Jump to content

Alan_B

Experienced Members
  • Posts

    4,274
  • Joined

  • Last visited

Posts posted by Alan_B

  1. If my malware protection allowed my files to be infected I would not trust my malware protection to identify every file that needed deleting,

    and I especially would not trust it to eradicate every instance of the Trojan Horse - whichever that may be.

     

    It may be advisable to get your computer checked out by experts.

    Free Expert advice sites are listed at

    http://forum.pirifor...showtopic=34786

     

    I cant seem to get the photos up on here off task manger as the photos are to big.

    Just in case you are using a camera to photograph the Task Manager, a screen-shot can be captured thus :-

    http://www.howtogeek...extra-software/

     

    Please note that whilst Recuva may be able to rescue and copy to another drive any files deleted from important folders such as C:\Windows\System32,

    it is unlikely that Windows will allow you to then copy back to their rightful location - there are much better ways of repairing a corrupted system.

    Recuva can however rescue and copy to another drive your documents and perhaps some applications.

     

    The absolutely simplest solution would be to restore a system image backup - if in fact you have such a backup available.

    This will however omit documents and applications that were added subsequent to the creation of the image.

  2. I make sure FF process is terminated. I do not use other Mozilla products. I believe I have that suggestion covered. Thank you Nergal and Winapp2.ini for your suggestions.

    The Windows "Task Manager" has a Processes TAB and this will show both Firefox.exe and also Plugin-Container.exe.

    When you close the Firefox application then both those processes should also close,

    but if they stay on you can right click and choose to "End Process",

    and if that fails right click and choose to "End Process Tree",

     

    Perhaps process lasso can achieve the same for you.

  3. I think that both environment varaiables and file and folder names are case insensitive,

    i.e. Temp = TEMP = temp.

     

    At my first attempt I only did half the job and only altered the "User Variables", and subsequently realised that "System Variables" also merit changing.

    The consequence was that BEFORE the User has logged into Windows anything written to %TEMP% actually writes to the system drive

    (Something like C:\Windows\System32\Temp\ I think - but Google probably knows for sure)

    Another possible consequence might be that some application that runs before you log in (e.g. Antivirus, DropBox, etc.) might adopt that initial default as its "scratchpad".

    I dread to think of Trident, the I.E. engine that is built into Windows.

     

    Is it possible that you have also only done half the job ?

     

    This is a simple guide with GUI screen-shots for changing both User and System variables

    http://forums.overcl...howtopic=184591

     

    This is a concise guide which fits on the screen without scrolling

    http://blogs.msdn.co.../15/513134.aspx

     

    N.B. I first relocated my %TEMP% after a VMWARE Virtual Machine misfired and aborted.

    When I closed various Windows and looked at Windows Explorer I saw a great big RED bar across system drive C:\

    and I found that 12 GB of free space had been reduced to a few dozen MB due to a constipated %TEMP%.

    I was thankful that Windows was still running (creeping) but feared it might never boot again with such little free space so I deleted the %TEMP% junk.

     

    I rebooted and all was well, and I then Googled for a way to relocate %TEMP% and ensure it would never again put my system drive in jeopardy.

  4. What was the virus ?

    How did you remove it ?

    How do you know that it has all been purged and is not still affecting you ?

     

    If you launch Windows Disk Management and take a screen-shot and supply that we would have a better idea of your situation.

    Are the 3 other hard drives internal or external HDD's ?

     

    What are you attempting to Recuva ?

    i.e. all of C:\, parts of C:\, or C:\ plus folders on other drives ?

  5. I see absolutely zero merit in wasting a user's time by searching for and removing MP3 tunes that have been converted from MP4 videos - or vice versa.

    You might want it but most people would not.

     

    Your suggestion would damage the CCleaner.exe reputation as being one of the safest junk file removers.

    I am in agreement with others who advocate the use of checksums to confirm that two files have identical contents.

