Essential Program Files Disappearing

[SynthetoBrick]

Vista Home Premium SP1 64-bit here.

I did a quick search for vanishing files on this forum and didn't find anything that matched my problem.

System specs: 4GB RAM, 200GB HDD, T5750 CPU, Radeon Mobility HD 2600

This will sound strange, but please try to believe me; I have been using Vista 64-bit for 4 months and previous Windows versions for over 10 years.

I have been having certain programs become crippled on a regular basis since 2 weeks ago. Some of them, such as FireFox, clearly have files that get deleted; other programs seem to be unable to access certain system dlls or even just get uninstalled completely.

The programs I have identified this problem with so far are: FireFox, AVG, avast!, ATI CCC, Adobe programs, Office programs, and many games that rely on DirectX dlls. Office applications are able to reconfigure themselves, but all the others must be reinstalled.

This problem does not occur after a restart, as it has happened 2 other times and just happened again while I was working on a report. The problem doesn't happen instantly either, as each time everything was working fine for at least 2 days even after several restarts. The applications themselves don't show an problems until they are restarted. For example, in this latest occurrence I had FireFox running and went to open a game but got the message that a directX dll (the one from august 2005 this time, it has been different ones in the past) was missing. I then closed FireFox and tried a different game, which gave me the same error. When I tried to open FireFox again, the error popped up saying that an ini file could not be found.

For the DirectX dlls, I checked the system32 folder and I always find them there and not missing.

For the FireFox ini, I checked the program folder and the ini along with several other files were missing.

For AVG and ATI CCC, the entire program seems to vanish, but the program entry remains in the programs list.

For avast!, the program crashes claiming that a skin file is missing and it really is not there.

I have used Spybot, AVG, avast!, and MalwareBytes. None of these utilities find any problems.

So far, I haven't seen any data in my personal files go missing. The only things that are getting destroyed are the programs.

I have tried running disk check, but it seemed that no problems were found so I highly doubt it is the HDD.

I have not tried a full registry cleaner because everyone I have talked to says they are more likely to do damage than help.

The first time this problem occurred, I tried using the oldest system restore available, which failed with the error that the restore was corrupted and the system restored to a newer point that still had the corrupted application.

Edited December 9, 2008 by SynthetoBrick

[WHS]

Hmm, mysterious indeed. But for starters, running AVG and Avast together spells trouble. You should get rid of one of them. And if MalwareBytes is in the startups, disable it there too. That should only be used for scanning. - See whether that helps.

[+primortal Subscriber²]

Check the event logs to see if there is anything in there. Drive corruption?

[SynthetoBrick]

Hmm, mysterious indeed. But for starters, running AVG and Avast together spells trouble. You should get rid of one of them. And if MalwareBytes is in the startups, disable it there too. That should only be used for scanning. - See whether that helps.

Sorry, I guess my statement was misleading. I was running AVG, and it kept getting uninstalled as well as it wouldn't find any viruses, so I switched to avast!, but even avast! can't find any viruses.

Check the event logs to see if there is anything in there. Drive corruption?

I checked but could not find any significant errors or alerts that would explain so many programs getting corrupted all at once.

Just to keep this problem updated, right now I am using Process Monitor to watch FireFox's application.ini in all events. The application.ini file is one that is deleted when all the other programs get corrupted each time, so it is an easy candidate for finding the error. So far, the program corruption hasn't happened again, but seeing as how it has happened 3 times in the past 2 weeks, I doubt I magically fixed it.

Since checkdisk seemed to declare the HDD in good condition, I'm starting to wonder if it might be the RAM.

I was playing a game the other day and I noticed some small textures were corrupted (they were a mish-mash of multi-colored squares) but the game continued to run without any problem; do you think this might be a sign of HDD or RAM failure?

