Welcome to Smokey's Security Forums.
Guests have only limited access to the board and it's features, please consider registering to gain full access!
Registration is free and it only takes a few moments to complete.

Smokey's Security Forums

Please login or register.

Login with username, password and session length
Advanced search  

News:

Adobe has issued a security update to its Shockwave Player which patches quite a few critical vulnerabilities. Many of the vulnerabilities could have allowed attackers to execute arbitrary code on the target machine.

Adobe Shockwave Player 11.5.8.612 Plugs 18 Critical Holes

Multilingual OTL (OldTimer ListIt) Log Analysis * Multilingual OTL Tutorials * OTL Downloads * Malware Removal * Microsoft Security Info & Alert Center * Official Jetico Inc. Support Forums

Share this topic on FacebookShare this topic on MySpaceShare this topic on Del.icio.usShare this topic on DiggShare this topic on RedditShare this topic on StumbleUponShare this topic on TwitterAuthorTopic: 20GB of files in C:\~BCWipe.del  (Read 1698 times)

0 Members and 1 Guest are viewing this topic.

Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #15 on: March 03, 2010, 07:56:35 AM »
We have got to the bottom of the problem. It happened after installation of Webroot
SpySweeper anti-spyware program on the test system.
Some anti-virus and anti-spyware programs create (and delete)  small TMP file for each record to a TXT file.
If generation of the log file is enabled in BCWipe  Transparent Wiping task, then the following happens:
-->BCWipe makes two records for each deleted file.
-->SpySweeper creates two temporary files (one for each record) and deletes them.
-->BCWipe takes those files for Transparent Wiping and makes 4 records in the log file.
-->SpySweeper creates 4 temporary files and so on.

So BCWipe wipes its own log files and reports the success in the log file - the process will never finish. Transparent Wiping process is working, but BCWipe.del directory grows and eats up the free space.

In future version we will add the special tool that will detect such case (by size of BCWipe.del)
and ask user to exclude the application from Transparent Wiping.

Right now, if you find out that your BCWipe.del directory is growing, we recommend to take a look at the logfile to know what application is the most active in deleting the files and put the application to application exclude list.


Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #14 on: March 02, 2010, 04:17:05 AM »
We would greatly appreciate if you report ANY result here.
Please install the latest version and report here whether the issue can be reproduced again.

We were able to get the effect and it disappeared with the newest version.
However we cannot be sure that the fix covers all possible cases.

Any information concerning the current version would be highly appreciated.
We would like to report that the issue has been resolved.

Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #13 on: March 01, 2010, 03:59:10 PM »
Everybody who has encountered this problem - please download and install the latest version of BCWipe - v4.01.8

http://www.jetico.com/bcwipe4.exe

If ~BCWipe.del directory fills the disk space again - please let us know.

GrtEsc

  • Member
  • *
  • Offline Offline
  • Posts: 5
Re: 20GB of files in C:\~BCWipe.del
« Reply #12 on: February 28, 2010, 03:48:32 PM »
I've been working with Jetico Tech Support on this issue for my system (Vista 32-bit). It appears to be a known (at least now) problem and they are working on it. I must say that they've been very responsive in trying to identify and fix the issue. They seem to be pretty close. I assume once they definitively identify the cause they will produce a 64-bit version as well. I'll keep the board posted on the outcome.

nfibnfib

  • Member
  • *
  • Offline Offline
  • Posts: 1
Re: 20GB of files in C:\~BCWipe.del
« Reply #11 on: February 28, 2010, 01:24:33 AM »
I am having the same problem on windows vista 64 ultimate.  The ~BCWipe.del file grows over 80GB overnight when I run my nightly AVG virus scan.  For some reason this is slowing windows to a crawl and causing my ram to get filled up.  I believe that it is due to the OS having to keep track of the amount of files in the ~BCWipe.del folder (200,000+).  Anyway haven't found any solution yet other than turning off transparent wiping.   

GrtEsc

  • Member
  • *
  • Offline Offline
  • Posts: 5
Re: 20GB of files in C:\~BCWipe.del
« Reply #10 on: January 24, 2010, 03:06:35 PM »
Tarsins,

Jetico Support gave me a new BCWipeTM file with additional logging a few days ago. Still having the same problem, but at least there's (hopefully) more information about what's happening now. I'll keep the board posted...

tarsins

  • Member
  • *
  • Offline Offline
  • Posts: 1
Re: 20GB of files in C:\~BCWipe.del
« Reply #9 on: January 24, 2010, 10:39:15 AM »
I am having this problem in Windows 7 64-bit.

There are two BCWipeTM processes. Their command lines are:
"C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe" TransparentWiping
"C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe" /user:S-1-5-21-3300115448-2408146327-340162759-1000 waitForEndSession

If I run the Transparent Wiping Tasks Properties from the tray I keep gettinhg a "Item already exists in wipe list" message box.

I'm currently trialling BCWipe so this is a bit of a show stopper.

