Shortcut opens wrong program.

[Peter Jason]

I have Windows 7.

One of the shortcuts on the desktop opens the wrong program and the
only way to close this is to use "end task" in Windows Manager.

Similarly if I go to the program itself and try to open this,I get the
same result.

The program is "Evidence Eliminator" and when I try to start it, it
opens another program in another folder.

Peter

 

[Nil]

I have Windows 7.

One of the shortcuts on the desktop opens the wrong program and
the only way to close this is to use "end task" in Windows
Manager.

What program does it open? Does that program not have a Quit option?

Similarly if I go to the program itself and try to open this,I get
the same result.

What do you mean "go to the program itself"? Do you mean you navigate
to the executable in the Program Files directory and run that?

The program is "Evidence Eliminator" and when I try to start it,
it opens another program in another folder.

I'd uninstall "Evidence Eliminator" and hope that solved the problem.
If it did, and if I thought I really needed it, I might then re-install
EE.

If that didn't do it, and since it's a commercial program, I'd contact
them for the support I paid for.

 

[richard]

I have Windows 7.

One of the shortcuts on the desktop opens the wrong program and the
only way to close this is to use "end task" in Windows Manager.

Similarly if I go to the program itself and try to open this,I get the
same result.

The program is "Evidence Eliminator" and when I try to start it, it
opens another program in another folder.

Peter

Dude, that program is the biggest fraud on the WWW.
I've seen him change hosts and domain names 6 times in a month!
You'd be better off trashing that thing entirely.

 

[Paul]

I'd uninstall "Evidence Eliminator" and hope that solved the problem.

Isn't there a danger, that uninstalling it right now, will delete
the "other program" ? If this is a file linkage problem (file
system pointer, points to wrong data).

I'd be more interested in how may other files do this,
whether chkdsk has been run recently (damage done
by chkdsk "repairing" something) or the like.

It's OK to be adventurous if there is a backup to rely
on - otherwise, I'd work a bit slower, in case there
is serious trouble there.

I'd also be curious as to whether the problem only showed up
after using EE on Windows 7, and whether EE is known to be
compatible with Windows 7. Windows 7 has junction points,
hard links, alternate streams, VirtualStore, and maybe
one of those features and EE, don't mix.

Paul

 

[Nil]

Isn't there a danger, that uninstalling it right now, will delete
the "other program" ? If this is a file linkage problem (file
system pointer, points to wrong data).

That hadn't occurred to me, but I suppose it's possible. I've never
heard of an issue like this before. Best to be cautious, I guess. I
can't imagine what would make executing one program would make another
program run... unless it was some insidious malware. I don't think file
system corruption would manifest itself that way, but ya never know...

After reading up about this program, "Evidence Eliminator," I wouldn't
trust it as far as I could throw it. I'd ditch it anyway I can and run
far away.

 

[Peter Jason]

Isn't there a danger, that uninstalling it right now, will delete
the "other program" ? If this is a file linkage problem (file
system pointer, points to wrong data).

I'd be more interested in how may other files do this,
whether chkdsk has been run recently (damage done
by chkdsk "repairing" something) or the like.


It's OK to be adventurous if there is a backup to rely
on - otherwise, I'd work a bit slower, in case there
is serious trouble there.

I'd also be curious as to whether the problem only showed up
after using EE on Windows 7, and whether EE is known to be
compatible with Windows 7. Windows 7 has junction points,
hard links, alternate streams, VirtualStore, and maybe
one of those features and EE, don't mix.

Paul

 

[Peter Jason]

Dude, that program is the biggest fraud on the WWW.
I've seen him change hosts and domain names 6 times in a month!
You'd be better off trashing that thing entirely.

It has fields to enter registry destinations for deletion, such as
those recording a particular USB thumb drive, its last date and
destinations.

Is there some similar software which will do this?

 

[Peter Jason]

Isn't there a danger, that uninstalling it right now, will delete
the "other program" ? If this is a file linkage problem (file
system pointer, points to wrong data).

I'd be more interested in how may other files do this,
whether chkdsk has been run recently (damage done
by chkdsk "repairing" something) or the like.

About a month ago I had that noisy HDD problem and I ran chkdsk that
showed up problems. Just before this "Security Essentials" reported
2 viruses that it deleted.
All the HDD noise stopped after running chkdsk.

