I asssigned SuperCleaner to clean up for "AutoClean". I've been using it for a long time and never had problem with it not to mention losing my important files.

So, by running the "AutoClean" function under SuperCleaner, does it somehow trigger something to wipe out my entire "My Documents" files? Would it have something to do with the "deltree.exe" file that once existed under C:? The DOS command? My friend is reliable and he told me he only dragged the "deltree.exe" file out of Windows.

I've tried Active@ Undelete, Active@ File Recovery - only retrieved some of the files. Now I'm trying Norton GoBack 4.

The lost files they are important, but more importantly I just want to know why and fix it and not let it happen again.

Please help me ;(....

[attachment=4935:attachment]
[attachment=4936:attachment]
[attachment=4937:attachment]

[Advertisements]

I see nothing in the screenshots you sent that would lead me to believe the supercleaner program is deleting these files short of a malfunction of the program

Deltree should not be deleting files still--it is a very DANGEROUS program that runs and then terminates,unless you somehow scripted it to run every time.

As for the first time, it is a VERY DANGEROUS application and it is very easy to make a mistake.


First, do you have the instructions your friend sent you?

Second, run hijackthis (follow link in my singature) and post a log. I am not looking for a malware program, but I want to see what is running at startup

[gerryf]

I see nothing in the screenshots you sent that would lead me to believe the supercleaner program is deleting these files short of a malfunction of the program

Deltree should not be deleting files still--it is a very DANGEROUS program that runs and then terminates,unless you somehow scripted it to run every time.

As for the first time, it is a VERY DANGEROUS application and it is very easy to make a mistake.


First, do you have the instructions your friend sent you?

Second, run hijackthis (follow link in my singature) and post a log. I am not looking for a malware program, but I want to see what is running at startup

[chinofeliz]

Logfile of HijackThis v1.99.1
Scan saved at 12:35:28 p.m., on 26/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5112.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Personal Firewall\lpfw.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\GV250\GV250.exe
C:\GV250\BcastTcp.exe
C:\GV250\DmHealthSvr.exe
C:\GV250\DMMailServer.exe
C:\Program Files\iolo\Search and Recover 3\SearchAndRecover.exe
C:\Program Files\iolo\Search and Recover 3\StreamServer.exe
F:\Program Files\Opera\Opera.exe
F:\Softwares\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - F:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Personal Firewall] C:\Program Files\Lavasoft\Personal Firewall\lpfw.exe /waitservice
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: MultiCam Auto Start.lnk = C:\GV250\DM500Startup.exe
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Lavasoft\PERSON~1\wl_hook.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Personal Firewall Service (LavasoftFirewall) - Agnitum Ltd. - C:\Program Files\Lavasoft\Personal Firewall\lpfw.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

[chinofeliz]

His instruction (he didn't send me any instruction, just talk over MSN but here it is basically):

1. Copy deltree.exe into under C:
2. Start - All Programs - Accessories - Comand Prompt
3. And then he just asked me to type in "deltree" then <tab> \ <tab> until I located "My University Studies" folder under "My Document" and press "Enter"
4. The command promt asked me [yn] I chose "y" then press Enter
5. Command prompt didn't give any error msg but when I checked afterwards the folder was still there with the undeletable file inside

This was basically what happened, I also tried using the "deltree" command on the whole "My Document" directory as all there was inside was "My University Studies" folder keeping the stubborn file.

Initially before deltree command he suggested "ren" command in DOS (rename?) but that didn't work so we moved onto "deltree" command.

Thanks for helping me out... I hope we can figure it out real soon
My friend actually took a pic with a local celebrity and I saved it into my documents and now it's lost he's really annoyed with me too, GOSH

Cheers

[gerryf]

there is nothing here that should be deleting any files....I don't care for the way you searched for this undeletable file, tho...

In Windows, souble click MY COMPUTER< choose LOCAL DISK C:, choose DOCUMENTS and SETTINGS folder (double click)

what folders do you see?

[chinofeliz]

I see "Administrator", "All Users", "Default User", "Guest", "LocalService", "NetworkService", and four user folders including mine. All the other users haven't been affected by this nonsense though. Just me under "My Documents"...

Thanx