[goodrevrnd]

I am having the exact same problem, it just started last night. First off, Speedfan stopped working after being untouched and running flawlessly for over a year. I reinstalled it and it started working again, I just assumed a windows update broke compatibility or something. I also got an error with Firefox's .ini last night, reinstalling fixed it. Fastforward this morning and Firefox won't even start, says file missing on shortcut. I navigate to the directory and all the files (but not subfolders or their contents) are missing. Reinstalling fixes it. A tad later, I go to play a game and I get a directx initialization error, tried different games, everything gave a similar error. After raging out at the thought of corrupted system files, I tried reinstalling video drivers first, which fixed the problem. Meanwhile during all this, Avast keeps wanting to reboot the computer for a program update, which I just now realize is because some of its files are probably getting deleted too. There is something very nasty going on here and since there's two of us having the EXACT same problem there is no way hardware could be causing this.

The only thing that changed recently was me installing the Firefox 3.1b2 and rebooting for some windows updates, but I can't remember if that happened before or after Speedfan failed the first time. Did you happen to install this build around the time you started having problems? I wonder if this is a coincidence, or if it contains somethign nasty for some reason.

Vista HP64

[+Anarkii Subscriber²]

Reading this there are two things you guys have in common: Your both using Avast and Firefox. I would put money on that the problem is one of those two software, as i'm on Vista x64 and using AVG, and Google Chrome, and have no problems.

[hadouken]

Reading this there are two things you guys have in common: Your both using Avast and Firefox. I would put money on that the problem is one of those two software, as i'm on Vista x64 and using AVG, and Google Chrome, and have no problems.

Excellent logic but SynthetoBrick was having his problem before he installed avast!, he used AVG first which apparently went missing by itself.

My first thought would be a dodgy IDE controller driver (maybe try an updated version), drive corruption (run MHDD32 on your HD's, available on the ultimate boot cd - google for it). If whole directories are going missing then it seems very strange that a program would cause it because there would be DLL and system files that would have been in use and programs wouldn't have been able to delete them, I would guess it was happening on boot or shutdown? Maybe open msconfig and see what programs are set to run on boot.

If it does happen to be a program thats doing it, download ProcMon from Microsoft technet, filter out everything but file operations and filter for FILE DELETE operations, then leave the program running all session and check if something is going on a deleting spree.

Strange problem though, cant think of much else. What motherboards are you both using?

[+allan MVC]

Excellent logic but SynthetoBrick was having his problem before he installed avast!, he used AVG first which apparently went missing by itself.

That, and the fact there are probably millions of users with both programs installed who do not have this problem ;)

[goodrevrnd]

Abit IP35-E

Whole directories aren't disappearing. In Firefox's case, the entire contents of the root firefox folder disappear, but it's subfolders and their contents remain intact. As far as Avast, whatever is disappearing seems to only pertain to the program update or partial files because it keeps running, and then wants to reboot the computer to apply it's updates. I have no idea what speedfan or directx/nvidia files went missing.

I disabled write caching on my hdd just as a precaution for now, and will install ProcMon and watch that.

[goodrevrnd]

Ok, how do I filter for File Delete? I don't see that option in there anywhere.

[hadouken]

That, and the fact there are probably millions of users with both programs installed who do not have this problem

lol good point :p

Ok, how do I filter for File Delete? I don't see that option in there anywhere.

Oops sorry, I was way off. You actually need to set two filters:

1. "Detail" "contains" "Delete: True" (type it without quotes)

2. "Operation" "is" "SetDispositionInformationFile" (select from the drop down box)

That should show you all deletes going on. Just leaving it running minimized as you get on with your business and come to it at the end of your session.

[Wuller-de-Wust]

I have a similar problem running XP. The service that triggers the problem is NetDrive (netdrive.net). When it starts up, it scans the system32 folder and deletes the first dozen files. ProcMon shows that SetDispositionInformationFile is being used. "Windows File Protection" blocks the deletes (sometimes), but one time it didn't. I reported this to NetDrive, but I'm wondering if it is really a Windows problem.

[jnelsoninjax]

@SynthetoBrick, did you install anything right before the vanishing files act? It sounds to me like you might have a rootkit (read here if you do not know what a rootkit is: http://en.wikipedia.org/wiki/Rootkit). I had a similar issue a while back where my browser would take minutes to load, I traced it down to a rootkit, but was not able to remove it without formatting the HDD. Rootkits are almost impossible to find, the only way I know of is to as everybody else has suggested and watch the process that are being loaded! I found this page which is a guide to some of the more popular rootkit scanners/removers http://www.networkworld.com/columnists/200...net.html?inform

[SynthetoBrick]

After a month or so of monitoring, I found nothing!

