Help - Search - Members - Calendar
Full Version: Immortal file with no name
Malwarebytes Forum > Computer Help > PC Help
exile360
I used Universal Extractor (great tool smile.gif ) to extract the setup file for Secunia PSI (latest version) and it used 7-Zip Extractor to extract the setup files to a folder on my desktop. I opened the folder and much to my surprise, no executables or dll's were in the folder, just files with single character names and one with no name. None of them had file extensions. I knew something obviously went wrong so I tried to delete the files and all of them went quietly except the 10k file with no name. Curiously I can move the folder and rename the folder, but I can't rename or delete the file sad.gif . Here's what I've tried so far (note: I'm on Vista x64 so my options are limited as far as compatible tools go):
  • Manual deletion: results in a strange error message from explorer
    QUOTE
    Delete Folder

    An unexpected error is preventing the operation. Make a note of this error code, which might be useful if you get additional help to resolve this problem:

    error 0x80070091: The directory is not empty.
  • del and rd commands run from an administrative command prompt have yielded similar results
  • I took ownership of the file and that did not help, the issue seems unrelated to permissions because it shows that I have full control of the file in question
  • I ran chkdsk /r on my C: drive (where the file is stored) per a few postings I found on the web from others that had similar issues, no luck for me unfortunately sad.gif
  • I tried Avenger, no luck (I suspect its driver doesn't work in x64 anyway and it could have trouble with nameless files without file extensions)
  • I tried FileASSASSIN in MBAM, it won't even let me select the file when I browse to it
  • I tried MS D.a.R.T. 6.0 x64, it gives me the same error as when Windows is running so I suspect it's an NTFS issue, similar to what happens with null reg entries when they get locked into place
  • I tried cut/paste to put them on a different drive, it won't let me move them from C:, but I can put them anywhere in C: that I want except of course the Recycle Bin sad.gif


If anyone has any ideas I'm open to them (and yes, I know formatting my drive would remove them, I'm not that desperate wink.gif . I also have System Restore disabled so that's not an option either) smile.gif .

Thanks
marktreg
Hi exile,

Give these progs a go, mate.

http://lockhunter.com/

and

http://download.cnet.com/EMCO-Unlock-It/30...4-10427650.html

I don't know if they will work or not. But they are both x64 compatible, so they may be worth a try. biggrin.gif
exile360
Good effort smile.gif . Unfortunately they were a no-go sad.gif . Those are unlocking tools that look for processes that are running and preventing file deletion. I wasn't able to delete the files offline booted from MS D.a.R.T. so these failed for the same reason, it has something to do with the files being completely nameless, not a running process holding it up sad.gif . Thanks for trying though, I do appreciate it biggrin.gif .
Marcus
QUOTE (exile360 @ Oct 27 2009, 01:16 AM) *
... it has something to do with the files being completely nameless, not a running process...


...uhm...if the file(s) don't have a name how do you know they are there? Or are you deducing that from the folder properties? huh.gif

Sorry I know that sounds a really stupid thing to ask - this is why I'm not an expert! laugh.gif
AdvancedSetup
Hi Exile,

Have you checked all of the ACL permissions? If it were XP the boot CD method would not care, but on Vista and Win7 they seem to honor the ACL of files and folders. I would change the owner on it and then set yourself or Administrators to FULL access and try again. Don't forget to TAKE OWNERSHIP of it.

exile360
@Marcus: I can see the file, that's how I know it's there wink.gif . It looks just like your HOSTS file (a file with no extension) except it has no name, but it's 10kb in size smile.gif .

@AdvancedSetup: Yep, I did Take Ownership several times (I long ago implemented that reg tweak to enable it in the context menu wink.gif ). I also manually edited permissions, made myself owner, gave myself full control etc. I discovered a thread about it here. One user claims that Unlocker did the trick, but it doesn't like x64 (even when executed via a 32 bit app like my internet browser) so that was a no go as well sad.gif . According to that thread Linux worked for one user so I'm downloading Knoppix now to give it a shot smile.gif .
AdvancedSetup
See if you can do this.

1. Create C:\JUNK\BadFile
2. Move the file to C:\JUNK\BadFile
3. Map a drive M: to C:\JUNK
\\YOURCOMPUTERNAME\C$\JUNK

Now try to delete the folder BadFile with that file in it. RD /Q /S M:\BadFile
exile360
Too late, already got it tongue.gif . I went back to the Unlocker page to see if there was any news on x64 support and there was, it doesn't support it sad.gif . But then I looked at the chart they have comparing its features to those of other somewhat similar softwares and I looked under the column Invalid Names and thought that sounded similar to what I was dealing with (although I know they generally mean file names that are too long) so I checked to see which tools made the grade for that. There weren't many, just DelinvFile and DelFXPFiles. I looked at the DelinvFile site and found they want you to pay for it now sad.gif . I downloaded the trial to see if it at least "thought" it could delete the files (which are now stored in C:\Windows.old under C:\Windows.old\1\file with no name and C:\Windows.old\2\file with no name because I tried to trick Disk Cleanup into deleting them per a certain MS help article describing the same file deletion error wink.gif ). Anyway, it turns out the "trial" is fully functional and allows up to 3 file deletions so I gave it shot, selecting the Windows.old folder I created and it appears to have worked. I can't see the folder at least so I think they're gone now smile.gif .
AdvancedSetup
Well then I'm pretty sure my method would have worked if it was a path issue. Do it again and see if my method will remove it laugh.gif
exile360
Heck no, you do it, you can easily replicate it, just use Universal Extractor to extract Secunia PSI and try to delete all the files in its folder laugh.gif .

I know I don't know nearly as much as you, but how could it be a path issue if I could easily move the folder and file around? Do you mean Windows didn't have a true path to the file because it had no name and no file extension?
AdvancedSetup
The windows redirector service for a network card often acts differently on how it manages files and folders. I don't think it is documented, just one of those odd behavior things you run into.

No problem. Please give me a direct link to the version you used and I'll see how it goes.
exile360
I used Universal Extractor 1.6 (portable of cours wink.gif ) and I extracted (er, tried to extract) PSISetup.exe. Have fun tongue.gif !
AdvancedSetup
Maybe a Vista issue or x64 issue. XP SP3 extract, no blank files. Folder and files delete just fine. I'll take a look on Win7, don't have a Vista x64
exile360
I ran Universal Extractor both as non-admin and as admin (that's why I had 2 folders and 2 blank files instead of just one) because sometimes admin privelages are required and I thought perhaps that was why extraction failed the first time. It used 7-Zip as the extraction method as I recall.
AdvancedSetup
Mine doesn't even ask me what to extract it with. It just extracts it. All files seem okay with legit file names. I'm betting you had some type of unexpected extraction or program error that caused it and I probably won't be able to duplicate easily.
exile360
It didn't as, it just started scanning the setup file, then it did the "Deep Scan" and started extracting with 7-Zip (I had to be quick to read it).
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2010 Invision Power Services, Inc.