Jump to content

Malwarebytes

FileASSASSIN Error.


2 replies to this topic

#1
JRMoore

    New Member

  • Members
  • Pip
  • 2 posts
Hi, I know this one is not your main product and you've not updated it in some time but in case you want to know I came across an error yesterday.

I wish I had a debug build of the program or at least a version which created logs anywhere to give you a more detailed description:

Operating system: Windows 7 Professional (32-bits), but I'm pretty sure it would happen in a Vista environment as well.
Filesystem the file was in is: NTFS 3.01.
Streams of the file: 1, just the primary, no ADS.
Misc. info: The file was a hard link to another file my user owns both.
User info: Full privileges (and UAC is disabled).

OK, so when selecting to delete the file from the GUI using the options: "Unlock locked file handles", "Unload modules", "Terminate the file's process" and "Delete file" causes the program to exit.

Executing the CLI using the parameter /assassinate gives the following info: FindRemoteFileHandles returned NULL value.

Thank you very much for your time and congratulations for such good programs,
James Russell.

#2
AdvancedSetup

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 22,574 posts
  • Gender:Male
  • Location:US
If you check the ACL permissions is it a hard link and does it have an Access Deny permission set on it?
Hard links are typically set to deny permissions so that you don't remove them on purpose, they're not there for you to really even see or know they exist unless you set your file and folder permissions to show them.
Ron Lewis
Manager, Online Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

If you've posted to the HJT forum and it has been over 5 days without a response please send a Private Message asking for assistance.

#3
JRMoore

    New Member

  • Members
  • Pip
  • 2 posts

View PostAdvancedSetup, on Oct 25 2009, 03:06 AM, said:

If you check the ACL permissions is it a hard link and does it have an Access Deny permission set on it?
Thank you for the answer, I was not able to verify the permissions of the file (I selected to delete it on the next reboot) but I couldn't reproduce the problem either.

That hard link was the only one in the set that failed to be deleted. There were 6 of them, I used them because I needed to use the same data across several programs and needed to be accessible from the programs' main executable file.

Regards,
James Russell.





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Follow Us