@SynthetoBrick, did you install anything right before the vanishing files act? It sounds to me like you might have a rootkit...

Video Card Monitoring utilities... (NVIDIA PerfKit/SDK, RivaTuner, ATITools...)

Not all at once, I was testing each one to see if they could display Video RAM usage.

- NVIDIA PerfKit/SDK was the strangest one because when I tried to uninstall it, it said it couldn't uninstall because it didn't recognize if I was running x86 or x64. I am, in fact, running Vista x64.

- RivaTuner wanted to install a custom video driver, but Vista stopped it dead at that point with its driver management settings.

- ATITools seemed to run fine but didn't seem to have a method of viewing Video RAM.

The only other thing that I could easily suspect was Windows Disk Defragmenter. This whole mess started right after I allowed Disk Defragmenter to run on a schedule.

Or, I could suspect AVG because it was having strange problems from the very beginning (2 months prior to these issues) such as not being able to update online with out corrupting AVG.

I can't seem to recreate this issue anymore, so I will try to provide as much information for anyone still having the problem:

-I downloaded WinFox, but files were corrupted so I didn't install it.

-I downloaded and installed 3DAnalyze, but I couldn't get it to work with some of my games, so I left it alone (It was an extracted install, no reg edits).

-I downloaded and installed ATITools, but I couldn't get it to show my card information, so I uninstalled it.

-I downloaded and ran drivegleam, but it seemed useless, so I just closed it down.

-I downloaded and installed NVIDIA PerfKit, but it seemed to be purely SDK, so I couldn't use it and left it alone.

-I downloaded and installed RivaTuner, but Vista blocked driver installation. I didn't want to change Vista's driver handling policy, so I left it alone.

-I noticed a strange amount of HDD space disappeared over night (from 20GB free to 10GB free).

-I decided to run Disk Defragmenter on a schedule to see if that helped the strange disk space.

-Three times over a period of a week, the exact same program files were deleted by some unknown force.

-No personal files in my user-created directories were deleted.

-The files were completely deleted, as a non-indexed search pulled no results.

-Each time, I would reinstall/repair the programs affected: FireFox, AVG, Office, Adobe, others I can't remember.

-Virus and general Malware scans found nothing.

-By the third time, I decided to try a system restore, but all my recent restores were corrupted.

-I Restored to a time one week before any of this happened and then ran a full Check Disk on restart, which found no disk errors.

-I checked System logs and found no disk errors or any other errors other than programs not running because their files were missing.

-I decided to not reinstall AVG, because it was not working properly to begin with, and try out avast!.

-I tried to uninstall NVIDIA PerfKit, but it didn't recognize my system and couldn't start the uninstall.

-A couple days later, a couple display files for avast!'s GUI were deleted along with some parts of Adobe and Office.

-I repaired all three programs with little trouble.

-I decided to turn off Disk Defragmenter, suspecting it.

-I decided to manually remove all parts of NVIDIA PerfKit, suspecting it.

-I started running Process Monitor for several files that were commonly deleted.

-Process monitor froze Vista several times around 25,000,000 events do to PageFile being completely filled.

-I learned to have Process monitor automatically delete unimportant entries after 20,000,000 events to prevent freezes while I was away.

-After 2 weeks of constant scanning, Process Monitor found nothing, so I started scanning less frequently.

That's all I can say.

Possible fixes:

Check Disk on restart

Disk Defragmenter turned off

NVIDIA Perf SDK manually removed

Process Monitor freezing Vista forcing me to do a hard shutdown

[jnelsoninjax]

OK, it really sounds like there is a virus running around your system and I would wager that it is a boot sector virus, so a format would not get rid of it... as far as the hdd space dropping check this post: https://www.neowin.net/forum/index.php?show...718938&st=0, it also might help you with the other issues too! :)

One other option: You could totally wipe out any existing partition,reboot, create a new partition, wipe it out, reboot, create a new partition, re-install vista! This would be a way of purging the system of the virus.