     

    I agree with your opinion that there is danger for the foolish who might think it safe to remove "duplicate" config.dat,

    but despise your argument that this is justification for making CCleaner even more dangerous with an even wider catalogue of "equivalent duplicates".

  6. A deleted file still exists - but you cannot see it because Windows wont allow you to see it.

    Until the deleted file is erased or wiped or over-written you may be able to retrieve it.

     

    What is your operating system ?

    What is your backup software that replaced your file ?

    Is your lost file actually a Folder containing 100 photos,

    or is it a *.ZIP file.

     

    I am surprised that backup software would destroy without warning an existing file/folder - time to consider alternatives.

     

    It is possible that what you have lost is actually relocated or hidden.

    It would be worth trying something like Locate32 to search for what Windows hides

    http://locate32.cogit.net/

  7. Version 4 uses CCleaner.ini like version 3, EXCEPTING for the File Finder Search.

     

    I observe that it makes no difference to CCleaner.ini when I modify the File Finder "Match By" checkboxes

    (i.e. Name, Size, and Modified Date),

    and yet I can close CCleaner and when I re-open the checkbox settings have been remembered.

    My best guess is that those three checkboxes are remembered in the registry.

     

    Whoops

    Retraction

     

    After closing CCleaner I double clicked the INI and it was opened by Notepad.exe and there was no change to previous contents.

     

    I have since then created a Bootable Ubuntu Flash drive and YUMI closed all instances of Windows Explorer whilst erasing the Flash drive.

    Then I returned to try something else with CCleaner,

    but when I Launched Windows Explorer and again selected CCleaner.ini and opened with notepad,

    I found that in my absence relevant additions have appeared in this CCleaner.ini :unsure:

     

    Windows 7 is messing me about because I am looking at Linux :o

     

    Regards

    Alan

  8. I had the same problem, which was caused by the program CIEUHU.EXE.

    http://answers.micro...c7-41671457fe11

     

    This is where I relied but didn't worked.

    That topic had many "same problem but solution failed" posts.

    There were at least two alternative executables which required different actions.

    Did you at least confirm that you were infected by CUIEUHU.EXE.

     

     

    A pain in the abdomen might be cured by anything from a strong laxative to removal of the appendix.

     

    I fully agree with Keatah - you need accurate diagnosis before selecting a course of treatment.

     

    I fear that every failed attempt which modifies the contents of the disc

    (including. a "normal" format - whatever that may be)

    will make it more difficult and expensive to achieve recovery.

     

    I think it is more common for malware to target your system partition (C:\) before it targets external drives.

    If your malware protection failed to protect your external drive I would not trust its internal protection,

    and malware could :-

    1. Have damaged system files which are required for use by Recuva;

    2. Could still be present and actively degrading operation of your system.

     

    I suggest that you get help to ensure your computer system is free of malware before you try to Recuva your external drive files.

    Here is a list of suggestions

    http://forum.pirifor...showtopic=34786

  9. Only one file cluster amongst millions will be over-written when you write to F:\ which holds your lost files,

    but you can refrain if you wish

    .

    No damage at all will be done by writing to drive D:\,

    and this is the most important test.

    If the test file on D:\ is not visible when the "device is not ready" then there is no way that Recuva is at fault - it is your hardware or operating system that is wrong.

     

    If the test file on D:\ is visible then Recuva should be able to restore files to D:\,

    unless of course too much time that has elapsed between Recuva scanning F:\ and your initiating restore that drive F:\ has gone to sleep as is the guilty "device is not ready".

  10. @Alan_B : when does this has been applied ? When installing the product, Licence Agreement is link online which isn't legal in France it seems because editor (Piriform) can change the licence apply to all previously installed products. And We don't read LA at every build.

    I have no authority on this - just a general awareness that changes have occurred.

     

    I will leave it for a moderator to answer and explain the details.

  11. Does anyone know what the problem is. It's never done this before.

    No one can know what the problem is.

     

    My guess is that you have a problem with "Unused File Extensions."