It's OK to be adventurous if there is a backup to rely
on - otherwise, I'd work a bit slower, in case there
is serious trouble there.

I'd also be curious as to whether the problem only showed up
after using EE on Windows 7, and whether EE is known to be
compatible with Windows 7. Windows 7 has junction points,
hard links, alternate streams, VirtualStore, and maybe
one of those features and EE, don't mix.

Well it was working before about a month ago.

Paul

I'll do a few more tests & report back.

 

[Char Jackson]

It has fields to enter registry destinations for deletion, such as
those recording a particular USB thumb drive, its last date and
destinations.

Is there some similar software which will do this?

I'm not sure you could be less clear if you tried, but perhaps give
CCleaner a look. It's free and is much more respected than the snake
oil you currently have installed.

<http://www.piriform.com/CCLEANER>

 

[KCB]

I have Windows 7.

One of the shortcuts on the desktop opens the wrong program and the
only way to close this is to use "end task" in Windows Manager.

Similarly if I go to the program itself and try to open this,I get the
same result.

The program is "Evidence Eliminator" and when I try to start it, it
opens another program in another folder.

Peter

According to the Support Knowledge Base for EE, you need to have version
6.03 to be compatible with Windows 7. Are you using the right version?

 

[Peter Jason]

I'm not sure you could be less clear if you tried, but perhaps give
CCleaner a look. It's free and is much more respected than the snake
oil you currently have installed.

<http://www.piriform.com/CCLEANER>

I have deleted the "Evidence Eliminator" and then done a chkdsk on the
system drive. (Took forever) But I need to know:

1/ where are the chkdsk results posted? Some log file?

2/ How do I tell CCleaner the registry path to delete the USBSTOR
entries?

Peter

 

[Char Jackson]

I have deleted the "Evidence Eliminator" and then done a chkdsk on the
system drive. (Took forever) But I need to know:

1/ where are the chkdsk results posted? Some log file?

I always just check the status message from the program itself before
I dismiss it.

But here you go, try these solutions:

2/ How do I tell CCleaner the registry path to delete the USBSTOR
entries?

My recommendation is not to go anywhere near the Registry, not even
with CCleaner.

What exactly are you trying to delete, and why? If it's always the
same Registry key, you might just create a script that deletes that
key, then recreates a new (empty) key with the same name. Of course,
there are numerous ways to achieve about the same thing.

 

[Peter Jason]

I always just check the status message from the program itself before
I dismiss it.

But here you go, try these solutions:
<http://forums.techarena.in/windows-xp-support/866643.htm>

I checked this site and did what it said. I went to "Event Viewer",
then to WindowsLogs/Applications and looked for a matching "Winlogon
with the Error ID 1001. No such match. Does this mean the chkdsk
gave no errors?

 

[Nil]

1/ where are the chkdsk results posted? Some log file?

Control Panel | Adminstrative Tools | Event Viewer | Application. Look
for Event ID 26212.

 

[Peter Jason]

Control Panel | Adminstrative Tools | Event Viewer | Application. Look
for Event ID 26212.

I found data from a chkdsk about a month ago, VIS:

************
Chkdsk was executed in read/write mode.

Checking file system on F:
Volume label is LIBRARY.

CHKDSK is verifying files (stage 1 of 5)...
33024 file records processed. File verification completed.
14 large file records processed. 0 bad file records processed.
0 EA records processed. 0
reparse records processed. CHKDSK is verifying indexes (stage 2 of
5)...
34794 index entries processed. Index verification completed.


CHKDSK is verifying security descriptors (stage 3 of 5)...
33024 file SDs/SIDs processed. Cleaning up 39 unused index entries
from index $SII of file 0x9.
Cleaning up 39 unused index entries from index $SDH of file 0x9.
Cleaning up 39 unused security descriptors.
Security descriptor verification completed.
885 data files processed. CHKDSK is verifying file data (stage 4 of
5)...
33008 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
124608310 free clusters processed. Free space verification is
complete.
Windows has checked the file system and found no problems.

976760000 KB total disk space.
478184732 KB in 31879 files.
13236 KB in 887 indexes.
128792 KB in use by the system.
65536 KB occupied by the log file.
498433240 KB available on disk.