Here is how to do that using the Vista DVD

1/ Switch on your PC

2/ Quickly insert the Vista DVD into your CD/DVD-ROM drive

3/ A message will appear asking you to 'Press any key to boot from CD/DVD

4/ Press any key

5/ A black screen will now appear with a progress bar along the bottom. The legend say's 'Windows is loading files'

6/ After the files have been loaded the Language screen will appear.

7/ Select your language from the list and press Next

8/ At the Installation screen press the Install Now button

9/ The product key window will now open

10/ Type your product key number into the available box and then press OK

11/ The End user License Agreement now appears. You 'must' accept this to continue

12/ At the next screen click on the Custom Install (Advanced) option

13/ The next screen to appear is 'Where do you want to install Windows'

14/ At the bottom of this window you will see an option marked Drive options (Advanced), click on this option

15/ In this Window select the partition you wish to Delete from the list available and then click the Delete option link

16/ A message will now appear informing you that 'If you delete this partition, all data stored on it will be permanently deleted.' Click OK to proceed

17/ Your Partition will now be deleted

[SynthetoBrick]

I appreciate the suggestion, John, but I'd rather live with a root-kit than reformat.

Reformatting would set me back at least 1 month to get everything set back up the way it is now.

That is valuable time I just do not have.

The problem just happened again, so before I try all kinds of over-the-top solutions, I'll gather as much information as I can.

d3dx9_39.dll seems to be tied directly to part of the issue.

Everyone once in a while, a program says it is unable to locate the component.

I look in system32 and it is sitting there, mocking me.

I assume there is a registry entry someone that is getting FUBAR'd.

Any suggestions on how to fix it without reinstalling the entire DX package?

Anyway...

I have Firefox running just doing nothing.

I tried to open a game, and I get the d3dx9_39.dll not found error.

I open up system32 and it is sitting right there, safe and sound.

I open up the Firefox install directory, and many of the files have been deleted, but Firefox is still running happily from memory.

I get a hit from Spybot S&D saying avast! was replacing a blank registry value with a skin location.

- Somehow the skin location was deleted without SpyBot noticing? wtf!

Edited January 28, 2009 by SynthetoBrick

[hadouken]

Are these disappearing files a temporary thing or do they re-appear once you've rebooted? I mean, you've been running the same system for a month now with files being deleted all the time, how can your system still be functional? Have you tried another file viewer, like "dir" in the command prompt?

If it's not a usermode program then it could be a system driver, maybe a file system filter (anti-virus programs use these). You can download Autoruns from technet, select the "Drivers" tab and look for anything that isn't by "Microsoft Corporation".

You could also boot into safe mode where only essential drivers will be loaded and see if files disappear there, too. Might eliminate some possibilites.

[SynthetoBrick]

Are these disappearing files a temporary thing or do they re-appear once you've rebooted? I mean, you've been running the same system for a month now with files being deleted all the time, how can your system still be functional? Have you tried another file viewer, like "dir" in the command prompt?

If it's not a usermode program then it could be a system driver, maybe a file system filter (anti-virus programs use these). You can download Autoruns from technet, select the "Drivers" tab and look for anything that isn't by "Microsoft Corporation".

You could also boot into safe mode where only essential drivers will be loaded and see if files disappear there, too. Might eliminate some possibilites.

Each time, files are permanently gone. Each time, I have to reinstall programs manually.

If I close Firefox right now, I won't be able to start it back up without reinstalling or finding the deleted files.

I have tried dir command in console, and the files are truly deleted.

I tried autoruns, a nice utility that helped me clean up some stuff.

I got rid of some Nero entries, but I have no clue if it will help or not.

This problem is so damn random, I could go another months before it happens again, or it could happen again tomorrow.

Edited January 28, 2009 by SynthetoBrick

[hadouken]

Did you check the "Drivers" tab on Autoruns? The reason I ask is because I think there could be a driver installed that's causing your problems, if so, it would be listed in the Drivers tab (by drivers I mean system code that is inserted into the Windows kernel, not just device drivers).

