Can't Delete a File!

[deemyz]

Received an .avi clip (I know, I know), I didn't open it until after a v-scan. When showed ok, I viewed it and immediately, it started using up all my system resources through explorer.exe. It tied itself there and then sysmon.exe began attempting to access the internet. As soon as I block it, it tries again (over and over and over again). When I shut down explorer and reboot, it stops and is not a problem again. Big problem is now the file is 28GB (That's right GIGABYTES!). I tried erasing the file. This starts it going again. I tried deleting it. This starts it going again. I tried deleting it from the command prompt. Can't find the file (Invisible?). Can't rename it or move it. HELP!!!!

 

[bcastner]

Start your computer in Safe Mode (without Networking).

Then, Start, Run, CMD

Note: Substitute for c: your drive letter to the file
Note: Substitute for the proper file name

del "\\?\c:\path_to_file_\you_want_to_delete"

 

[deemyz]

Well, thanks for the effort, but the results are the same. Even in safe mode, it is tied into explorer.exe. Trying to delete it through the command prompt in safe mode says it can't find the file. Any other attempt to delete it starts the same system resource hogging. Any other ideas?

All Help is greatly appreciated-Mike McChesney

 

[deemyz]

I even downloaded "Wholock me" from Dr Hoiby. This little file lets you see what process is using what file. When I try using Eraser, I get the msg that the file is in use by another program and can't erase. Same with delete. Doing anything to this file (even right clicking it) starts up the resource hog??????????????????????????????????????????
No virus scan can find it either before or during it's system hogging. I use Symantec and Ad Aware 6, but have used online checks from Bitdefender, Trend Micro, and Zeroknowledge. Nothing can be found.

 

[bcastner]

If the file is in use it must be due to some process. Download Process Explorer and find out what that process is, and stop the process.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

You should be able to delete the file now. If the file contains any odd characters, including reserved names or a blanks space at the end, the following techniques should allow you to delete the file:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q131702

http://support.microsoft.com/default.aspx?scid=kb;en-us;320081

http://support.microsoft.com/default.aspx?scid=kb;EN-US;315226

 

[linney]

There is mounting evidence that corrupt AVI files can cause this type of problem. This explains it better and offers a possible fix.

Select a file - windows stops.
Thread779-422825

To delete this file you will probably have to do it while not in the Explorer or Windows environment.

You can try Recovery Console.

You can delete Explorer and use the Task Manager to navigate to the file and delete it then reload Explorer.

You can try third party programs to access the file before Windows loads.

DelLater.

DelLater is a tiny program that allows you to specify files to be deleted when Windows next boots, making it ideal for those situations when you can't delete a file because it's in use. Source code included.

http://www.diamondcs.com.au/index.php?page=products

 

[deemyz]

Thanks. This gives me alot more info. I still can't stop the process without killing windows explorer. When I open up the explorer section in Process Explorer there is a pack of "Mutant" headings under the Type Section.

 

[deemyz]

Thanks linney. When I try to use this in the command prompt I get a syntax error msg?

 

[deemyz]

If this is a recurring problem with .AVI files, someone needs to start looking at the size of the files before they are deleted. This is nothing accidental as the size of the file has grown from about 12MB to 28GB. It loooks like it copied a lot of my HD to itself.

This is some form of maliciousness (is that a word?).

TKS_Mike

 

[bcastner]

Bring up Task Manager and kill all the proceses. If you have to stop Explorer, go ahead and do so. Then in Task Manager, File, New Task, del filename

To restart explorer, File, New Task, explorer.exe

 

[deemyz]

I was hoping to have to uninstall and reinstall explorer.exe. Somehow, the file was made invisible to the system. How is this?

I finally found a workaround. I moved all the files I wanted to keep out of the folder and then deleted the entire folder from the command prompt. This seems to have worked. I'll try overwriting all the free space on the HDD today and see if the 28GB was recovered.

bcastner and linney, Thanks again for your help. I'll post a reply tomorrow just to let you know if the final worked.

If anybody else has this problem, or if anyone has any other knowledge about this creature, please post a reply here (or link). I'd like to find out more.

Thanks Again-Mike

 

[linney]

Hiding Files.

You may have a Desktop.ini file that could cause this type of behavior. This explains what I mean.

http://www.astalavista.com/library/os/win95-98/mshidden.txt

Read the article, it gets interesting around the paragraph

"HOW MICROSOFT DOES IT"