GrtEsc

  • Member
  • *
  • Offline Offline
  • Posts: 5
Re: 20GB of files in C:\~BCWipe.del
« Reply #8 on: January 19, 2010, 04:15:34 AM »
I do not see any BCWipeTM processes in the process list.

I check the log file. There are lots of "Success lines", then a steady stream of "Action: File queued for wiping" lines without any "success" lines after that. That's when the ~BCWipe.del directory starts filling up.

Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #7 on: January 18, 2010, 09:01:24 AM »
Thank you for the important information.
Could you please perform two more steps to help us to investigate the case?
1. Check if "BCWipeTM.exe" process exists in the list of active processes in Windows Task Manager(ALT-CTRL-DELETE). Please set the "View" to display the command line of the process.
There are two "BCWipeTM.exe" processes - with the parameter "WaitForEndSession" and with the parameter "Transparent Wiping". We are interested in the second one - does it exist?

2. Please take a look at the Transparent Wiping logfile - does it report errors for every file deleted in the system?

We would greatly appreciate your assistance.

GrtEsc

  • Member
  • *
  • Offline Offline
  • Posts: 5
Re: 20GB of files in C:\~BCWipe.del
« Reply #6 on: January 15, 2010, 09:15:02 PM »
The BCWipe service is started when the computer starts up and continues to show a running state. It even deletes files from the ~BCWipe.del directory for a while. Then it stops deleting the files. The service shows it is still in a running state but the files never get deleted form the directory.

Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #5 on: January 14, 2010, 06:57:42 AM »
It seems that  BCWipe Service was not started or was stopped on your system.
Could you please check if it is loaded or not:
- Run Start-->Run, type "services.msc" - the list of loaded services will appear.
- find BCWipe Service and see the current status - "started" or "stopped".
If it is stopped for some reason, please start it by right-clicking and running Start command.

Please reboot and check again if the service is running or not.
If it is stopped - it means that something in your system does not allow BCWipe service to start at system startup.
It may be antivirus or firewall or other installed software.
And that is why the ~BCWipe.del folder grows.

Please let us know the results of your investigations.

GrtEsc

  • Member
  • *
  • Offline Offline
  • Posts: 5
Re: Re: 20GB of files in C:\~BCWipe.del
« Reply #4 on: January 14, 2010, 01:50:31 AM »
I recently started having this same problem. I tried uninstalling and reinstalling (BCWipe 4.01.3) but the number of files in C:\~BCWipe.del just keeps growing. Manually erasing them (with RightClick->Delete with Wiping) works, but the system recreated the directory and starts adding more files to it. I also tried pausing & restarting the Transparent Wiping Task with no success.

Has anyone come up with a solution to this problem? It would appear that Transparent Wiping is not doing what it is advertised to do!

We were disturbed by your complaint.
Could you please report the current situation? Did BCWipe wipe these files?
Or did you delete them yourself? Does Transparent Wiping work now on your system?

Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #3 on: November 26, 2009, 04:14:00 AM »
We were disturbed by your complaint.
Could you please report the current situation? Did BCWipe wipe these files?
Or did you delete them yourself? Does Transparent Wiping work now on your system?

Jetico

  • Jetico Support Engineer
  • *
  • Offline Offline
  • Posts: 684
Re: 20GB of files in C:\~BCWipe.del
« Reply #2 on: November 23, 2009, 08:44:13 AM »
Are you running the final release of BCWipe or a beta version?
Are you sure that Transparent Wiping is active? What is the status of the task reported by TW systray icon and in TW task properties? Try to switch the TW task to "paused" and then to enable it again.
Use log file to see whether the settings are updated and to check if TW is actually active or not.

EolTopic starter

  • Member
  • *
  • Offline Offline
  • Posts: 6
20GB of files in C:\~BCWipe.del
« Reply #1 on: November 22, 2009, 01:21:47 PM »
Using 4.0.1 and noticed that BCWipe (Win7) has about 20GB's of files laying arouind in C:\~BCWipe.del just taking up space, some of these files go back weeks.  I thought maybe they were laying around waiting to be processed but BCWipe task isn't showing activity.  I can manually go in and wipe them but this seems to defeat the purpose of transparent wiping.
 

* Permissions
You can't post new topics.
You can't post replies.
You can't post attachments.
You can't modify your posts.
BBCode Enabled
Smilies Enabled
[img] Enabled
HTML Disabled


Except where otherwise stated, all content © 2006 - 2010 Smokey Services™ -- All rights reserved
Design of all board graphics, banners and images by Emma aka Tinker - © 2006 - 2010 Smokey Services™ -- All rights reserved
Smokey's Security Forums is member AQMRB - Alliance of Qualified Malware Removal Boards™, an organisation of Approved Qualified Malware Removal Help & Support Boards
Member ASAP - Alliance of Security Analysis Professionals™

    

  

Smokey's provide fully qualified OTL (OldTimer ListIt) Log Analysis & Malware Removal services in English, German and Spanish language