Cant delete file named rescache.hit when uninstalling?

[Gargamel360]

Well, I don't know what you are confused about.....it is from Avast!'s sandbox, that seems pretty clear to me.

What fact outside of that are you trying to grasp? 

[skay_baltimore]

Well, I don't know what you are confused about.....it is from Avast!'s sandbox, that seems pretty clear to me.

What fact outside of that are you trying to grasp?

Here's the OP's first post:

I had a problem yesterday when Wiondows told me Avast was not running.  Uniinstalled, used aswclear from safemode.  A directory on root of c:/ was left, entitled "avast! sandbox" with multiple directories. Could not get folder/ file to delete even from safe mode....What is it?  Why does it not delete, even with 'aswclear' tool?  Can this be addressed?

It clearly states that the folder on the C drive, entitled avast! sanbox remained after a safe mode uninstall using aswclear, and that trying to delete it manually was unsuccessful (and later on he said he thought he boiled down the problem to a particular file in that folder -- rescache.hit). You yourself state or imply that the sandbox folder was created by Avast, which means asking for advice on the Avast forum is appropriate. So it quite clear that he's asking what to do about an Avast-created folder that won't delete even after Avast is uninstalled using Avast's own uninstall utility. (But thanks for your post(s) trying to help. Maybe now that the issue is more clear, a solution will be forthcoming quickly.)

[MAG]

Also, I prefer not to use Linux distro's as one can read from a post about my acknowledgement of Avast understadning nothing is unhackable.

I wasn't suggesting that you install Linux - just download an iso and create a liveCD to boot with. On any modern machine it should load entirely into RAM.

[Gargamel360]

Well, I recognize that he wonders why the uninstall utility fails to clean it.  As far as that goes, the "Why" is more or less pointless, the fact is the removal tool failed to remove it (I wonder if he has tried running it twice?), but yeah, the tool not doing a full clean up should probably be looked at.

But he asks;

I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory). 

Thats the part I was confused over, it is from the Avast! sandbox, created by Avast!, and anything inside it is from running something sandboxed.

It probably wont go away easy, do to permissions.....you could as mentioned, try a Live CD to remove it but he wont because "nothing is unhackable", I have no idea what that means either, in relation to using a Live CD.  The other option is what was mentioned by Support to him....installing Avast! again will let you get rid of it, as it is an Avast! file, the problem with removing it is that he uninstalled Avast! so no one is left in command of the file, its an orphan.

[skay_baltimore]

Well, I recognize that he wonders why the uninstall utility fails to clean it.  As far as that goes, the "Why" is more or less pointless, the fact is the removal tool failed to remove it (I wonder if he has tried running it twice?), but yeah, the tool not doing a full clean up should probably be looked at.

But he asks;

I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory). 

Thats the part I was confused over, it is from the Avast! sandbox, created by Avast!, and anything inside it is from running something sandboxed.

It probably wont go away easy, do to permissions.....you could as mentioned, try a Live CD to remove it but he wont because "nothing is unhackable", I have no idea what that means either, in relation to using a Live CD.  The other option is what was mentioned by Support to him....installing Avast! again will let you get rid of it, as it is an Avast! file, the problem with removing it is that he uninstalled Avast! so no one is left in command of the file, its an orphan.

Okay. So you're suggesting that the one option available, in lieu of using the Linux Live CD, is to re-install Avast, then run the aswclear uninstall utility afterwards, and see if that removes the now orphaned folder? Does he need to install the same version of Avast that he originally installed, or will the current version do? And are there any particular settings in aswclear that will help to assure that the folder in question will be removed? (And would Revo uninstaller in aggressive mode be an option as well?)

And for possible further clarification:

1. Do you have the Avast sandbox folder on the %system% drive that he has on his?
2. Have you ever found that that particular folder would not delete after running an uninstall?
3. Are you saying that since it's an Avast generated folder, it's safe to remove, if at all possible, without harming the OS in any way? So that using a program like File Assassin might work? (if in fact the file he boiled the delete problem down to is actually the file that's keeping the folder from being able to be deleted) Because I know that File Assassin comes with Malwarebytes, and a lot of folks have Malwarebytes on their systems already.

Thanks.

[Gargamel360]

So you're suggesting that the one option available, in lieu of using the Linux Live CD, is to re-install Avast, then run the aswclear uninstall utility afterwards, and see if that removes the now orphaned folder?