4096 bytes in each allocation unit.
244190000 total allocation units on disk.
124608310 allocation units available on disk.

**************

Note that this ID was 26214





Bur I found the results from the latest scan (yesterday) with an Event
ID of 1001, with the Source = wininit VIS:

**************


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
324864 file records processed. File verification completed.
485 large file records processed. 0 bad file records processed.
2 EA records processed.
76 reparse records processed. CHKDSK is verifying indexes (stage 2 of
5)...
410770 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is
verifying security descriptors (stage 3 of 5)...
324864 file SDs/SIDs processed. Cleaning up 73 unused index entries
from index $SII of file 0x9.
Cleaning up 73 unused index entries from index $SDH of file 0x9.
Cleaning up 73 unused security descriptors.
Security descriptor verification completed.
42954 data files processed. CHKDSK is verifying Usn Journal...
33984216 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
324848 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
175715365 free clusters processed. Free space verification is
complete.
Windows has checked the file system and found no problems.

976657407 KB total disk space.
273199700 KB in 270949 files.
139076 KB in 42955 indexes.
0 KB in bad sectors.
457167 KB in use by the system.
65536 KB occupied by the log file.
702861464 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
175715366 allocation units available on disk.

Internal Info:
00 f5 04 00 39 ca 04 00 d7 d9 07 00 00 00 00 00 ....9...........
02 24 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 .$..L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

******************

Is this all OK?

 

[Nil]

I'm not in expert in file systems, but everything looks OK to me. Maybe
someone else will chip in if they see something unusual in the logs. I
can't explain the different Event IDs.

 

[Paul]

I found data from a chkdsk about a month ago, VIS:

************
Chkdsk was executed in read/write mode.

Checking file system on F:
Volume label is LIBRARY.

CHKDSK is verifying files (stage 1 of 5)...
33024 file records processed. File verification completed.
14 large file records processed. 0 bad file records processed.
0 EA records processed. 0
reparse records processed. CHKDSK is verifying indexes (stage 2 of
5)...
34794 index entries processed. Index verification completed.


CHKDSK is verifying security descriptors (stage 3 of 5)...
33024 file SDs/SIDs processed. Cleaning up 39 unused index entries
from index $SII of file 0x9.
Cleaning up 39 unused index entries from index $SDH of file 0x9.
Cleaning up 39 unused security descriptors.
Security descriptor verification completed.
885 data files processed. CHKDSK is verifying file data (stage 4 of
5)...
33008 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
124608310 free clusters processed. Free space verification is
complete.
Windows has checked the file system and found no problems.

976760000 KB total disk space.
478184732 KB in 31879 files.
13236 KB in 887 indexes.
128792 KB in use by the system.
65536 KB occupied by the log file.
498433240 KB available on disk.

4096 bytes in each allocation unit.
244190000 total allocation units on disk.
124608310 allocation units available on disk.

**************

Note that this ID was 26214





Bur I found the results from the latest scan (yesterday) with an Event
ID of 1001, with the Source = wininit VIS:

**************


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
324864 file records processed. File verification completed.
485 large file records processed. 0 bad file records processed.
2 EA records processed.
76 reparse records processed. CHKDSK is verifying indexes (stage 2 of
5)...
410770 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is
verifying security descriptors (stage 3 of 5)...
324864 file SDs/SIDs processed. Cleaning up 73 unused index entries
from index $SII of file 0x9.
Cleaning up 73 unused index entries from index $SDH of file 0x9.
Cleaning up 73 unused security descriptors.
Security descriptor verification completed.
42954 data files processed. CHKDSK is verifying Usn Journal...
33984216 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
324848 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
175715365 free clusters processed. Free space verification is
complete.
Windows has checked the file system and found no problems.

976657407 KB total disk space.
273199700 KB in 270949 files.
139076 KB in 42955 indexes.
0 KB in bad sectors.
457167 KB in use by the system.
65536 KB occupied by the log file.
702861464 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
175715366 allocation units available on disk.

Internal Info:
00 f5 04 00 39 ca 04 00 d7 d9 07 00 00 00 00 00 ....9...........
02 24 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 .$..L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

******************

Is this all OK?

So it's no longer stuck in a loop ?