You say that it's random though and doesn't happen all of the time, so maybe it isn't a driver. I'm not sure what you could do next. :( My next course of action would be to try and deliberatly cause the problem and find out if something in particular is triggering it. Maybe keep a log of what programs are affected, which files are being deleted, dates/times etc, what other programs are running at the time, etc. Try to to find a pattern.

If there is something that triggers it, try going into safe mode and performing the same action there and see if files are deleted.

Does anyone else use your computer and do you have a firewall installed? The only other thing I could think of is if you are infected with malware or someone else is messing with your files.

[MilesM]

Hi, I just started having this problem as well. Has anyone found any solution to the problem? I've found one or two other threads dealing with this problem, but none of them for sure resolved.

Running Vista Ultimate x64 sp1. ATI HD3850 graphics card. I have the same firefox .ini problem and the directx .dll file problem. I'm using Kaspersky internet security, but this started a while into using Norton. I'm guessing this rules out the firewall/firefox incompatibility possibility. On my quest for a solution I've come across someone who suggested that their graphics card drivers might be causing the problem. I also found someone having the problem that solved it by downloading the whole directx sdk, rather than the online installation version, but he/she did not say if it worked for good. "until the next time the files are deleted" was what the person said, and so far after trying it I havn't had a problem. But this problem occurs at random it seems, so a month or so of no problems isn't unheard of.

I'm pretty adept with computers, but self-taught, so terminology usually goes over my head. A minimum of big words would be appreciated :p

Thanks

Miles

[SynthetoBrick]

I hate to perform necromancy on this thread, but the problem is still not solved.

Did you check the "Drivers" tab on Autoruns? The reason I ask is because I think there could be a driver installed that's causing your problems, if so, it would be listed in the Drivers tab (by drivers I mean system code that is inserted into the Windows kernel, not just device drivers).

You say that it's random though and doesn't happen all of the time, so maybe it isn't a driver. I'm not sure what you could do next. :( My next course of action would be to try and deliberatly cause the problem and find out if something in particular is triggering it. Maybe keep a log of what programs are affected, which files are being deleted, dates/times etc, what other programs are running at the time, etc. Try to to find a pattern.

If there is something that triggers it, try going into safe mode and performing the same action there and see if files are deleted.

Does anyone else use your computer and do you have a firewall installed? The only other thing I could think of is if you are infected with malware or someone else is messing with your files.

I've looked at the Drivers tab before, but I'm honestly not sure wht I should be looking for.

All I can say at this point is that it doesn't seem to be caused by my actions directly or at least not immediately.

I still strongly believe that a Vista service has gone awry and is responsible for all this turmoil.

I am the sole user of this laptop. Also, I use it far too frequently to stop connecting to the internet to see if I am being hijacked.

Hi, I just started having this problem as well. Has anyone found any solution to the problem? I've found one or two other threads dealing with this problem, but none of them for sure resolved.

Running Vista Ultimate x64 sp1. ATI HD3850 graphics card. I have the same firefox .ini problem and the directx .dll file problem. I'm using Kaspersky internet security, but this started a while into using Norton. I'm guessing this rules out the firewall/firefox incompatibility possibility. On my quest for a solution I've come across someone who suggested that their graphics card drivers might be causing the problem. I also found someone having the problem that solved it by downloading the whole directx sdk, rather than the online installation version, but he/she did not say if it worked for good. "until the next time the files are deleted" was what the person said, and so far after trying it I havn't had a problem. But this problem occurs at random it seems, so a month or so of no problems isn't unheard of.

I'm pretty adept with computers, but self-taught, so terminology usually goes over my head. A minimum of big words would be appreciated :p

Thanks

Miles

I am so glad that I am not the only one. I was thinking maybe I am just crazy.

I do have the DirectX SDK as I use it occasionally for testing games mods in beta or with my own small programs that I write.

However, that hasn't stopped the errors. Each time I have to run a DirectX standard setup and then the Web setup to get the DX dlls working again. Never understood why I can't just run one or the other.

Good luck to you in your defense of the vanishing files and registry entries. lol

As always, I will update this if I can determine anything new.