Can not delete a file with 8bit characters in the name

[Matt]

I have received several attachments from spammers with
8bit characters in their filenames. When I try and delete
the files I get the message "File not found".

I have tried removing them in Windows Explorer, Command
Prompt, and a custom program I wrote. I get the same
results each way.

How can you kill these files?

Matt

 

[David J. Craig]

First, find the person holding the keyboard and mouse. Then lock that
person in a small closet for at least three months. Feed that person
several books on Windows such as those in the "Dummies" series.

From the question I know I can't depend upon this being Windows 2000 you are
using, but I will pretend it is. Start a CMD.EXE window. Change the
current drive and directory to where the bad files were saved. Do a dir /x
in that directory. See if the short file names can be deleted. If not,
format the hard drive and reinstall the operating system. There are disk
utilities and other things that might work, but are probably far too
complex.

 

[R. C. White]

Hi, Matt.

How did those attachments become files on your computer in the first place?
Receiving the messages that carry attachments apparently can't be helped,
unless your ISP has a good filter that can stop them before they reach your
computer. But you certainly can keep them from becoming FILES on your own
computer, can't you?

Which email program do you use to receive the messages from spammers? In
OE, there is no need to open the attachment. Simply highlight the message
in the list and Delete it. The message - attachment and all - will simply
disappear without ever becoming a file on your computer. The attachment's
short life on your computer will have been limited to being just a part of
your Inbox.dbx file, never a separate file.

If you HAVE ignored all the warnings and safeguards and do have such files,
then open a "DOS" window, use dir /x to determine the SFN (Short File Name,
also known as the 8.3 filename) of each file and del <SFN> for each one.
(You said you tried the Command Prompt, but you didn't say HOW you tried
it.)

Then make sure that your OE is still set to protect you from such
attachments. Click Tools | Options... and then the Security tab. By
default, the box in front of "Do not allow attachments to be saved or opened
that could potentially be a virus" is checked. If the check has
disappeared, put it back. Whenever you DO need to open an attachment that
you trust, visit this page and uncheck the box, then visit it again and
check the box again when you are finished. Also, of course, even if the box
is not checked, do not open, file, read or otherwise even look at an
attachment unless you trust the sender, both in the sense of trusting that
person to do you no harm intentionally AND in the sense of trusting that
person to "practice safe hex" and not harm you unintentionally.

RC

 

[Matt]

This computer is running Win2K.
The user is a 30 year veteran operating system designer.
The dir /x output shows the 8bit characters also, no dice.
Formatting the hard drive should not be required to delete
a file in a properly designed operating system.
Please let me know if you have a reasonable suggestion.

 

[Matt]

Good evening,

The attachments were automatically saved as files by my
email program (Eudora). I do not know if it has an option
to not do this, I looked before but didn't see one.

dir /x prints the short filenames with 8bit characters,
no help there.

The problem appears to be in the filesystem's programming
interface to the shell or program that is trying to access
the file. When the program queries the filesystem for the
names of the file in the folder it is being supplied the
filenames in 8bit characters as they are stored on the
disk. When the program sends that same string back to
the filesystem as part of a delete or rename command
something in the OS that manipulates the files is probably
stripping the 8th bit off the filename and the mangled
7bit filename is not matching any of the files in the
directory, hence the "File not found" message I get when
trying to rename/delete the offending files.

Third party disc managers will probably have the same
problem that both the windows command shell, the Windows
Explorer, and the program I wrote ran into, that the
OS code that supports file commands does not support 8
bit characters in the filename for all functions.

Thanks to anyone who can shed enough light on this issue
to allow for a solution other than formatting the disc
and starting over.

Matt

 

[Michael Bednarek]

I have received several attachments from spammers with
8bit characters in their filenames. When I try and delete
the files I get the message "File not found".

I have tried removing them in Windows Explorer, Command
Prompt, and a custom program I wrote. I get the same
results each way.

How can you kill these files?

I can't duplicate that here (CMD.EXE or Explorer in NT5.0/5.1). If I
create a file with Alt+128 in the filename (TESTÇ.TXT), I also can
delete it. Alt+128 appears here as Ç (capital cedille). My codepage is
850, my console font is the default Raster Fonts. However, I observe
that the short filename of such a file is TEST~1.TXT whereas you say the
short filename on your system also contains the 8-bit character, which I
find baffling.