If CHKDSK now runs every time, with no problems
found after each run, maybe, just maybe, it's fixed.
But there is no real way to know for sure, unless
an independent verification mechanism is available...

Have you stopped using EE for the moment ? I'd do some
CHKDSK runs, where no EE activity at all was involved,
so there can be no additional damage. If everything
checks out, then it's entirely up to you, what you do
next.

*******

If it was my C: drive, I'm the suspicious type, and
I'd probably try to move the data off and move it
back again. But I haven't tried that on Windows 7 yet,
so don't know what issues will arise (like, how to get
the thing booting again, after I'm finished). My
technique, doesn't copy the partition boot sector,
so when I'm finished, the equivalent of "fixboot" is
required before C: will boot again. I wouldn't expect
anything to go wrong, but haven't verified the technique
yet on Windows 7.

I use my technique (copy with Robocopy) on my WinXP C:
drive, move the data off, reformat C: (which wipes out
the partition boot sector), then copy the files back.
Then, I have to do a "fixboot" to get it bootable again.

Perhaps I'd need a more modern version of Robocopy (it
may already be on the Windows 7 disk, version 027?), or
something like Richcopy.

http://en.wikipedia.org/wiki/RichCopy

I like to play around like that, and the reason I can
do stuff like that, is doing a sector by sector backup
before trying it. If I foul it up, or get stuck half
way through, I can always roll back to where I was before
(just takes time for the copy to complete). The first
time I did some stuff with the laptop, I actually pulled
the drive out of the laptop, and slaved it to the desktop,
to speed up the operation. Using a USB enclosure for
backups, is a bit slower by comparison (i.e. leave
laptop drive in laptop, connect USB hard drive and do
a sector by sector backup that way, for safety). So far,
there is no USB3 in the house, so I'm still stuck with
30MB/sec speeds.

The modern SATA laptop drive, makes it real easy to
temporarily put the SATA drive inside the desktop
computer, because the 3.5" cabling works with the
2.5" SATA drive.

Paul

 

[Peter Jason]

So it's no longer stuck in a loop ?

If CHKDSK now runs every time, with no problems
found after each run, maybe, just maybe, it's fixed.
But there is no real way to know for sure, unless
an independent verification mechanism is available...

Have you stopped using EE for the moment ? I'd do some
CHKDSK runs, where no EE activity at all was involved,
so there can be no additional damage. If everything
checks out, then it's entirely up to you, what you do
next.

I removed the EE just before the chkdsk scan. I might reinstal it
later.

*******

If it was my C: drive, I'm the suspicious type, and
I'd probably try to move the data off and move it
back again. But I haven't tried that on Windows 7 yet,
so don't know what issues will arise (like, how to get
the thing booting again, after I'm finished). My
technique, doesn't copy the partition boot sector,
so when I'm finished, the equivalent of "fixboot" is
required before C: will boot again. I wouldn't expect
anything to go wrong, but haven't verified the technique
yet on Windows 7.

I use my technique (copy with Robocopy) on my WinXP C:
drive, move the data off, reformat C: (which wipes out
the partition boot sector), then copy the files back.
Then, I have to do a "fixboot" to get it bootable again.

Perhaps I'd need a more modern version of Robocopy (it
may already be on the Windows 7 disk, version 027?), or
something like Richcopy.

http://en.wikipedia.org/wiki/RichCopy

I like to play around like that, and the reason I can
do stuff like that, is doing a sector by sector backup
before trying it. If I foul it up, or get stuck half
way through, I can always roll back to where I was before
(just takes time for the copy to complete). The first
time I did some stuff with the laptop, I actually pulled
the drive out of the laptop, and slaved it to the desktop,
to speed up the operation. Using a USB enclosure for
backups, is a bit slower by comparison (i.e. leave
laptop drive in laptop, connect USB hard drive and do
a sector by sector backup that way, for safety). So far,
there is no USB3 in the house, so I'm still stuck with
30MB/sec speeds.

The modern SATA laptop drive, makes it real easy to
temporarily put the SATA drive inside the desktop
computer, because the 3.5" cabling works with the
2.5" SATA drive.

Paul

I have a WD "Centenial" 1Tb HDD spare next to the computer just in
case. I want to transfer everything over to this as soon as I figure
out how. I guess HDDs are like car batteries; change them every 2
years.

Peter