File that refuses to be deleted

Zaphod B

I guess this goes in MS Apps/OS, sorry if it should be somewhere else.

Having missed an episode of 24 I tried to download the episode from Grokster (I don't think this constitutes warez, after all I only wanted to watch it then delete it). Anyway I wasn't too surprised to discover that it wasn't an episode of 24, but (you've guessed it) some kind of pr0n, which as it turned out didn't work anyway. Gotta love the wonderful people of the Kazaa and Grokster community. Not only do they share files that don't work, they rename them just to p!ss you off that little bit extra.

So I delete it. No, I don't. Apparently "It is being used by another person or program. Close any programs that might be using the file and try again". Now if that wasn't enough, the system also grinds to a halt for a couple of minutes while it waits for that message comes up, and after it's come up, Windows continues to run slowly until I restart. The same thing happens if I try to move or rename the file. I tried deleting it in a DOS window... nothing. I tried deleting it with McAfee file shredder... nothing. All this I tried with the internet disconnected if that makes any difference.

I know it was pretty dumb of me to trust Kazaa/Grokster users but ... This file just will not die... any ideas?

KdjaCL

Restart pc in Safe mode and delte it there.

then install adaware and clear out any spyware (kazaa may not work after doing this).

Then use Msconfig to stop any nasty programs laoding (if any left doubt it adaware is cool).

kdjac

oneweb

Have you tried a cold reboot? (Sorry if you have, just worth a try.) Are you on a network? Sometimes network files get hooked. What OS are you using?

How'd ya know it was pr0n if it didn't work?

pickarooney

And use BitTorrent next time!

dahamsta

Gotta love the wonderful people of the Kazaa and Grokster community. Not only do they share files that don't work, they rename them just to p!ss you off that little bit extra.

Could just as easily have been one the the movie companies or their agents. They and the record industry have been seeding the P2P networks with this kind of stuff for a couple of years now. It's unlikely the movie company would purposely plant porn, but you wouldn't know what their agents would do.

(Madonna did it recently with her latest track, an American Life, swapping the song out with silence and Madonna saying "What the fvck do you think you're doing?" A couple of days later, somebody hacked her site and left a message there saying "This is what the fvck I think am doing." Madonna lost a customer here when she released the single as an MP3 exclusively to the US, so I gotta say I'm not sympathetic.)

adam

daveg

control alt delete... remove everything except explorer running in the background... then delete the file.

Same as restarting in safe mode but faster.

ando

if its xp/2000 or nt you can go into the process's like what dave said, and stop any process's there, then delete the file. If its still acting up you might want to install some anti-virus software, by activating the file, you may have unleased a virus onto the system

SouperComputer

yea i think a virus may have it by the proverbial danglies. Latest Defs and full scan. Kazaa is full of sheggin trojans and stuff, so be careful!

one of the most common ones fills your shared folder with fake shares.

Zaphod B

No luck deleting the virus in safe mode, thx for the advice tho. Now I have other problems however... I did a VirusScan (McAfee) and it seems my System32.exe is infected with IRC-Sdbot. "Unable to delete the file IRC-Sdbot. The file is either in use or resides or write-protected media"... any ideas?

Oh btw oneweb I knew because although the video didn't work, the sound did... "Oh, ja! Ja Karl! Das ist gut! Jaaa!" and the like...

oneweb

Originally posted by Zaphod B
Oh btw oneweb I knew because although the video didn't work, the sound did... "Oh, ja! Ja Karl! Das ist gut! Jaaa!" and the like...

Eehksellent!

Have you tried running sfc (system file checker) in Safe Mode? It's MS's fixer upper if system files get over-written/deleted. Tis worth a try...

Zaphod B

Well Karl and his friends have been deleted now, after a virus scan, ad-aware scan and a bit of guesswork in Task Manager.
Thanx for the help and suggesting AdAware.

Unfortunately the virus still very much alive and healthy, and McAfee is still very much impotent and useless. Any suggestions on how to kill this bastard?

ando

"Backdoor.Sdbot is a server component (bot) that a hacker distributes over the IRC channels. It allows a hacker to perform a wide variety of actions on the compromised computer.

The Trojan arrives in the form of a Portable Executable (PE) file. When Backdoor.Sdbot runs, it copies itself to the %System% folder as Cnfgldr.exe or Sysmon16.exe"

"Once this type of Trojan attacks a computer, it is difficult to determine what else the computer has been exposed to.

In most cases, changes—other than those made by the Trojan—will not have occurred. However, a hacker may have been able to use the Trojan to access the computer to make changes to it.

Unless you can be absolutely sure that malicious activity has not been performed on the computer, we recommend completely re-installing the operating system"


Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Scroll through the list and look for cnfgldr.exe.
If you find the file, click it, and then click End Process.
Close the Task Manager


you really need nortan anti virus to remove this bugger for good. by ending the task, your stopping the virus but it will restart itself soon enough

daveg

My own approach would be back up needed files. Format c: and reinstall.