Can you cite an example of a filename, long and short?

What happens if you use wildcards, omitting the 8-bit character(s) with
a "?"? Or what if you move all non-8-bit filenames somewhere else and
then issue: DEL *.* in that directory?

 

[Guest]

Thanks for the response!

Del *.* yields the message for each file:
"The system cannot find the file specified."
This message appears once for each file.

Del ????????.EMS yields the same thing.

Is there a way to post a screenshot here?
If not is there a way to forward you a JPG?

The filenames have a hard '~' (tilde), this
might be the interesting piece of information.
Some of the filenames only have the C with the
tail as an odd character outside of the tilde.

The 'dir' and 'dir /x' outputs are identical.

Attrib lists the files as only having the 'A'
bit set.

Thanks for any help!

Matt

 

[Michael Bednarek]

Del *.* yields the message for each file:
"The system cannot find the file specified."
This message appears once for each file.

Del ????????.EMS yields the same thing.

Is there a way to post a screenshot here?
If not is there a way to forward you a JPG?

Just cite a filename. What about
DIR /X >fu.bar
and then paste fu.bar into a post?

Do the filenames contain device names, like LPT1, PRN, AUX, COMn, CON?

The filenames have a hard '~' (tilde), this
might be the interesting piece of information.
Some of the filenames only have the C with the
tail as an odd character outside of the tilde.

The 'dir' and 'dir /x' outputs are identical.

They can't be.

 

[Matt]

Thanks for the suggestions. Here is the output of the
shell commands you suggested:

L:\Users\Matt\Attachments>dir /x
Volume in drive L is Windows
Volume Serial Number is 0101-16CD

Directory of L:\Users\Matt\Attachments

07/30/2004 05:06p <DIR> .
07/16/2004 02:11p <DIR> ..
02/25/2004 09:51a 2,663 (╓)
EÆ~!S.EMS
03/08/2004 11:08a 3,117
UUAIÇ~HY.EMS
03/09/2004 02:42p 2,147
UUAIÇ~FM.EMS
03/15/2004 10:34a 1,670 (╓)
1'~O5.EMS
03/10/2004 11:11a 2,192
UUAIÇ~FS.EMS
03/17/2004 10:09a 1,614
¥_ÄÅÇ~%7.EMS
03/18/2004 10:24a 990
¥AÄÅÇ~1X.EMS
07/29/2004 04:41p 19,456 EVERY~WU.DOC
Every Nation DVD Sunday.d
oc
03/19/2004 10:28a 1,025
¥AÄÅÇ~H9.EMS
07/28/2004 10:41p 787 OPENI~87.TXT
Opening and Closing Cards
..txt
07/28/2004 11:24a <DIR>
ToFile
10 File(s) 35,661 bytes
3 Dir(s) 21,483,225,088 bytes free

L:\Users\Matt\Attachments>dir
Volume in drive L is Windows
Volume Serial Number is 0101-16CD

Directory of L:\Users\Matt\Attachments

07/30/2004 05:06p <DIR> .
07/16/2004 02:11p <DIR> ..
02/25/2004 09:51a 2,663 (╓)EÆ~!S.EMS
03/08/2004 11:08a 3,117 UUAIÇ~HY.EMS
03/09/2004 02:42p 2,147 UUAIÇ~FM.EMS
03/15/2004 10:34a 1,670 (╓)1'~O5.EMS
03/10/2004 11:11a 2,192 UUAIÇ~FS.EMS
03/17/2004 10:09a 1,614 ¥_ÄÅÇ~%7.EMS
03/18/2004 10:24a 990 ¥AÄÅÇ~1X.EMS
07/29/2004 04:41p 19,456 Every Nation DVD
Sunday.doc
03/19/2004 10:28a 1,025 ¥AÄÅÇ~H9.EMS
07/28/2004 10:41p 787 Opening and Closing
Cards.txt
07/28/2004 11:24a <DIR> ToFile
10 File(s) 35,661 bytes
3 Dir(s) 21,483,225,088 bytes free

L:\Users\Matt\Attachments>del U*
L:\Users\Matt\Attachments\UUAIÇ~HY.EMS
The system cannot find the file specified.
L:\Users\Matt\Attachments\UUAIÇ~FM.EMS
The system cannot find the file specified.
L:\Users\Matt\Attachments\UUAIÇ~FS.EMS
The system cannot find the file specified.

