Program Updates Are Replaced with Earlier Files

[Roger...]

For about the last 4-months I've found a series of problems on this computer.   Some time in January 2014 folder permissions got buggered up preventing access in some cases.  MS provided a Folder Repair plus a few other methods and some of the folder permission issues were solved.  Not all got fixed, but "Windows Repair" seems to have cleaned up the folders I've checked.

What hasn't been resolved is in how my daily data updating program can't be updated to a current release.  To get  new updated exe files I need to update the software on my laptop and then copy the changed files to this computer.  That works well, but it is clumsy and will only work as long as there aren't any registry changes involved.

When the same updating software is run on this program Windows forces the files back to a version that was released in early January.  This means that files that were copied to the disk from the laptop with dates in early April of this year get replaced with files released in January of this year.

File searches of this computer's disk to find those earlier files never locates the source of where those earlier file versions are hiding.

There are other issues like how the dialog that needs action and has focus doesn't always appear on top, but instead if most often hiding behind other windows.

If I could get either of these issues resolved it would bring Win-7 back to what it can be, and that would be a relief.

Attached file is a text record of the main display from System Information.

[Shane]

Are you also checking the versions of the files as well? I am curious to see if the files are actually changing but Windows isnt updating the time modified info on it. So the best way to tell is to see if the file versions match.

If the file versions are newer when you install the update but then go back to old versions then you have something that is replacing the files and not just the time modified. If that is the case we need to see if for some reason Windows is doing that, which I have seen only happen a few times as the files where loaded into memory and then written back to the drive after. Normally a reboot and then update without opening the program will do that trick. But lets take it one step at a time 

Shane

[Roger...]

Hello Shane.
Thank you for responding.  This issue has me baffled.

Mouse over file to Pop-Up version data:
Old File: 2.10.7.566
New File: 2.10.7.622

Program features are also changed with the new file as an additional confirmation.

I've tried to do an update right after a disabled/enabled fresh boot with no change.  I'm admin on this machine, but have used the "Run as Administration" option.  OS uses AVG Pro, and that is always disabled. 

Thanks again,
Roger...

[Shane]

OK good so the file versions are different. So when the files are put back do they go back to the old versions?

If they are being replaced then we need to trace down what is doing the replacing back tot he old versions.

This program here can help us with that
http://technet.microsoft.com/en-us/sysinternals/bb896645

It has filters where we can add to only watch certain things, then we can findout what is putting those files back.

Shane

[Roger...]

Process Monitor is running and showing a huge amount of detail.  When I tried to view the Help file in the folder where it open, it shows all the Help topics, but the content on the displayed pages is missing. 

Can you share the details on the filters that should be enabled?

Also, I'm open to a remote session and payment for your time.

My internet connection will be offline for a few hours while the local ATT technician attempts to solve connection issues.  This means my next response will be delay to any posting after the next 20-minutes or less.

Thank you,
Roger...

[Shane]

In the program click on filter menu and then filter under it.

Once that is open, in the first drop down box choose "Path" Then the next box put it to "Contains" then the third box put the folder path to the program where the files are being repplaced. That should do the trick to filter the results and only show anything that touches that folder

Shane

[Roger...]

I tried to post this yesterday and again earlier this AM along with the process monitor's log file, but they didn't stick.  I'm now thinking the log file was too large to be compatible with the Reply Upload option, which aborted the reply.  It is now uploaded to this folder and will be cleared after you've had a chance to retrieve the file.
   http://tinyurl.com/moz8l8t  (44+ MB Text File)

Sorry for the delay and for trying to attach a file that was too large.

After a cold power-disconnected boot the file update test was executed with the process monitor active to watch for the actions during an update.  Results of those test generated two different results using the same updating file on two different directories.  Results in the directory that had the same files as those in the updating file were different than those in the directory where none of the problem files were present.

