Can't delete files w/ invalid names 3

[suncity]

I have some jpg files with invalid names in a folder.
WinXP/Pro edit/ delete won't delete them. DOS mode Run / del *.jpg says "invalid filename" (DUH! )
Can't even access them to change their name to something valid.

Any way of directly accessing these files and deleting them with some utility or special process?

Thanks!

 

[linney]

Probably you shouldn't be actually clicking Shutdown on the actual Shutdown box, only on the Start Menu to bring up the Shutdown box.

 

[suncity]

Good idea.
Start / Ctl-Alt-Del gave TaskMstr as usual.
"Cancel or Close"? Which task? All tasks are listed, I don't know which one to end (if that's what I'm supposed to do).
Flying blind, since I (literally!) don't know what this step sequence does. News to me, but I'll go with it to the letter, and maybe find out what I'm doing later.

 

[linney]

Cancel or Close on the Shutdown box?

Where's Bill?

 

[dbMark]

Did you try the suggestion by thefourthwall to delete the file from a Cmd window? Another idea ... will it let you rename it, either in Explorer or Cmd window?

dbMark

 

[suncity]

dbMark, I tried all suggested with same result.
No delete, rename, or any function that requires access to the files. From XP or Cmd. Nasty!

I generated a Knoppix CD. Will do major backup before attempting to use it -- unknown territory for me. I only hope Knoppix home screen is explanatory enough to know what to click to do a file delete.

Know I know how astronauts feel when they walk in space with only radio connection to mother Earth.

 

[bcastner]

Explorer.

Sorry, thumb typing on a Blackberry.
I am standing in an airport line waiting to board a flight to Italy.

 

[MontyPalmer]

Suncity,
I have been going through this hoping I could put some steps together for you and unfortunately it looks like the best you are going to do is be able to do in Knoppix is open them to see what they are. Knoppix can no longer write/delete to NTFS. I checked my Oreilly Knoppix hacks and the steps that they outlined did not work on my xp pro box. If you do not have access to that book, and would like to know what the commands are I am more than happy to transcribe them here, with all of the proper aknowledgements of course. I feel bad because this was my idea and I was really cavalier about suggesting it. Let me know if you want the commands.

Cheers, and again, sorry for suggesting an outdated solution.

my bad.

Monty Palmer
President
Paltechs

http://www.paltechs.com

 

[linney]

Time to consider a Format and re-install?

If you have a spare partition you might even be able to use Automated System Recovery to backup every thing on the corrupt drive. Hoping that it will backup everything but the unreadable corrupt files. You then might be able to restore this backup to the dodgy partition via the ASR which will automatically format the partition before any restore operation.

How to Set up and Use Automated System Recovery in Windows XP

http://www.microsoft.com/windowsxp/pro/using/itpro/managing/asr.asp

You may need a second partition for ASR to work properly.

 

[suncity]

I finally figgered out BCastner's sequence of steps: set up for delete a cmd level, disable Explorer, delete file (hopefully), then re-enable Explorer. Clever. But unfortunately didn't work. Educational tho.

I'm closing this matter. Exhausted most options for now, until I get some more time. Between AVG, MS Spybot, and Search&Destroy I think I'm OK.

Yes, I do have space for another partition on another large physical drive. ASR, as usual, a last resort. But ASR backup good practice to do as standard procedure.

This thread closed for now. Appreciate everyone's help. Educational !!!

 

[bcastner]

I said in my original post that this was "Extreme Windows" and I guess I should have emphasized this more.

On Step #4 you all do Ctrl-Alt-Del. The advice was Ctrl-alt-Shift.

You will then see the prompts mentioned.

I leave this as a GUI mystery to you all, but there is a discussion by David Candy of this keystroke sequence in Google Groups.

 

[bcastner]

suncity,

Time for the use of Recovery Console and an fdsisk. If, as I mentioned earlier you have a rootkit infection, I think the best advice is to copy off you data and do a clean install.

 

[garebo]

I've been following all this. There's one thing that went over my head, that is bcastners extreme windows. I really want to learn how to do that!!

Anyway, to your problem. I also believe, as do others, you have some sort of malware\trojan problem. I see you have run a few programs. To be honest, we all need a bit more than you have listed.
On that note, can i suggest you shoot over to trend-micro and do an online scan. The reason is that they have a great site, great programs, and they find stuff that our A\virus and other progs simply fail to find! If they cant help you, my bet is you need a reformat and re-install. They do require you allow their small prog to be installed on your computer but they are completely trustworthy, they have a very good rep. I have used it over 100 times and never a prob, but they have fixed many a malware\trojan problem. They recently changed their format but its easy to follow. I suggest, it its still there, you click on the "auto repair" button, again, they have never done me wrong. They are execeptionally good with trojans and other such malware that our a\virus progs dont catch!

If you do run a trend-micro online scan and you still need to reformat and re-install, can i offer one last piece of advice? Use the hard drive mfgr diagnostic floppy or cd and use the "write zeroes to the hard drive" program inside that. The reason is that some virus\trojans and some other malware survive a simple reformat. But i havent had one survive a "zeroed" hard drive yet. These guys here may offer you a better suggestion but i can tell you that my way has worked fine for me whenever i or my customers machines have had virus\trojans\malware to deal with. When i have no choice but to reformat and reinstall thats the way i go and so far so good. I run the "write zero" program, then i fdisk and format fat32. Then i install win xp and have it format the drive NTFS. Between the "write zero" and 2 formats its a lot safer and its not a lot of work.