Yes and No.  What I mean is reinstall Avast!....then Avast! should have possession over that file, ideally.  Then go into sandbox settings and use the button that flushes the sandbox contents.  Then (if you dont want Avast! anymore) remove Avast! normally from Control Panel, and (just as a precaution) run the removal tool in Safe Mode to check if anything is left, and clean it out if it is. 

Does he need to install the same version of Avast that he originally installed, or will the current version do?

Should not matter.

And are there any particular settings in aswclear that will help to assure that the folder in question will be removed? (And would Revo uninstaller in aggressive mode be an option as well?)

No, no settings.  I guess Revo might be an option here, in lieu of having to re-install and all that.  I don't recommend it for everyday uninstalls of security applications, but it might work to clean up an orphan file, but so might File Assassin and another previously mentioned option. 

Thing is the OP does not seem to want to be rid of Avast!....he wants the file gone, then he wants to re-install, but that is most likely not needed.  Those files are probably there so things can run sandboxed, because when sandboxed, an application is cut off from parts of the system it might be dependent on, so virtual copies are probably needed in some cases. 

you will notice my over abundance of Wiki-banned words like "Most Likely, Probably, etc....thats because I'm going mostly on educated guesswork, because I'm not a dev

[UserA789]

And for possible further clarification:

1. Do you have the Avast sandbox folder on the %system% drive that he has on his?
2. Have you ever found that that particular folder would not delete after running an uninstall?
3. Are you saying that since it's an Avast generated folder, it's safe to remove, if at all possible, without harming the OS in any way? So that using a program like File Assassin might work? (if in fact the file he boiled the delete problem down to is actually the file that's keeping the folder from being able to be deleted) Because I know that File Assassin comes with Malwarebytes, and a lot of folks have Malwarebytes on their systems already.

Thanks.

These are very relavant things that Im surprised no one has goten out of what Iv posted.  Thanks you.  (1) No one has came and said they have this folder install on thier machines. (2) No one has confimred that it gets 'special permissions' that are not 'admin' (as stated even by the "hidden admin" account) changeable even after uninstalltion occurs.  (3) If removal of this will cause system instability, then this needs to be stated, so I can not worry about that and just re-install Windows.

Well, I recognize that he wonders why the uninstall utility fails to clean it.  As far as that goes, the "Why" is more or less pointless, the fact is the removal tool failed to remove it (I wonder if he has tried running it twice?), but yeah, the tool not doing a full clean up should probably be looked at.

But he asks;

I think it needs addressed how and why it got created, and apperntly by Avast! (if not, why it would be in an Avast! directory). 

Thats the part I was confused over, it is from the Avast! sandbox, created by Avast!, and anything inside it is from running something sandboxed.

It probably wont go away easy, do to permissions.....you could as mentioned, try a Live CD to remove it but he wont because "nothing is unhackable", I have no idea what that means either, in relation to using a Live CD.  The other option is what was mentioned by Support to him....installing Avast! again will let you get rid of it, as it is an Avast! file, the problem with removing it is that he uninstalled Avast! so no one is left in command of the file, its an orphan.

The first part is answered above.  Secondly; I have tried running it twice... first thing I did actually.  To the LiveCD query, why should I have to use something else, other than my original OS, to get rid of it.  If I cant, then wouldnt you agree this needs adjustment within Avast development?  Logic would dictate it does.  Not to mention, Iv had issue with my last DL of the LiveCD, so Id like to just keep it to Windows.

Thanks for getting clarification.

Thing is the OP does not seem to want to be rid of Avast!....he wants the file gone, then he wants to re-install, but that is most likely not needed.  Those files are probably there so things can run sandboxed, because when sandboxed, an application is cut off from parts of the system it might be dependent on, so virtual copies are probably needed in some cases. 

I have already re-installed Avast!.  I wouldn't think of using anything else... yet.  That does not lessen this needing attention and fixing.  I even tried to get rid of the folder by uninstalling again (along with a third attempt using aswclear)... by trying to change the settings for the 'Sandbox' folder; as it specifically states it will delete the orginal if changed... trying to modify its permissions from actual administrtive account.

Nothing has worked successfully, but more over I think this needs attention from the Avast developer team, along with a fix 'tool'.