GoneShootin

thats a bit overkill tbh daveg :rolleyes:

troubleshooting those kinda problems is one of the best ways to learn, NOT reload the OS each time you hit a problem....

Pimp Ninja

No way is it overkill.

The virus, in this case a trojan, has compromised the PC in question, there is no telling what else has been dumped onto the machine. A format/reinstall is the minimum action that should be taken.

The standard procedure once a machine has been compromised, the attacker will harden the machine, to prevent other attachers gaining access. Then he will install some extra tools/utilities on the machine to either come back to later, to get better access to the compromised box, or possibly to use it as a 'launch-platform' on to other machines.

Its not overkill. Format that puppy immediately, and get it cleaned.

from NAI Virus Database
It connects to an IRC channel and accepts commands from there. The commands are related to performing denial of service attacks and downloading and running files on the victim's computer.

A malicious attacker may have already done this to your machine, and if he's good, you wont know it. If hes really good, it will be almost impossible to track. Dont risk it. Format.

BigEejit

Heh ... I knew I'd seen something like this ages ago, and I knew that there had to be a nice easy answer to the original posters question, viz: how to delete a file that refuses to do so, even in safe mode: ...

My sister had the same problem and I fixed it today, using the following from d'internet:

Delete undeletable files
http://rogier.xszone.nl/windows/wintricks.html

1) Close all open programs.
2) Open a Command Prompt window.
3) Close Explorer.exe from the task manager (ctrl-shift-esc), leave Task Manager open.
4) Navigate to the folder with the undeletable file(s) in the command prompt window with the cd command.
5) Delete the file with del filename.ext
6) Reopen explorer.exe from the taskmanager.

zep

Sorry to hear bout this Zaphod...
BTW is this the Real Zap????

BigEejit

Originally posted by zep
Sorry to hear bout this Zaphod...
BTW is this the Real Zap????

Yes it is the real zap zep:D

Tivoli

you never said what type file it is, if its an mpg/avi/wmv (why did you think it was a video?),then its hardly a virus, and probably a hard drive problem, run a full scandisk overnight, see what it comes up with, as for that system32.exe problem, search for in on you windows cd rom, and overwrite the infected one from dos ( I am guessing your on win98 or me, cos i doupt xp/2k would allow a virus to write to a system file)

edit> i just did a search and yeah it affects xp, and system32.exe is the virus, nothing to do with windows (sounds real doesn't it)

Ancient1

It's not a virus, it happens because of incomplete downloads in some way or another.
I have the same problem with a dodgey avi file - still cant delete it. Found some useful tips on www.annoyances.org - the problem is if i go in in safe mode thru the admin account (i'm on xp pro), the file is in a folder which is not shared ...duh..:ninja:

Ancient1

http://www.boards.ie/vbulletin/showthread.php?s=&threadid=118790

you'll find some good info on this thread - same topic - unfortunately as you will see it didnt help me, but thats coz i'm an idiot:D

Capt'n Midnight

Don't forget if you have Win95/98 you can boot from a floppy disk (write protect it first) to delete files.
If you have 2k/xp you can boot from the CD (though it may use files on the HDD) and have a better chance of deleting files

NOTE: if you suspect a virus ALWAYS COLD BOOT
don't just restart - Shutdown and Power off first.

Or get a Knoppix CD

horacember

if 2k/xp

have you tried openning a command prompt
disabling antivirus
task ending explorer (or user shell)
delete file from command prompt
restart explorer or reboot

?

Ancient1

task ending explorer (or user shell)

can you run that by me again?

and how do you actually delete a file from command prompt?:ninja:

BigEejit

Originally posted by Ancient1
can you run that by me again?
and how do you actually delete a file from command prompt?:ninja:

he just said pretty much the same as I said earlier in this very thread, open your eyes man

Ancient1

but thats coz i'm an idiot

as i mentioned....:D

Ok - i just survived a heart attack after i couldnt restart explorer.exe, but its up and running now...
next problem - how do i navigate to the folder using cd command ??
Dude this is like advanced astrophysics to me, if you help me out with this one i owe you a pint !:D

Ancient1

Hey BigEejit,

it worked!! I figure it out, FINALLY:D

Thanks !

BigEejit

Congrats

vibe666

for future reference, it's nothing to do with virus's or trojans or gremlins or anything like that.

it's all down to the way XP handles large files.

an easy way to get around the problem is to either turn the 'feature' off in XP (has to be done in the registry I'm afraid, see annoyances.org if you really want to do it), or do what I do and have a seperate partiton (FAT32) for downloaded files and have a simple little folder called DL to put your files in while they are being downloaded. if anything goes pear shaped, you can boot up in DOS mode with a handy DOS boot disk (if you haven't got one why not? - www.startdisk.com) and easily navigate to the d:\DL directory and delete the file manually from there with the del command. i.e.

d:
cd\dl
del crapfile.dat.

reboot, and you're done.