Weird copying/moving system files

S

Screenwipe

New Member
This behavior started on a Thinkpad R52 running XP SP3, and has continued and morphed on a Thinkpad W500 running Win 7 Ultimate x64. On a substantial number, but not every, Erase of a file or folder, system files (.dll, .exe, .ini, .dat) are copied to the folder in which the erase is run. I recently noticed that this has morphed on the Win 7 system to actually moving these types of files from System 32, SysWOW64, and maybe other Windows folders to the root C:\ location. I could deal with the copy behavior, because the original files remained in their proper location (ran a search before further action), so running Erase again removed the copied files). This new moving behavior on the Win 7 system is more disturbing, because I haven't memorized what is in the System32 and SysWOW64 folders (and who knows, maybe some of these are from C:\Windows as well), and if I delete or erase them, they will be eliminated from my system (again, a search reveals these files are ONLY in C:\, not in any of the C:\Windows folders.

Here's a brief representative list:

appidcertstorecheck.exe
AxInstUI.exe
MultiDigiMon.exe
waitfor.exe
aticalcl64.dll
cmifw.dll
msdia80.dll
nettrace.dll
XpsGdiConverter.dll

Overall, there are 55 .dll files, 15 .exe files, and several miscellaneous other system files now in my C:\ folder and nowhere else on my computer. So far, this has not affected operation of the computer, presumably because the system looks to C:\ as well as C:\Windows\whatever when it needs one of these system files. As I have time, I'll try to track each file down and move it to its proper location, but in the meantime, I'd really like an explanation as to how and why Eraser is doing this, and how to stop it other than discarding the program.

I know Eraser is the culprit, because these files show up immediately after running it (plus, in the previous copying behavior, the copies were created in the folder being erased.

Any help greatly appreciated.
 
Are you running Eraser 5?
 
6.0.7.1893 currently. Previous versions in the past, whatever was current at the time. I've had the W500 since late December, 2009.
 
Could you go to the Settings panel, and scroll down to the plausible deniability section. Does anything appear in the list?
 
No entries and box not checked for plausibility. I intentionally did not select this option. If it helps, I have DOD 7 pass as the erasure and unused space methods. I have never used the erase unused space. Also, RNGCryptoServiceProvider is the Randomness data source, and that is the only option available. English interface, auto remove successful tasks, if recurring task missed, execute when Eraser next starts (I have no recurring tasks), Default Erasure Methods and PRNGs is the only Core plugin.

Having used Eraser after posting my message yesterday through today, I now have 61 dll files and 17 exe files in my C:\ folder, an increase of 8 files. I haven't yet made a list, so I can't tell you what has been added since yesterday. Still no apparent affect on system functionality.
 
I'm at a loss -- this behaviour was default for Eraser 5, not for Eraser 6. You've disabled that feature for Eraser 6 so it shouldn't happen. Maybe you can try resetting your settings (delete the HKCU\Software\Eraser 6 key in the registry) and see if that helps anything?

I've not had any reports similar to this for v6.
 
Hey, Joel,

Thanks for trying, you're one of the best support people I've ever run across, even if my situation is not resolved. As for lack of reports, that might because other users don't pay as much attention to the overall status of their system as I do, although I admit it could also be some strange combination of programs and settings unique to my system, although it seems strange that this has occurred over two different Thinkpads running two different OSes (Win XP SP3 and Win 7). Whatever, I like the program and use it most time instead of BCWipe, which I also have.

Oh, I just remembered there is also one other slightly annoying behavior. I frequently download .exe files through Firefox to the Windows 7 default Downloads folder, then install them. I let the install complete, and open and close the just installed program, sometimes immediately, sometimes after accessing some or all of the programs functions. I then go back to the Downloads folder in Windows Explorer, right click the .exe file and choose Erase. A majority of the time (like 8 or 9 out of 10), the erase fails, and the message box pops up with "program is busy" or whatever that box says (I don't really pay attention), and asking if I want to erase on reboot. I say No, then Yes to Remember this choice. The file changes it's date modified to 1/1/80 (?81, I suddenly can't remember). I then delete the .exe extension, leaving only the base filename, and choose Erase again, and it is erased. I also have 2-3 unlock programs, and running each one before deleting the .exe extension says the file is not locked by any process. Again, this is just a minor annoyance, not a deal breaker, but I thought I would alert you.
 
Screenwipe said:
Hey, Joel,

Thanks for trying, you're one of the best support people I've ever run across, even if my situation is not resolved. As for lack of reports, that might because other users don't pay as much attention to the overall status of their system as I do, although I admit it could also be some strange combination of programs and settings unique to my system, although it seems strange that this has occurred over two different Thinkpads running two different OSes (Win XP SP3 and Win 7). Whatever, I like the program and use it most time instead of BCWipe, which I also have.
Click to expand...
I'll run through the code again this weekend, just to make sure. What baffles me is that the files are consistently from the Windows folder, and no where else.

Screenwipe said:
Oh, I just remembered there is also one other slightly annoying behavior. I frequently download .exe files through Firefox to the Windows 7 default Downloads folder, then install them. I let the install complete, and open and close the just installed program, sometimes immediately, sometimes after accessing some or all of the programs functions. I then go back to the Downloads folder in Windows Explorer, right click the .exe file and choose Erase. A majority of the time (like 8 or 9 out of 10), the erase fails, and the message box pops up with "program is busy" or whatever that box says (I don't really pay attention), and asking if I want to erase on reboot. I say No, then Yes to Remember this choice. The file changes it's date modified to 1/1/80 (?81, I suddenly can't remember). I then delete the .exe extension, leaving only the base filename, and choose Erase again, and it is erased. I also have 2-3 unlock programs, and running each one before deleting the .exe extension says the file is not locked by any process. Again, this is just a minor annoyance, not a deal breaker, but I thought I would alert you.
Click to expand...
This is really reminiscent of Eraser 5. Are you very sure that Eraser 5 isn't installed (or is it uninstalled completely?) Eraser 6 doesn't ask whether you want to erase on reboot, it just unlocks the file automatically. Have a check in C:\Windows\System32 if there is Eraser.dll, and also check the Programs and Features control panel applet. It now seems possible that you've got a combination of v5 and v6 on your computer (Eraser 6's context menu in Windows Explorer is nested in a submenu with the Eraser icon painted next to the entry)
 
You must log in or register to reply here.
Back
Top