L:\Users\Matt\Attachments>

 

[Michael Bednarek]

I still can't duplicate the behaviour you describe.

I can create the filenames you cite, and delete them
from Explorer or from cmd (you ARE using cmd.exe, not
COMMAND.COM, right?) "DEL U*" works as expected, as does
"DEL *.EMS".

Several things to try/check:
* Start cmd.exe with the /u switch
* Use cmd's filename completion; type
DEL U<TAB>
where <TAB> indicates to hit the filename completion
character, which most people set to TAB.
* Can you delete the whole directory Attachments from
Explorer?
* Is your file system NTFS?
* Does your e-mail program (Eudora?) have any mechanism
to delete previously saved attachments?

(Also, when you deal with a problem involving unusual
characters, posting from a web or HTML based client to
newsgroups is confusing; I believe "Content-Transfer-Encoding:
quoted-printable" will mangle these characters quite
badly; use "Content-Transfer-Encoding: 8bit" instead.
It would also help to turn line wrap off temporarily -
as I have done here. It doesn't guarantee that lines will
get as intended to the reader, but at least they have a
chance. A proper news reader is much preferrable.)

Thanks for the suggestions. Here is the output of the
shell commands you suggested:

L:\Users\Matt\Attachments>dir /x [snip]
02/25/2004 09:51a 2,663 (╓)EÆ~!S.EMS
03/08/2004 11:08a 3,117 UUAI=C7~HY.EMS
03/09/2004 02:42p 2,147 UUAI=C7~FM.EMS
03/15/2004 10:34a 1,670 (╓)1'~O5.EMS
03/10/2004 11:11a 2,192 UUAI=C7~FS.EMS
03/19/2004 10:28a 1,025 ¥AÄÅÇ~H9.EMS [snip]

L:\Users\Matt\Attachments>dir

[snip]
02/25/2004 09:51a 2,663 (╓)EÆ~!S.EMS
03/08/2004 11:08a 3,117 UUAIÇ~HY.EMS
03/09/2004 02:42p 2,147 UUAIÇ~FM.EMS
03/15/2004 10:34a 1,670 (╓)1'~O5.EMS
03/10/2004 11:11a 2,192 UUAIÇ~FS.EMS
03/17/2004 10:09a 1,614 ¥_ÄÅÇ~%7.EMS
03/18/2004 10:24a 990 ¥AÄÅÇ~1X.EMS [snip]
L:\Users\Matt\Attachments>del U*
L:\Users\Matt\Attachments\UUAIÇ~HY.EMS
The system cannot find the file specified.
L:\Users\Matt\Attachments\UUAIÇ~FM.EMS
The system cannot find the file specified.
L:\Users\Matt\Attachments\UUAIÇ~FS.EMS
The system cannot find the file specified. [snip]

-----Original Message-----


Just cite a filename. What about
DIR /X >fu.bar
and then paste fu.bar into a post?

Do the filenames contain device names, like LPT1, PRN, AUX, COMn, CON?


They can't be.

 

[Overlord]

Hi Matt.

Something will work.

Boot to command prompt, navagate to the directory and use the old
Zip commands to zip all the files in the directory using the switches to
move the files into the zip file. Unzip all the files you want back and
delete the zip file with the nasty stuff still in it.

Boot a Knoppix disk, bring up the file and see if nix has a problem deleting
the files. In the past Knoppix has supposedly had some trouble handling
NTFS file systems. Don't know if it's worked it out yet or not.

This;
http://www.theabsolute.net/sware/dskinv.html
claims to "Display the true drive contents by bypassing the operating system
and directly reading the raw drive sectors". Worth a shot....
Perhaps this or another util can directly edit the MFT;
Find out the file's address, drive around it's neighborhood, firebomb it's house.