[Gargamel360]

Okay, I see what you want now....you don't really care if this is fixed for you specifically, so much as you want to figure out how it happened (or have the devs figure it out) so it can't happen to you or anyone else anymore. 

I can answer those Qs, though
1: No, but I have the Free version, and I'm assuming you use a paid version of Avast!  Plus, I'm cecking from a LUA, it might not even show for me.....and I'm currently locked out of my ADMIN account because my friends love to play PC pranks (changed my admin pass  )
2: Nope....aswsnx privatestorage has been left a couple time, thats the autosandbox, but the removal tool always killed it if normal method failed.
3: Can't say for certain, sorry.  But to the best of my knowledge, everything running sandboxed is a copy, not an original

[skay_baltimore]

So you're suggesting that the one option available, in lieu of using the Linux Live CD, is to re-install Avast, then run the aswclear uninstall utility afterwards, and see if that removes the now orphaned folder?

Yes and No.  What I mean is reinstall Avast!....then Avast! should have possession over that file, ideally.  Then go into sandbox settings and use the button that flushes the sandbox contents.  Then (if you dont want Avast! anymore) remove Avast! normally from Control Panel, and (just as a precaution) run the removal tool in Safe Mode to check if anything is left, and clean it out if it is. 

Does he need to install the same version of Avast that he originally installed, or will the current version do?

Should not matter.

And are there any particular settings in aswclear that will help to assure that the folder in question will be removed? (And would Revo uninstaller in aggressive mode be an option as well?)

No, no settings.  I guess Revo might be an option here, in lieu of having to re-install and all that.  I don't recommend it for everyday uninstalls of security applications, but it might work to clean up an orphan file, but so might File Assassin and another previously mentioned option. 

Thing is the OP does not seem to want to be rid of Avast!....he wants the file gone, then he wants to re-install, but that is most likely not needed.  Those files are probably there so things can run sandboxed, because when sandboxed, an application is cut off from parts of the system it might be dependent on, so virtual copies are probably needed in some cases. 

you will notice my over abundance of Wiki-banned words like "Most Likely, Probably, etc....thats because I'm going mostly on educated guesswork, because I'm not a dev

Thanks. At least the issues and/or possible solutions are much clearer to me now. (The point of reinstalling Avast so it can own that folder, and then using the Sandbox to flush that file is particularly clear, and it wasn't nearly as clear to me before.) Hopefully, a solution for the OP is right around the corner.

[Charyb-0]

(1) No one has came and said they have this folder install on thier machines. (2) No one has confimred that it gets 'special permissions' that are not 'admin' (as stated even by the "hidden admin" account) changeable even after uninstalltion occurs.  (3) If removal of this will cause system instability, then this needs to be stated, so I can not worry about that and just re-install Windows.

Not true!

Vlk responded to it here. http://forum.avast.com/index.php?topic=95193.msg759750#msg759750

I have been dedicated to Avast for a number of years.  However, the suport via the Support Ticket site is less than sub-standard.  I dont get it.  I paid for the product and expected the same top notch support that the software demonstrates.  They continually combine tickets that have NOTHING do with each other.  It seems as though they read the first part and then decide what the rest 'must' be relaying.  If an ACTUAL Avast team member gets this, please read the following ticket THROUGHLY (Ticket #OXW-598354). I have files that were NOT cleaned up in by unisntalltion OR aswclear (posted on the forum: http://forum.avast.com/index.php?topic=95063.msg759090#msg759090 ).  These are files CREATED by Avast, apparently.  See the screenshot in the post.

Is there a problem with these agents and their comprehension?  Is it something I said?  Is Avast simply biased against the country of orgin?

I dont get it, when the product is so above the rest, why the support seems the same; if not worse.  And calling in isnt the answer either.  One is simply having to re-state and put into slow, childlike phrases to get ANY help at all.  Is it time for me to STOP sharing my great opinions of Avast with the veterans I meet with each month, as once its bought we are left to mostly or own devices and knowledge?

Hi UserA789,
I understand your frustration, but this seems to be quite a hard nut to crack. You seem to be the first person who has ever had the problem (or at least reported it to us).

The Sandbox folder is indeed set so that no one besides the System account can access it. This makes it slightly more difficult to remove.
However, individual files in the folder may be protected by other mechanisms (some even outside of avast) and so removing the folder using regular methods may not be possible.

