Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: What is bu_todelete.rdb and why is are there multiple deletions of it?

  1. #1
    rboltuck Guest

    Default What is bu_todelete.rdb and why is are there multiple deletions of it?

    I believe that rdb extension files are related to ZA. I have noticed recently an extraordinary amount of disk space taken by multiple deletions, sometimes every minute or two, of a file called bu_todelete.rdb, which is apparent in the list at the Norton Protected Unerase Wizard. Each copy of the file was exactly the same size, about 4.7 MB. Norton confirms the files were deleted by the vsmon process (which is ZA). Now I uninstalled and re-installed ZA, but the deletions are continuing, but they are each smaller, just 1.7 MB. These deletions held in Norton Unerase purgatory sometimes take up to 6 GB of disk space total. I don't recall this problem before a week or so ago. I did have a major virus/spyware infection prior to that (apparently something attempting to hijack my machine for a botnet) but seem to have cleaned it up nicely, but can't help wonder if the virus didn't modify ZA behavior in some manner that persists. There is only one reference to bu_todelete.rdb through Google, and not very enlightening: http://www.sysinternals.com/Forum/fo...=6622&PN=1 (this is a forum dedicated to interpreting rootkit scan results, apparently).

    Does anyone know anything about bu_todelete.rdb? Gurus? Many thanks.

    Operating System:Windows XP Home Edition
    Product Name:ZoneAlarm (Free)
    Software Version:6.5

  2. #2
    mmiconnect Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?



    Seeing the same events...running my hard disk ragged. Within hours this fills the NORTON protected file and can engross 2GB forcing a low disk space alert based on my settings. ZA needs to offer a fix.



    I have ZA PRO and XP Home - all at the latest rev and release levels

  3. #3
    jarvis Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    In previous versions, the database was loaded at bootup and kept in RAM. Changes were written to IAMDB.RDB periodically, but the database was not "cleanly closed" until shutdown. When ZA Closed it would close the database and copy it to BACKUP.RDB

    That meant that if ZA or your PC crashed, it could recover from BACKUP.RDB but your settings would be reset to how they were on your last successfull shutdown of ZA. For people running machines 24x7, this could be a lot of settings lost.

    Now in 6.5 it appears that the BACKUP.RDB file is updated regularly while ZA is still running. Maybe it renames BACKUP.RDB to bu_todelete.rdb, then saves the new BACKUP.RDB and finally deletes bu_todelete.rdb This means that if the system crashes, virtually no settings will be lost. This is an improvement!

    Now, deleting a file is a normal operation and if you've installed software to catch these deletes for recovery, and it's clearly working and capturing lots of these, you need to exclude .rdb files from Norton Protect. Or exclude the C:\Windows\Internet Logs folder from protection, whatever is easiest in Norton.

    All the above is of course, conjecture/opinion, based on what I (and you) have observed; I see the BACKUP.RDB file being updated more frequently than in previous versions.

    Message Edited by jarvis on 07-19-2006 11:39 PM

  4. #4
    Join Date
    Jun 2004
    Posts
    320

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    Is that also the cause of the many files being added to restore points?

  5. #5
    ai_tak Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    It seems strange that system restore would be backing a file every time it is changed, usually it just backs up exe files. If we knew what Microsoft's parameters for backing up a file with SR it would help.

  6. #6
    rboltuck Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    I'll bet the problem with bloating the system restore folder (SYSTEM VOLUME INFORMATION in XP Home) is closely related, and in some ways seems to be a more serious flaw then the deletions accumulating in Norton UnErase (NPROTECT). See this thread for much discussion: http://forum.zonelabs.org/zonelabs/b...ssage.id=34871 .

  7. #7
    rboltuck Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    Jarvis, thanks for the explanation, which makes sense. I can agree that this change was intended as an improvement, but I would not call its effects an improvement. First, in years of using wintel machines (and since 2002, XP), I've never encountered any program that deletes multi MB sized files every two or three minutes. Second, I don't know how to exclude a file extension or folder from Norton UnErase (NPROTECT), have never previously had to do so, and don't know why I should have to figure it out now (even if it is possible), especially since ZA itself offered no warning or explanation of this significant structural change in the behavior of its program. Third, the problem of large, extremely frequently deleted RDB backup files seems to have other effects on the system, including a high degree of disk fragmentation over short periods of time and bloating the system restore folder (SYSTEM VOLUME INFORMATION on the c:/ root) with hundreds of large RDB files, diminishing rapidly available disk space (compounding the effect of captured deletions in NPROTECT) -- see this thread: http://forum.zonelabs.org/zonelabs/b...ssage.id=34871 . So, on balance, as I indicated, IMHO, this is not an improvement but rather a headache. I have now done a clean uninstall of free ZA 6.5X and re-installed 6.1X. I didn't see any problem with the behavior or functionality of the previous version of free ZA, and if it ain't broke, my advice is don't fix it -- that adage evolved over the eons for a reason!

  8. #8
    jarvis Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    How to exclude folders from System Restore - Warning: Requires registry editing. Back up the keys you're about to change before you edit them!

    <Font color="blue">How to exclude folders from Norton Protected Recycle Bin

    I still think that deleting files is a normal operation, if they're files the software created in the first place. Norton Protected Recycle Bin is an add-on that copies all deleted files so they may be restored. By catching all these deleted files, it's just doing it's job - so exclude the files you don't want to capture.

    System Restore normally only makes a restore point every 24 hours, unless you install / remove software. I would only expect to see 2 .rdb files per restore point; IAMDB.RDB and BACKUP.RDB Still, these can be excluded although it does require a registry modification.

  9. #9
    mmiconnect Guest

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    Thanks for the hypothecation. I went back and find the file is created at about 1m40sec to 2min intervals. The size is routinely 4.71MB. with a 3GB free spacecapacity VSMON fills up my hard drive in a matter of hours.

  10. #10
    Join Date
    Jun 2004
    Posts
    320

    Default Re: What is bu_todelete.rdb and why is are there multiple deletions of it?

    Looking at the other entries in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\BackupRestore\FilesNotToBackupit seems that you can also specify a specific file, rather than the whole folder. So it may be enough to exclude backup.rdb, or should that be bu_todelete.rdb?

    Message Edited by JRosenfeld on 07-20-2006 04:54 PM

    Message Edited by JRosenfeld on 07-20-2006 05:03 PM

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •