Can't Delete File Even Though I Am the Owner/Adminstrator

[gr3gw]

I have a folder containing one file in C:\Program Files. The file has an EXE extension but is zero bytes long. I am the owner and the administrator. I've tried numerous methods to get rid of it including Cedrick Collomb's UnLocker.

It's been around for several years or more. Last week my backup program objected to its presence and failed to complete and so I have to do something about it. I'm building a Ubuntu system on a USB stick which I believe WILL solve the problem.

I've had great success with Windows Repair but it doesn't detect the undeletable folder and file problem. I'm not complaining but I thought the team might be interested in tackling this problem.

If I know what to provide - screen dumps, etc. I can do that before I use Unix to clobber the folder.

[Boggin]

Which program does the .exe belong to ?

As it's .exe it may be in use which is why you can't delete it - try it in Safe Mode.

I've found FreeFixer to be a good program for removing otherwise difficult to remove items as long as they aren't white listed and it may also be worth running it in Safe Mode.

http://www.freefixer.com/

[gr3gw]

Thanks, Boggin.

I tried FreeFixer but it was unsuccssful. For individual files it uses a technique similar to Unlocker's when you want the file deleted anyway.

I didn't mention the folder and filename before as I didn't want the conversation diverted to spam and viruses. The file's pathname is "C:\Program Files\Shopperz\csrrc.exe". I may have caused the 'undeletable file' condition when I was madly trying to get rid of ShopperZ.

I'll move to Plan B - Unix.

Thanks for your help.

[Boggin]

See if AdwCleaner and/or Junkware Removal Tool will shift it - the download link for JRT is lower down the page.

http://www.bleepingcomputer.com/download/adwcleaner/

Also run these in Safe Mode with Networking should the program be running, but you can check its status in Task Manager/Processes and end it.

[crazy4years]

IOBit Uninstaller(free) gets to business pretty seriously also, if you want a file and remnants removed. I always suggest a restore point first in case it pulls something used in duplication.

[gr3gw]

Thanks, Crazy4Years. I haven't tried IOUninstaller. I think this product is directed at files installed by software installers.

I resorted to Unix. No hesitation when deleting the 'rusted on' file.

Would still like to know what characteristics of the file prevents it from being deleted from within Windows in case it happens again or is preventable.

[crazy4years]

I suspect it is the location more than the name. You could always rename it and see if it uninstalls more easily to determine that. Malware can have a way of worming files inside others without it showing up for us to find where to delete them (such a waste of talent) so you are trying to delete something at a location that does not exist there. Misleading you?

[gr3gw]

I did try renaming but Windows said I didn't have permission even though I am administrator.

I did think it was something to do with being zero length but I've since learned that zero length is quite legitimate and easy to create and delete, hence I was quite curious about your 'worming files inside others'. I can only speculate what change has been made to make the file un-deletable, I just don't know enough to speculate meaningfully.

[Boggin]

Did you try the adware removal tools I'd posted in Reply #3 ?

[gr3gw]

I  tried FileAssassin but not AdAware.

I'm now thinking it might be something to do with 'copy-on-write'. Today I saw an error message explaining that I couldn't  delete a file as it was being copied. When I found out more, copy-on-write is an OS technique for safely copying files that are open. Shadowing may use this technique. It could be that the file I couldn't delete, and finally removed through Unix, was locked for 'copy-on-write' when there was a system crash. For some reason, the 'copy-on-write' flag couldn't  be removed.

It's a guess but it's the kind of explanation that works. The fact that the file was malware is, I think, mis-direction.

Thanks for the suggestion.

[Boggin]

Okay - as long as the job is done