Vlk

And I mentioned it at reply #24

I had a problem yesterday when Wiondows told me Avast was not running.  Uniinstalled, used aswclear from safemode.  A directory on root of c:/ was left, entitled "avast! sandbox" with multiple directories.  Could not get folder/ file to delete even from safe mode.  Traced the problem to one file called "rescache.hit".  All google searches suggest this is some kind of virus but thought Id come here for answers.  Have reinstalled but dont get why it wont go away, even when using Admin account.

What is it?  Why does it not delete, even with 'aswclear' tool?  Can this be addressed?

screenshot shows directory and file name structure on root of C:

How did you decide that rescache.hit is the problem? I had avast crash and it left a sandbox folder with multiple directories on c drive. I couldn't delete the sandbox folder and the directories contained within after uninstalling avast. You need to be logged on as an administrator and change the ownership and permissions. From what I can tell, the crash caused it and it hasn't occurred since then.

Like I said, the sandbox crashed which created this condition. It hasn't happened since. Since then, the devs have increased the stability of the sandbox with each release.

There have been several options given to remove the folders/files. All are good options. I removed it in less than 5 minutes by manually taking ownership of it and changing permissions.

You could always create a support bundle under the maintenance tab and upload it to avast. Instructions on how to upload are given once you create the bundle. Add your support ticket # to it.

[miscreant]

rescache.hit files can be found in windows>rescache folder in various rcxxx folders and is normal.These files cannot be deleted or modified(not recommended imo anyway) unless ownership is taken.I guess thats why they cant be removed from  the avast sandbox either unless ownership is taken of them.Logging on as administrator is not ownership enough.

[skay_baltimore]

rescache.hit files can be found in windows>rescache folder in various rcxxx folders and is normal.These files cannot be deleted or modified(not recommended imo anyway) unless ownership is taken.I guess thats why they cant be removed from  the avast sandbox either unless ownership is taken of them.Logging on as administrator is not ownership enough.

That makes sense. But then doesn't that beg the question: Why would Avast put a file in its Sandbox folder that it then can't delete? Since other posters have stated categorically that if it's in that particular folder, Avast had to have put it there, why put a file in an Avast Sandbox folder that then can't be deleted? Isn't the whole purpose of having a Sandbox feature to be able to temporarily house a suspicious file, and keep it from infecting the whole system, and be able to delete that file if it's determined that it's a Trojan or a virus? Is it a possible bug? (i.e. that file should never have been put into that folder in the first place?)

[UserA789]

How did you decide that rescache.hit is the problem? I had avast crash and it left a sandbox folder with multiple directories on c drive. I couldn't delete the sandbox folder and the directories contained within after uninstalling avast. You need to be logged on as an administrator and change the ownership and permissions. From what I can tell, the crash caused it and it hasn't occurred since then.


Like I said, the sandbox crashed which created this condition. It hasn't happened since. Since then, the devs have increased the stability of the sandbox with each release.

There have been several options given to remove the folders/files. All are good options. I removed it in less than 5 minutes by manually taking ownership of it and changing permissions.

You could always create a support bundle under the maintenance tab and upload it to avast. Instructions on how to upload are given once you create the bundle. Add your support ticket # to it.

CharyB,

I would  LOVE to take ownership of the file, but as you pointed out VLK explains this cant happen as it owns by 'SYSTEM' and not Administrtor.  Also, I never said this file was what caused the conflict between Windows Security Center and Avast to be reported as not running... BTW, the icon didnt show anything wierd, like the red X-sign, but when opened Avast clearly stated it was not running.

But it was never declared that this rescache file caused that, it was simply stated that I uninstalled and reinstalled Avast after seeing the security notifiaction.  After, I went to verify that Avast was completly cleaned and thats when I ran into the 'avast! Sandbox' directory.  I could not delete the directory and started having inconsitent problems.  I started at the top of the tree and started deleting files inside it to find out what file was stopping the entire tree from being deleted/cleaned.  At this point, Im sure the PC in question has been compromised due to other inconsistencies so Im sure Ill just be re-formatting it, most likely, but I may try to duplicate the problem.  If it doesnt then Id bet a kick in the jib that Iv ran across an exploit.  If it does duplicate, then Im sure that the information can be used by Avast to remedy either the 'Uninstaller' or the 'aswclear' tool.

Either way, something good will come of this, Im sure of it!!!