Update Test: 1
Perform an update using the current updating file on the working folder where the data downloading software runs each day.  This folder had the current files in place.  Files in this directory were current because the updater was executed on the laptop and the changed files were copied and pasted into this folder.  When those files were examined after this test to update the current files present in this directory prior to the updating file being executed were left unchanged.

Code: [Select]

Update No-Change - Correct Files Stayed In Place:
OK 3/6/2014 10:15 AM 9,245,184 PositionMgr.exe
OK 4/25/2014 11:02 AM 3,900,928 EzDownloader.exe
OK 4/25/2014 12:50 PM 6,384,128 MarketScanner.exe
OK 4/25/2014 12:48 PM 1,0,805,760 UAd.exe

  Update Failed Problem Older Files Appeared Instead of Current Updated Files:
X 10/29/2013 7:57 AM 9,262,080 PositionMgr.exe
X 1/15/2014 8:45 AM 3,728,384 EzDownloader.exe
X 1/17/2014 2:19 PM 6,148,096 MarketScanner.exe
X 1/17/2014 1:57 PM 1,0,396,160 UAd.exe
Update Test: 2
This test used the same updating file in a directory where the problem files had been deleted and cleared from the trash prior to the reboot.  When this folder was updated the files in the updating file were present, but not at the revision level as the files in the updating file.  Instead the files present in this second directory where the typical older files that appeared after every update since this problem began in January 2014.

Does anything in the Process Monitor Log show what might be happening, and what can be done to make it stop?

Thank you for staying with me on this issue,
Roger...

[Shane]

Yeah there is a 4mb limit for attachments on posts lol

Ok looking at the log I do see 2 exes that are hitting that folder.

TSVNCache.exe
and
Dropbox.exe

Which I am wondering if dropbox is replacing the files from the ones from online storage if they are on there. Reason why is when you copy and paste the files from the computer over and they stay it is because the last accessed date or one of the other dates gets updated with the current time. Drop box sees that newer time and it looks newer than the ones online. But when you do a update the times are that of when the file was first made, making the files look older to dropbox which it would then download the ones from onlie replacing them because it thinks they are newer.

At least thats what it looks like lol otherwise dropbox shouldnt be touching that folder.

However I am also looking at the logs and I see other things happening as well.

I see msiexec.exe and Explorer.EXE also hitting some of the files. Right now I filtered out most of everything and only looking at what is happening with PositionMgr.exe.

Here we see the msiexec.exe reading the file
12:38:55.7766002 PM   MSIEXEC.EXE   7260   QueryStandardInformationFile   D:\Data\UA\PositionMgr.exe   SUCCESS   AllocationSize: 9,248,768, EndOfFile: 9,245,184, NumberOfLinks: 1, DeletePending: False, Directory: False

Then right after that it writes the file to there, I see TSVNCache.exe and Dropbox.exe accessing the file, then once they are done accessing it I see the msiexec.exe qurey the file again and this time it is a totally different size

12:46:09.8468666 PM   MSIEXEC.EXE   6116   QueryStandardInformationFile   D:\Data\UA3\PositionMgr.exe   SUCCESS   AllocationSize: 9,265,152, EndOfFile: 9,262,080, NumberOfLinks: 1, DeletePending: False, Directory: False

At which point I see msexec.exe and explorer.exe both write that file.

12:46:27.2249471 PM   msiexec.exe   1232   WriteFile   D:\Data\UA3\PositionMgr.exe   SUCCESS   Offset: 9,240,576, Length: 21,504, Priority: Normal

12:46:28.0024499 PM   Explorer.EXE   3484   WriteFile   D:\Data\UA3\PositionMgr.exe   SUCCESS   Offset: 8,388,608, Length: 876,544, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
12:46:28.0057759 PM   Explorer.EXE   3484   SetEndOfFileInformationFile   D:\Data\UA3\PositionMgr.exe   SUCCESS   EndOfFile: 9,262,080

So what I would do is get dropbox and that other exe to leave that folder alone and see if that does the trick.

Shane

[Roger...]

TSVNCache.exe must be part of the TortoiseSVN Subversion process that I use to write technical information.  That process has been in place for almost 18-months and it only has three Subversion folders, all on the same "D" drive.  I can't imagine TortoiseSVN having a repository of the UA3 directory where the action takes place.  UA3 was created only recently and was never committed to the Subversion process.  TortoiseSVN only will update files when it is manually triggered to Synchronize files with its designated repository.  Attached is an image of the TortoiseSVN cache Log File area.  Cache for log files is disabled and no files are being cached other than those sent to the Repository which are all images and XML topic files.

Dropbox.exe is a cloud process I use to share files and store information I want to have available when I'm laptop mobile.  There are no known instances of the data downloading software on in any of the folders within the Dropbox entity.

I would do is get dropbox and that other exe to leave that folder alone and see if that does the trick

I don't know what to do or how to influence either of these programs from peaking at a folder. 

Dropbox is totally dependant upon forced submissions and retrievals, and TortoiseSVN only responds to deliberate synchronizing commands. 

Both of these processes have been in place long before this issue began.

Windows Backup Process
This process provides a backup to my "C" drive files.  I keep deleting the files in its destination partition, but would rather disable its operation altogether.  In it place I use a disk mirror process call Casper to keep my disk backed up at the end of each week.  Casper works well for recovery because it provides an actual mirror.  I don't know the Windows Backup is part of the issue, but out any means to disable it, even though it doesn't have any files to source when I remember to destroy them, I don't know if that is part of the issue.

I've destroyed the directory UA3 where the older files were appearing.  Would creating another Process Monitor test to a new directory be of any help in discovering what might happening?

[Shane]

Starting fresh inst a bad idea, or better yet reinstall it to a different folder. The log you sent only showed those 4 processes touching those files with msiexe and explorer doing the actual write ommands to the file and the other processes pulling read info from the files.

Ok so this time I am looking at the logs and I added a filter in path to show me only EzDownloader.exe

Again only those two have any write commands and it is of the old versions

12:46:27.1898734 PM   msiexec.exe   1232   WriteFile   D:\Data\UA3\EzDownloader.exe   SUCCESS   Offset: 3,670,016, Length: 58,368, Priority: Normal
12:46:28.0692205 PM   Explorer.EXE   3484   WriteFile   D:\Data\UA3\EzDownloader.exe   SUCCESS   Offset: 3,145,728, Length: 585,728, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal

I know msi installers will replace files and such when needed but I dont know why it would be doing that to old versions.

So what I would do is this, uninstall the program, once it is uninstalled use this tool to make sure any traces of it are removed from msi installer
http://www.softpedia.com/get/Security/Secure-cleaning/Windows-Installer-CleanUp-Utility.shtml

Once you can see that the installer has no traces of it then reinstall the program again but this time to a new folder and lets see how it does:-)

Shane

[Roger...]

OK - I'll give the uninstall process a try.

I won't be able to do that until the weekend because a fresh clean-install of this program and its resident data files is near to a Gig of data.  Program side is small, but the data side is huge and takes a long time to download and then install even with a fast machine like this one.  Data side is all DB-Type files, but to remove all traces the DB-data files are more than a trace with them making a huge space footprint.

I'll report next when I've been able to try the uninstall.

Do you think there would be any information in new program only install into a fresh directory that might be taken before doing something that would remove all traces of the current software and its data?

[Shane]

Not sure, but if the program itself is small and the installer only installs that part you should be able to just put the large data that is downloaded in a different folder and then move it to the correct spot once done to save time.

We only want a fresh start of what the installer does, things it downloads should be separate from that.

Shane

[Roger...]

This isn't solved yet.  I'm waiting for a released software only installation that doesn't force the installation of data.  I asked for this after your last posting and the developer agreed to create and promised to have it available late today or sometime tomorrow.  If it doesn't arrive until Friday, I'll perform the instructions you offered on Saturday morning.

Sorry for the delay,
Roger...

[Shane]

No problem, and glad to hear they are working with you on it :-D

Shane