     

    We can only guess, and the better you define the problem the better we can guess.

    I suggest you specify a particular issue that is not being fixed.

  12. Nothing appeared in either explorer, and despite saying quality excellent, it still said device not ready and nothing was recovered

    It is impossible for anything (including RECUVA) to save to drive D:\ whilst drive D:\ is not ready,

    and drive D:\ is almost certainly not ready if Windows Explorer cannot see its contents - unless of course it has no contents

     

    I am sorry but from post #3 I was expecting that there would be files present on both D:\ and F:\

    Reviewing your screen shot in post #5 this is possibly not true.

     

    Please create a small file on both D:\ and F:\,

    e.g. use Notepad and create a single line with the word "Test" and save it as D:\Test.txt and F:\Test.txt

     

    Now use Recuva again and wait until it has completed a scan and is ready to recover.

    At this stage launch Windows Explorer and confirm that it can show both D:\Test.txt and F:\Test.txt

    If it cannot see both files then wait until they appear before you launch Recover.

    It they never appear then I cannot understand what is wrong with your devices - they got me beat.

  13. Gee, ya know that was a bit rude.

    Also I didn't know the development didn't inhabit these forums (unlike many others) at any time. Good to know for those who aren't here very often.

    More rude is arriving as a stranger and asking for help and saying it will be most appreciated,

    and subsequently complaining of rudeness when advised of your mistaken assumptions.

  14. Opened explorer to both drives, but it still gives me the 'device is not ready' and didn't recover the file

    Did you have separate instances of Windows Explorer,

    and were they both showing the contents of the relevant drives at the instant you were tying to save and wer being told 'device not ready' ?

     

    How about setting up Recuva so it as ready to save to D:\,

    and at that instant using Windows Explorer to copy a visible (not deleted and not lost) file from F:\ to D:\

    and then telling Recuva to Save.

    Please report if windows Explorer successfully copies and Recuva still fails to save with 'device not ready'

  15. I simply launch a spreadsheet and drag-drop the file onto the spreadsheet.

    The file is "tab delimitted" and the results appear in nice columns ready for printing.

  16. Perhaps you need to have a delayed auto-start.

    My preferred choice is to NOT close down the computer myself but to hit a shortcut that launches CCleaner in /AUTO /SHUTDOWN mode,

    then IE history is cleaned ready for the next morning and Ccleaner actions do not dely my use of the computer on startup as I impatiently wait with coffee in hand :)

  17. Deletion is a drastic step which may be difficult for a novice to recover from.

     

    I suggest an option (preferably the default option) of Deletion to the Recycle Bin,

    and a pop-up or alternative notice advising to NOT empty the bin until after rebooting and checking that the duplicates really are redundant before emptying the bin.

  18. take a few shots and see if you can preview them. that'll exclude the card itself from the problem list.

    I suggest the fewer the better because I assume that every shot now has the probability of destroying one of the shots you wish to recover.

  19. CRC32 on a large enough system will find some false positive results. Better would be MD5 duplicate matches, though you're right - a disclaimer that this will require some *time* to complete.

    Unlikely

    I guess a given file with a 32 bit checksum would need to be compared with "2 raised to power of 32" = 4,294,967,296 to have a probability of 1 matching result.

    That is a tremendous number, much bigger than the 74,602 files present in Windows Ultimate.

    Just searching in C:\ for duplicated names and sizes there are less then 36 duplicate pairs found, i.e. 99.9% of the total population are excluded by name and size,

    so a 32 bit checksum is probably good for a total population of 4,294,967,296,000 files

  20. I do realize adding in secure checksum/hash checking could possibly make the File Finder agonizingly slow, but it's the safest approach to know with absolute certainty if dealing with real duplicates or not.

    It would be a terrible delay if every file was processed in one pass.

    It would be a negligible delay if the first pass omitted hash checking, and only performed hash checksums on files that have otherwise been matched.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.