Archived from groups: microsoft.public.win2000.file_system (More info?)

Hello,

I've had a "visitor" (a.k.a. hacker) on my computer who left bunch of files
which i can not delete... whenever i try to delete those files i get "Cannot
delete file: Cannont read from the source file or disk.", in Access Control
Settings, i have greyout and without ability to remove "Everyone".. I've
tryed to add Administrator, but everytime i do so i get "An error occured
applying security information to:" <dir/file name> The system cannot find
the file specified.

any ideas?

Archived from groups: microsoft.public.win2000.file_system (More info?)

Hi, John.

This is a FAQ here, although it seems to have been asked less frequently of
late. A search of the archives should produce many tips.

To start with the easy stuff...

Open a Command Prompt ("DOS" window) and use the good old DOS commands to
get the 8.3 filenames (dir /s/a) and delete those (del <SFN> ). Or isolate
the bad guys in their own directory and then remove the whole directory
tree - files, subfolders and all - in one fell swoop (rd <foldername> /s).
As always in the "DOS" window, type any command followed by /? to see a
mini-Help file listing all the switches and parameters for that command:
dir /?

As a one-man, one-computer kind of guy, I know nothing of networks or
permissions or stuff like that. So your problem may very well be over my
head. I hope some real guru will chime in with some better ideas for you.

RC
--
R. C. White, CPA
San Marcos, TX
rc@corridor.net
Microsoft Windows MVP

"John Smith" <someone@microsoft.com> wrote in message
news:uJbPeO2cFHA.3132@TK2MSFTNGP14.phx.gbl...
> Hello,
>
> I've had a "visitor" (a.k.a. hacker) on my computer who left bunch of
> files which i can not delete... whenever i try to delete those files i get
> "Cannot delete file: Cannont read from the source file or disk.", in
> Access Control Settings, i have greyout and without ability to remove
> "Everyone".. I've tryed to add Administrator, but everytime i do so i get
> "An error occured applying security information to:" <dir/file name> The
> system cannot find the file specified.
>
> any ideas?

Archived from groups: microsoft.public.win2000.file_system (More info?)

C:\xxx>dir /s /a " "
The system cannot find the path specified.

C:\xxx>rd " "
The system cannot find the path specified.

C:\xxx>

no matter what i do, all i get is "The system cannot find the path
specified."




"R. C. White" <rc@corridor.net> wrote in message
news:u1Y8yKcdFHA.1448@TK2MSFTNGP14.phx.gbl...
> Hi, John.
>
> This is a FAQ here, although it seems to have been asked less frequently
> of late. A search of the archives should produce many tips.
>
> To start with the easy stuff...
>
> Open a Command Prompt ("DOS" window) and use the good old DOS commands to
> get the 8.3 filenames (dir /s/a) and delete those (del <SFN> ). Or isolate
> the bad guys in their own directory and then remove the whole directory
> tree - files, subfolders and all - in one fell swoop (rd <foldername> /s).
> As always in the "DOS" window, type any command followed by /? to see a
> mini-Help file listing all the switches and parameters for that command:
> dir /?
>
> As a one-man, one-computer kind of guy, I know nothing of networks or
> permissions or stuff like that. So your problem may very well be over my
> head. I hope some real guru will chime in with some better ideas for you.
>
> RC
> --
> R. C. White, CPA
> San Marcos, TX
> rc@corridor.net
> Microsoft Windows MVP
>
> "John Smith" <someone@microsoft.com> wrote in message
> news:uJbPeO2cFHA.3132@TK2MSFTNGP14.phx.gbl...
>> Hello,
>>
>> I've had a "visitor" (a.k.a. hacker) on my computer who left bunch of
>> files which i can not delete... whenever i try to delete those files i
>> get "Cannot delete file: Cannont read from the source file or disk.", in
>> Access Control Settings, i have greyout and without ability to remove
>> "Everyone".. I've tryed to add Administrator, but everytime i do so i get
>> "An error occured applying security information to:" <dir/file name> The
>> system cannot find the file specified.
>>
>> any ideas?
>
>

Archived from groups: microsoft.public.win2000.file_system (More info?)

Hi, John.

