Undeleteable NPROTECT files

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

Trying going into safe mode and deleting via command prompt.  We have a document on this:

 

http://service1.symantec.com/SUPPORT/nsw.nsf/docid/2006101317183907

  

The items you cannot delete are more than likely being locked by an active driver or service.

 

 

Thanks for the suggestion - I have already been down this route (oh to get back to the good old days of DOS, including nu, sd & ds - shows how long I have been a Norton Utilities user).

 

As far as I am aware, this is something more than the files being locked - you get the file in use message if you try to delete the .LOG file and this is different to the message that I get when I try to delete the main files.

 

Under windows  I get the message "Cannot delete file: Cannot read from source file or disk".  Under DOS I get "Could Not Find (filename)" even though the files all show on a directory listing, using a 'dir' immediately prior to the delete.

 

Its as if the file listing is no longer connected to the underlying file on disk, but I would have thought that this would have been picked up by chkdsk or Disk Doctor.  Do you know if these look inside the RECYCLER directory?

Both NDD and Checkdisk should include the RECYCLER directory.  Kind of an out of left field recommendation, could you try Wipe Info on the folder?  Both wipe free space and wiping the folder if it lets you.

1 Like

It couldn't be something like an NTFS rights issue, could it?  Perhaps, like the System Restore files, marked for "system" access only?

 

If this is the case, maybe you could add the adminstrators group and then be able to delete them.

 

The only other situtation in which I've seen files that can be seen, but not deleted, is when the total path+filename exceeds 256 characters (some kind of explorer limitation, even though the NTFS can support it), but I don't think that would apply.

 

Perhaps I should go back to basics and ask what OS version and filesystem you are using? Have the files got a created/modified date on them so you can see whether they are recent or old?

 

As a last ditch attempt, I'd probably use one of your other hard disks to temporarily install another OS, mount the problem drives as simple data drives and then try to delete the files (no locking should be possible I think).

 

JamesB

 

 

Hi

 

The computer is running some major file conversions at the moment and is likely to be at it for a few hours yet, so I can not try anything too clever tonight.  

 

The file system is NTFS and I am running on Windows XP Home edition. 

 

What I have done is turned off the protection on my C: and F: drives.  I was then able to move the NPROTECT directory in its entirely  out of the RECYCLER directory and into the root.  I was then able to turn back on protection and new directories and log files were created.  At least this problem is no longer messing up current operations and I can monitor the new directories to see if the problem reoccurs. It should also mean that when I get a chance to reboot any locks and links attached to the files should be removed. 

 

I have had a look at the attributes and there does not appear to be anything strange going on and I am logged in as the administrator, so that should not be the problem.  The path & filename are simply C:\RECYCLER\NPROTECT\0000xxxx. so I am well away from the 256 limit.

 

On the F: drive the files are dated (created, modified & accessed are within a few minutes of each other for each file) between  the 25 and 29 April 2009.

 

On the C: drive most of them were created at the same time on 4 April with a further 17 created on 20 April and another 12 on 26 April. The modified and accessed dates are in sync and range between the 9 April and 29 April.  There are actually 1948 files with numbers ranging between 00000000 and 00003650

 

I should mention that one of the early things that I tried was to change the number of days before it purged the files on the F: drive to 1 day, but this did not have any effect.  The C: drive remains set at 7 days.

 

None of this makes a lot of sense to me as there are too many contradictions.  Does it ring any bell for anyone else? 

 

I will then have a further play with them tomorrow and will try out your suggestions.  If anything else comes to mind, let me know and I will give it a try and report back.

Aaaggghhhh its creating more of them!!!!!

 

OK, I have taken a couple of deep breaths and will try and do this logically.

 

The OLD directories -  as reported previously I have moved the NPROTECT directories out of RECYCLER and into the root.  I have even renamed them adding in 'old' to their name.  I have rebooted, so as far as I am aware these files are as 'clean' as I can make them.  I still can not delete, copy or change them in any way.  They can not be 'wiped'.  Whilst a directory listing gives the three time/date stamps if one clicks on a file and asks for its Properties, the three time/date stamps are missing in the popup box.

 

Chkdsk is still not reporting any problems, but they are still coming up as unmovable files in Speed Disk.

 

I now seem to be stuck with these files using up a chunk of my drive with no way to get rid of them.

 

The NEW directories - having moved the old directories, I turned back on Norton Protection and it created new directories and log files.  I rebooted, did some housekeeping involving moving files from one drive to another and tried to sort out the problems with the old directories.  Along the way I cleared out both the recycle bin and the NP bin probably a couple of times.  When it was clear that I could not solve the problems with the old directories, I checked out the new ones to make sure that they were OK.  To my horror, even though both 'Empty Files' lines were greyed out, there were files present in the new NPROTECT directories on both drives. 

