Welcome to ChaosZone!
Prasenjeet Dutta's Home Page.

About this Post
Archives

Removing Undeletable Files on Windows

If you see ‘undeletable’ files on Windows NT-family OSes, even as an administrator, it may be a sign of worm, virus or rootkit infestation. (You can easily verify if the files have been locked by another process using Process Explorer or FileMon).

The easiest way to remove these undeletable files is

rd \?\D:\full\path\to\folder or
del \?\D:\full\path\to\folder\file.ext

You may get a ‘file in use by another process’ error — relogin and you should see the files removed. MSKB 120716 says that should be

\.\D:\some\folder

but I had problems with that. Good links on this at incidents.org and anetforums.

(Post Updated 2004-11-24.)

10 June 2002 10:17 pm

Comments are closed.

 

Copyright © 2001-2006, Prasenjeet Dutta. Terms of Use.

RSS Subscription Icon Subscribe

Powered by WordPress