Thanks for the suggestions. Here is the output of the
shell commands you suggested:

L:\Users\Matt\Attachments>dir /x
Volume in drive L is Windows
Volume Serial Number is 0101-16CD

Directory of L:\Users\Matt\Attachments

07/30/2004 05:06p <DIR> .
07/16/2004 02:11p <DIR> ..
02/25/2004 09:51a 2,663 (╓)
E=C6~!S.EMS
03/08/2004 11:08a 3,117 =20
UUAI=C7~HY.EMS
03/09/2004 02:42p 2,147 =20
UUAI=C7~FM.EMS
03/15/2004 10:34a 1,670 (╓)
1'~O5.EMS
03/10/2004 11:11a 2,192 =20
UUAI=C7~FS.EMS
03/17/2004 10:09a 1,614 =20
=A5_=C4=C5=C7~%7.EMS
03/18/2004 10:24a 990 =20
=A5A=C4=C5=C7~1X.EMS
07/29/2004 04:41p 19,456 EVERY~WU.DOC =20
Every Nation DVD Sunday.d
oc
03/19/2004 10:28a 1,025 =20
=A5A=C4=C5=C7~H9.EMS
07/28/2004 10:41p 787 OPENI~87.TXT =20
Opening and Closing Cards
.txt
07/28/2004 11:24a <DIR> =20
ToFile
10 File(s) 35,661 bytes
3 Dir(s) 21,483,225,088 bytes free

L:\Users\Matt\Attachments>dir
Volume in drive L is Windows
Volume Serial Number is 0101-16CD

Directory of L:\Users\Matt\Attachments

07/30/2004 05:06p <DIR> .
07/16/2004 02:11p <DIR> ..
02/25/2004 09:51a 2,663 (╓)E=C6~!S.EMS
03/08/2004 11:08a 3,117 UUAI=C7~HY.EMS
03/09/2004 02:42p 2,147 UUAI=C7~FM.EMS
03/15/2004 10:34a 1,670 (╓)1'~O5.EMS
03/10/2004 11:11a 2,192 UUAI=C7~FS.EMS
03/17/2004 10:09a 1,614 =A5_=C4=C5=C7~%7.EMS
03/18/2004 10:24a 990 =A5A=C4=C5=C7~1X.EMS
07/29/2004 04:41p 19,456 Every Nation DVD=20
Sunday.doc
03/19/2004 10:28a 1,025 =A5A=C4=C5=C7~H9.EMS
07/28/2004 10:41p 787 Opening and Closing=20
Cards.txt
07/28/2004 11:24a <DIR> ToFile
10 File(s) 35,661 bytes
3 Dir(s) 21,483,225,088 bytes free

L:\Users\Matt\Attachments>del U*
L:\Users\Matt\Attachments\UUAI=C7~HY.EMS
The system cannot find the file specified.
L:\Users\Matt\Attachments\UUAI=C7~FM.EMS
The system cannot find the file specified.
L:\Users\Matt\Attachments\UUAI=C7~FS.EMS
The system cannot find the file specified.

L:\Users\Matt\Attachments>

~~~~~~
Bait for spammers:
root@localhost
postmaster@localhost
admin@localhost
abuse@localhost
postmaster@[127.0.0.1]
(e-mail address removed)
~~~~~~
Remove "spamless" to email me.

 

[Guest]

Thanks for all your suggestions.

I physically unmounted the HD and took it over to
my Linux computer. Root was able to remove the
files no problem.

All other suggestions didn't pan out.

 

[Guest]

Thanks for all your suggestions.

I physically unmounted the HD and took it over to
my Linux computer. Root was able to remove the
files no problem.

All other suggestions didn't pan out.

 

[Michael Bednarek]

Thanks for all your suggestions.

I physically unmounted the HD and took it over to
my Linux computer. Root was able to remove the
files no problem.

All other suggestions didn't pan out.

Thanks for the update. Does that mean the file system was not NTFS, or
can your Linux computer read/write NTFS?

 

[Michael Cecil]

Thanks for the update. Does that mean the file system was not NTFS, or
can your Linux computer read/write NTFS?

Linux R/W support for NTFS hasn't still been experimental for over a year.