Win 7 Pro puts two deleted new folders in recycle bin on reboot

[dweebken]

Ever since this week's MS update, Win 7 Pro 64 bit has been putting two
empty new folders in the recycle bin when I shutdown and restart the
computer. they're always called New Folder (2) and New Folder (3)... I
can purge them from the recycle bin ok, but on the next reboot cycle
they come back. It only happens on one machine - I have two similar
machines, and the machine that it's happening on had a complete rebuild
only a few days prior to the Windows update so its virtually a virgin
machine. 'cept now it's been screwed a bit... Anyway, if someone has any
hints on how to fix this without another 5-day rebuild and reconfigure,
I'd be eternally gratedul for a while.

Thanks

 

[BillW50]

In

Ever since this week's MS update, Win 7 Pro 64 bit has been putting
two empty new folders in the recycle bin when I shutdown and restart
the computer. they're always called New Folder (2) and New Folder
(3)... I can purge them from the recycle bin ok, but on the next
reboot cycle they come back. It only happens on one machine - I have
two similar machines, and the machine that it's happening on had a
complete rebuild only a few days prior to the Windows update so its
virtually a virgin machine. 'cept now it's been screwed a bit...
Anyway, if someone has any hints on how to fix this without another
5-day rebuild and reconfigure, I'd be eternally gratedul for a while.

Thanks

I too have experienced endless updates that go bad for over 10 years
now! And back in 2008, I was forced to stop updating on an EeePC 701
with a soldered in 4GB SSD. As the updates just won't fit on the drive.
And I thought I would have to restore routinely from backups since I
fully expected to be plagued by endless malware infections.

Oddly enough that didn't happen. Not one single malware infection. So I
stopped updating on about 6 test computers to see what would happen to
them. Well four years later, they haven't been infected with malware
either.

So nowadays I only install an update if it addresses a bug that I am
dealing with. And there is a lot of truth in the old saying don't fix
something that isn't broke.

 

[Paul]

Ever since this week's MS update, Win 7 Pro 64 bit has been putting two
empty new folders in the recycle bin when I shutdown and restart the
computer. they're always called New Folder (2) and New Folder (3)... I
can purge them from the recycle bin ok, but on the next reboot cycle
they come back. It only happens on one machine - I have two similar
machines, and the machine that it's happening on had a complete rebuild
only a few days prior to the Windows update so its virtually a virgin
machine. 'cept now it's been screwed a bit... Anyway, if someone has any
hints on how to fix this without another 5-day rebuild and reconfigure,
I'd be eternally gratedul for a while.

Thanks

I wonder if it is an update that isn't "taking", and is trying
to finish installing over and over again ? When things install,
if they're a part of the OS, a portion of the install happens
before shutdown, and a portion can happen at startup. Maybe
the portion at startup has failed, and the update from Windows
Update, tries to install it just before the next shutdown again.

Other than that, it could be quite difficult to debug with free
tools. While a Sysinternals program can be used to log some
kinds of system activity, the question would be, whether you
could arrange such a tool to run early enough, to catch the
"New Folder (2) writer".

*******

You know, it took me the longest while to figure out where a
folder called "DragonDropProcessFolder" in my temp was coming
from. For about a year, I figured it was some software I'd
installed and tested and then uninstalled again, and I figured
some part of it was left behind. I couldn't find a corresponding
startup item or anything (with tools like Autoruns). Eventually,
purely by accident, I narrowed it down to VPC2007 (virtual PC).
It was showing up after a virtual PC session. It was a relief
it wasn't an "unwanted visitor" of some sort

Paul

 

[BillW50]

In

I wonder if it is an update that isn't "taking", and is trying
to finish installing over and over again ? When things install,
if they're a part of the OS, a portion of the install happens
before shutdown, and a portion can happen at startup. Maybe
the portion at startup has failed, and the update from Windows
Update, tries to install it just before the next shutdown again.

Other than that, it could be quite difficult to debug with free
tools. While a Sysinternals program can be used to log some
kinds of system activity, the question would be, whether you
could arrange such a tool to run early enough, to catch the
"New Folder (2) writer".

*******

You know, it took me the longest while to figure out where a
folder called "DragonDropProcessFolder" in my temp was coming
from. For about a year, I figured it was some software I'd
installed and tested and then uninstalled again, and I figured
some part of it was left behind. I couldn't find a corresponding
startup item or anything (with tools like Autoruns). Eventually,
purely by accident, I narrowed it down to VPC2007 (virtual PC).
It was showing up after a virtual PC session. It was a relief
it wasn't an "unwanted visitor" of some sort

Paul

Wouldn't Sysinternals catch your "DragonDropProcessFolder" creation,
Paul?