 

I opened the 'UnErase Wizard' but it had no recoverable files listed.

 

The files in the NPROTECT directory are made up of two sorts.  One type have just the eight digit file name and no extension which are once again undeleteable.  The other type, in addition to the eight digit file name have extensions, mainly exe, ht, cab & m.  I can manually delete these latter files, but they are not being picked up by either the 'Empty Norton Protected Files' command or the 'UnErase Wizard.

 

Anyone any suggestions as to what is going on and how I stop it - Heeeeeelp!!!

 

 

Could you attach screenshots of what you're seeing?  I need to do some investigation on this.

 

 

Hi Erik 

 

I have done some screenshots but how do I attach them?  I do not have a website or subscribe to any of the photo hosting sites so can not see how to use the links etc above..

 

Gerard

 

If you have it saved as a file, you can click "Insert/edit image".

 

 

 

Message Edited by erik_carlstrom on 04-30-2008 08:43 AM

Hi Erik

 

Sorry to be thick about this - I have 8 JPG files created by Snagging showing various aspects of the problem. I can not however get any of them to load using "Insert/edit image". It keeps asking for a URL and if I type in the path and filename instead it will not accept it. I even loaded one of them into my browser, copied the address as it appeared there and pasted this in, but to no avail.

 

Is there a specific way of entering a local filename as a URL that I need to use? Can I put all 8 files in one post or do I need to do 8 separate ones? Any other way that I can send these to you?

 

Gerard

 


EnorMouse wrote:
...Any other way that I can send these to you? 

Hi Gerard,

 

I have sent you an email with information on how to upload information for us to review. Please let us know when you have uploaded the files. Thanks! 

Message Edited by Tony_Weiss on 04-30-2008 09:52 PM

I had the same problem.

 

It was due to an old NSW not completely uninstalling itself.

 

I ran the latest version of SymNRT (you might have to scroll down the page a bit to see the download link) which uninstalled every Norton product on my system, and I had to reinstall Norton 360. BUT I was able to manually delete all the NPROTECT files.

 

 

Regret to say that I am still here and still suffering.   Last few weeks have been hell on a number of fronts so I have not been able to put in the effort on this that I should.

 

I have run the uninstal program and reinstalled both NSW & NIS - still have the same problem.

 

Tony - I have tried to run the program that you sent to me but it refuses to run the way that you say it should.  Instead it keeps asking me to reproduce the error. 

 

Part of the  problem with this is that at present, whilst my computer boots up fine from a power on,if you do a restart then it hangs once it has shut down and refuses to boot up again.  You have to power it down and then switch on again and this tends to disrupt some software relying on the restart..  I am working with Microsoft to see if I can get to the bottom of this, but due to timing differences and when I am available we only seem to manage one email a day.  So far I have managed to totally confuse them and my contact is off doing further research to come up with a new action plan.

 

I have also been installing some new drivers and updated to SP3.  I am also looking into a BIOS upgrade, but at the moment my system is rejecting the one from the motherboard supplier.

 

One piece of good news, I have found a little piece of freeware called 'Unlocker' which has successfully deleted all of the files - I had reached something in excess of 8,000, so am rather happy about that.

 

Norton Protection is continuing to create undeletable  files - I just ran a Live Update and it created about another dozen. 

 

I have however worked out that one of the commonest  files that it was picking up was being generated by SeaMonkey and was called something like cookies.txt.moztmp.  It seems that every time something happens with cookies that this file gets updated and I found about 20 copies of it in the Unerase Wizard after about a hour's browsing .  They were all about 30K which happened to be the size of the vast majority of the undeletable  files.  I have now added *.moztmp to the exclusions list, so hopefully the size of the problem will be less and I can continue to handle it with 'Unlocker'.

 

Have you had any further thoughts about what may be causing this?

 

Once I solve the restart problem I will have another go at running your program and sending you the results..

 

Thanks for your help so far and apologies for the delay in getting back to you. 

Thanks for the update.  Please let us know once you've solved the shutdown problem with MS.  It is very curious that unlocking the files allows for deletion as those files should not be locked.  Let's wait for after the shutdown problem so we can ensure a more stable environment for troubleshooting.

 

 

 

 

Hi Erik

 

Just so that you are aware, although the program is called 'Unlocker', in addition to its ability to remove locks it also seems to have a superior ability to access files, to delete, rename or move them.  It did not report any locks on the files but its delete facility did get rid of them when nothing else that I tried worked.

 

 I will get back to you when I have a clearer idea as to what is going on.

 

Regards

 

EM