Looks like I goofed a bit. The command to find the 8.3 filenames should be
dir /x. The /s/a is to show all files (including Hidden, System and Read
only) in all subdirectories. Dir /x should show all the Long File Names
with an additional column, before those names, showing the Short File Names.
And, of course, even a very short name is an LFN if it includes a character
not allowed in an SFN - such as a space. Often, the dir /x command reveals
that the SFN is quite different from what we expect from seeing the visible
name.

I'm not sure how to interpret your examples. You show " "; is that what
you actually typed, or do you mean that you get the same (bad) results no
matter what you type? Does " " indicate wildcards, or are you actually
typing spaces between the quotes?

You can't remove the active directory, of course, or its parent. So if your
rogue files are all in c:\xxx\badguys, for example, you should cd to some
other directory, such as C:\yyy, and your entry would look like:
c:\yyy>rd c:\xxx\badguys /s

We may need to see the actual filenames, rather than examples, in order to
interpret just what the problem is. If you copy'n'paste some sample name(s)
from Windows Explorer into Outlook Express, we might be able to see any
oddball characters.

As I said, though, if it is a permissions problem, I probably won't be able
to help.

RC
--
R. C. White, CPA
San Marcos, TX
rc@corridor.net
Microsoft Windows MVP


"John Smith" <someone@microsoft.com> wrote in message
news:uonKCycdFHA.720@TK2MSFTNGP15.phx.gbl...
> C:\xxx>dir /s /a " "
> The system cannot find the path specified.
>
> C:\xxx>rd " "
> The system cannot find the path specified.
>
> C:\xxx>
>
> no matter what i do, all i get is "The system cannot find the path
> specified."
>
>
>
>
> "R. C. White" <rc@corridor.net> wrote in message
> news:u1Y8yKcdFHA.1448@TK2MSFTNGP14.phx.gbl...
>> Hi, John.
>>
>> This is a FAQ here, although it seems to have been asked less frequently
>> of late. A search of the archives should produce many tips.
>>
>> To start with the easy stuff...
>>
>> Open a Command Prompt ("DOS" window) and use the good old DOS commands to
>> get the 8.3 filenames (dir /s/a) and delete those (del <SFN> ). Or
>> isolate the bad guys in their own directory and then remove the whole
>> directory tree - files, subfolders and all - in one fell swoop (rd
>> <foldername> /s). As always in the "DOS" window, type any command
>> followed by /? to see a mini-Help file listing all the switches and
>> parameters for that command: dir /?
>>
>> As a one-man, one-computer kind of guy, I know nothing of networks or
>> permissions or stuff like that. So your problem may very well be over my
>> head. I hope some real guru will chime in with some better ideas for
>> you.
>>
>> RC
>>
>> "John Smith" <someone@microsoft.com> wrote in message
>> news:uJbPeO2cFHA.3132@TK2MSFTNGP14.phx.gbl...
>>> Hello,
>>>
>>> I've had a "visitor" (a.k.a. hacker) on my computer who left bunch of
>>> files which i can not delete... whenever i try to delete those files i
>>> get "Cannot delete file: Cannont read from the source file or disk.", in
>>> Access Control Settings, i have greyout and without ability to remove
>>> "Everyone".. I've tryed to add Administrator, but everytime i do so i
>>> get "An error occured applying security information to:" <dir/file name>
>>> The system cannot find the file specified.
>>>
>>> any ideas?

Hi R. C. White! I am having the same problem as John here, and what you posted had helped a lot. I had several folders with odd names placed on my Win2k server by a hacker, and doing a "rd /s" got rid of most of the folders.

However, one folder tree remains, and when I try "rd /s" on it, ti tells me that "The system cannot find the file specified."

If i do a "dir /x" on the folder in question, I get this:

Volume in drive E is New Volume
Volume Serial Number is C808-3D7E

Directory of E:\Web\remmis sites\digitalnetstorage.com\0303~1\0200~1\0200~1

11/22/2005 04:35p <DIR> .
11/22/2005 04:35p <DIR> ..
11/22/2005 04:35p <DIR> com3
0 File(s) 0 bytes
3 Dir(s) 4,297,605,120 bytes free

It seems like the LFN is "com3", but the SFN is blank, or a space, or a series of spaces. Trying the "rd /s" command on the com3 folder or parent folder, it will always tell me that "The system cannot find the file specified." and displays the com3 folder. Com3 strikes me as a reserved windows file name or something.

I know your last post to this thread is 2 years old, so I'm hoping to God that you are still watching this site, or someone is.

Please help!