Process Monitor
http://technet.microsoft.com/en-us/sysinternals/bb896645

 

[Dave \Crash\ Dummy]

Ever since this week's MS update, Win 7 Pro 64 bit has been putting
two empty new folders in the recycle bin when I shutdown and restart
the computer. they're always called New Folder (2) and New Folder
(3)... I can purge them from the recycle bin ok, but on the next
reboot cycle they come back. It only happens on one machine - I have
two similar machines, and the machine that it's happening on had a
complete rebuild only a few days prior to the Windows update so its
virtually a virgin machine. 'cept now it's been screwed a bit...
Anyway, if someone has any hints on how to fix this without another
5-day rebuild and reconfigure, I'd be eternally gratedul for a while.

If you know which update it is, uninstall it and reinstall it using
"Check for updates." If you don't know which one, uninstall all of them
from the latest update and reinstall them one at a time.

To uninstall updates, open Windows Update and select "Installed Updates"
at the bottom of the left column. Updates will be listed last first,
with the install date in the far right column. Directions for
uninstalling are at the top of the page.

 

[Paul]

In

Wouldn't Sysinternals catch your "DragonDropProcessFolder" creation,
Paul?

Process Monitor
http://technet.microsoft.com/en-us/sysinternals/bb896645

The problem is, you can't run the necessary tool for too long,
because of the quantity of data it accumulates. It was only
later, that I discovered it can dump to RAM or dump to disk,
and if you use the disk option, you'd have more room to collect
samples.

Maybe it could have caught it, if I'd run it all day
long, but I wonder if eventually it would slow the system
down to the point it would be unusable ? I've never tried that.
Usually when I do that kind of testing, I aim for short test
runs, in case I need to scroll through all the samples. When I
fixed a registry problem associated with a "mixer.exe" installed
on my system, I had to scroll through roughly 100,000 registry
access entries, to find the one that was actually breaking things.
Doing it that way, can on occasion be a "needle in a haystack"
situation. And that's why I don't do that kind of analysis
all that often. Because I know I'm going to physically suffer
for it (all that scrolling).

Maybe if someone made a tool that just logged new file or
folder creation, it might be easier. But Process Monitor
(procmon.exe) can create a lot of data in a hurry.

http://technet.microsoft.com/en-us/sysinternals/bb896645

The only resource capture I can see in procmon for this, is

"Operation" "is" "CreateFile"

which would capture every file and folder created after
you started the run. So you'd have to scroll through it, until
you found the event. I don't see an option to flag a particular
filename. And when I tested it, it captured 700 entries in
one minute, many of which look bogus (they can't possibly
all be brand new files - lots of the file names are system
files).

If I take the properties of one of those entries as an example,
this is the kind of information I can get. So you might be
able to get some idea this way. If it was a Windows Update,
then you'd expect something appropriately named for that.

CreateFile
C:\WINDOWS\system32\wbem\Logs\wbemcore.log

Process = "C:\WINDOWS\System32\svchost.exe -k netsvcs"
Stack = wbemcomn.dll (most likely item in list, it's not specific)

Paul

 

[BillW50]

In

The problem is, you can't run the necessary tool for too long,
because of the quantity of data it accumulates. It was only
later, that I discovered it can dump to RAM or dump to disk,
and if you use the disk option, you'd have more room to collect
samples.

Maybe it could have caught it, if I'd run it all day
long, but I wonder if eventually it would slow the system
down to the point it would be unusable ? I've never tried that.
Usually when I do that kind of testing, I aim for short test
runs, in case I need to scroll through all the samples. When I
fixed a registry problem associated with a "mixer.exe" installed
on my system, I had to scroll through roughly 100,000 registry
access entries, to find the one that was actually breaking things.
Doing it that way, can on occasion be a "needle in a haystack"
situation. And that's why I don't do that kind of analysis
all that often. Because I know I'm going to physically suffer
for it (all that scrolling).

Maybe if someone made a tool that just logged new file or
folder creation, it might be easier. But Process Monitor
(procmon.exe) can create a lot of data in a hurry.

http://technet.microsoft.com/en-us/sysinternals/bb896645

The only resource capture I can see in procmon for this, is

"Operation" "is" "CreateFile"

which would capture every file and folder created after
you started the run. So you'd have to scroll through it, until
you found the event. I don't see an option to flag a particular
filename. And when I tested it, it captured 700 entries in
one minute, many of which look bogus (they can't possibly
all be brand new files - lots of the file names are system
files).

If I take the properties of one of those entries as an example,
this is the kind of information I can get. So you might be
able to get some idea this way. If it was a Windows Update,
then you'd expect something appropriately named for that.

CreateFile
C:\WINDOWS\system32\wbem\Logs\wbemcore.log

Process = "C:\WINDOWS\System32\svchost.exe -k netsvcs"
Stack = wbemcomn.dll (most likely item in list, it's not specific)

Paul

There are a number of folder monitors out there besides Process Monitor.
Here is a very simple one with very few options. But it still gets the
job done. Although it doesn't tell you what process caused the disk
access.

Moo0 FileMonitor (Free) - Monitor file access easily
http://www.moo0.com/software/FileMonitor/