Good advice + great people = tek-tips

 

[suncity]

Am running HouseCall now. It promises to report malware, but doesn't mention deleting them. Maybe I'm being oversensitive 'cause I'm a bit bruised from this matter. But every little bit helps.

I hope free HouseCall lets me delete them.

Special thanks for the "malware surviving a format" tip. Tenacious little buggers. Kinda like pitbulls: they hold on until victim stops moving.

Trying to close this matter, but I still keep getting good ideas. Tek-Tip great site !!!!

 

[garebo]

Thanks

I have been using trend-micro for a long time but they just changed their format. I ran a scan lately and thats when i found out. Since i didnt have any virii\trojans, and only a few spyware type things i didnt pay a lot of attention, but the format has changed. I just figured it would be improved, maybe i am wrong.

Would you let me know how your scan goes?

I am gonna do a scan tomorrow. But again, when i did the scan the other day, i had nothing, so there was nothing to fix, so i may not find out if its still doing repairs as it has in the past. Hope i find out before i really need their help!
My guess (hope), with their new format, they are fixing the virus\trojans, but leaving malware\adware\sypware as an option for the person to decide what to do with?




Good advice + great people = tek-tips

 

[suncity]

Good news: Scan found many virus' -- McAfee missed them.
Bad news: HouseCall "passed" many of them as "undeletable."

You were right: HouseCall finds many more virus' than anything I have ever used (AVG, McAfee, Norton, MS Spybot)

Format is clean, intuitive, easy to use.

 

[bcastner]

The about:blank is a known malware and can be removed without a reformat.

I emphasize: in Safe Mode run the Microsoft Beta antispyware tool twice. Ewido once. See: faq608-4650

 

[garebo]

Suncity, see what i mean! Housecall catches virus and other stuff that our a\virus misses. I stress this as i have, on other threads, had people say why should i run this trend-micro when my onboard antivirus says im clean.
Well, somehow trend-micro does a better job.

As for ridding yourself of these, you may very well only need to use safe mode and have the list of names and where the files is located which you got from trend-micro.

Or you could try the microsoft antispyware prog as bcasner suggested (which i use, a great prog) and use that first to try and get rid of these files, failing which you can try a manual delete in safe mode, that may very well do it and save yourself a reformat.

Another step that i take is to do a manual check of the registry for these same files. Just last week i had one called "up2dat5" that trend-micro found. I cant remember if trend-micro deleted it or if i had to delete it, but the devil came back anyway. I opened the registry and found the file or reference to it in my registry, i deleted it and its been a week now and i am ok. Every time i deleted the file it was back the same day, so i am pretty sure its gone for good. Using google i found that up2dat5 is a peer to peer bug, but i am free from it. But the point is that i would check the registry and delete any references to these files or some may come back to haunt you. Make a backup of your registry before you start.
And if you make a mistake or have any probs you can use goback or system restore to fix that. But as long as you only delete references to that file name there likely wont be a problem, ive done this hundreds of times. Pardon me if you already do this.





Good advice + great people = tek-tips

 

[suncity]

I updated and ran MS Spybot twice in Safe Mode. Caught 1 first run, 0 second.

Manual (cmd level) delete in Safe Mode didn't work.

Based on Garebo suggestion, I've listed programs in my TaskMgr list so I can compare to future list to see if any crazy uninvited guests show up. Then I can delete those interlopers from registry. When I'm pretty sure I'm clean, I create a restore point.

Oh! TrendMicro allows check for BOTH virus and spyware in a combined scan. But can be run individually.

 

[garebo]

Thanks for the info on trend-micro new setup. I was a bit confused when it ran as i am used to the old one.

I just take a picture of the listings in task mgr with a screen capture prog called printkey as it allows me to only capture what i need and makes a smaller file. YOu can google it and its free. Course there are many such programs.

I have had cmd.exe, up2dat5, and another one i cant quite remember the name, something like iexplorer or explorer, the word "explorer" was part of it. However, there are legitimate files in there called explorer as well.
You can always tell if its not a legitimate file as it will be using up system resources when you have nothing running. The standard explorer that belongs there wont do that. But, again, often you have to go to registry and manually delete references to these progs or they come back there with a vengeance!

Are you saying you still have malware that you know of that you cant get rid of? What are the names?

I would sure like to see a written explanation of what bcastner was talking about, something written so a dummy like me can understand and undertake, lol.
thanks



Good advice + great people = tek-tips

 

[suncity]

I have .jpg DATA files that I cannot delete. All scans run clean for programs, so I think I'm OK there.

File names all start with a small square character; consitency suggests a deliberate process at work (malware?). Nothing seems to work, inside or outside of windows. That's why a physical level tool such Disk Explorer seems to be the last resort before reformat.

I've tried the Ctrl-Alt-Shift "exteme Windows" thing every which way: before Start click, during Start click, after Start click. I always get the same familiar trio: log off, shut down, restart. I'm sure there is something useful there, I just don't have enough detail to make it work.

HouseCall will be a permanent part of my arsenal. Thanks.