Deleting files

  • Thread starter Thread starter Andrew Chalk
  • Start date Start date
A

Andrew Chalk

How do I delete files that contain illegal characters? I just checked my
ftproot and there are a slew of obscurely named directories that appear to
have been created by some intruder. They are protected from deletion --
presumably by an illegal charater in the name. Is there a tool that can
handle such files?

Thanks.
 
Andrew Chalk said:
How do I delete files that contain illegal characters? I just checked my
ftproot and there are a slew of obscurely named directories that appear to
have been created by some intruder. They are protected from deletion --
presumably by an illegal charater in the name. Is there a tool that can
handle such files?

Thanks.
Click to expand...

Most can be deleted with a "wildcard" command from a Command
Prompt. If you post an example then someone can give you further
instructions.
 
From a command prompt try;

del \\.\Drive:\directory\filename
(Note: the period between \\ and \)

Also

dir /x
and try deleting them using their 8.3 short names.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| How do I delete files that contain illegal characters? I just checked my
| ftproot and there are a slew of obscurely named directories that appear to
| have been created by some intruder. They are protected from deletion --
| presumably by an illegal charater in the name. Is there a tool that can
| handle such files?
|
| Thanks.
|
|
 
I tried that. No luck. The names appear to use non-printing characters. Even
*.* does not work. I am assuming that it is the illegal characters that are
the cause of the problem as that was an old trick from DOS days. I have also
stopped the ftp service so that is not holding them open..

Any other ideas?

Thanks.
 
No joy. See my reply to Pegasus for a description.

This looks like a standard hacker trick. Is there a tool to remove such
files?

Thanks.
 
Hi Andrew - From my Blog, Defending Your Machine, here:
http://defendingyourmachine.blogspot.com/ Try particularly Delete Invalid
File.


? Sometimes the tools below will find files which they are unable to delete
because they are in use.

A program called Copylock, here, http://noeld.com/programs.asp?cat=misc can
aid in the process of "replacing, moving, renaming or deleting one or many
files which are currently in use (e.g. system files like comctl32.dll, or
virus/trojan files.)"

Another is Killbox, here: http://www.downloads.subratam.org/KillBox.zip

A third which is a bit different but often very useful is Delete Invalid
File, here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem.






--
Regards, Jim Byrd, MS-MVP

Andrew Chalk said:
No joy. See my reply to Pegasus for a description.

This looks like a standard hacker trick. Is there a tool to remove
such files?

Thanks.

Dave Patrick said:
From a command prompt try;

del \\.\Drive:\directory\filename
(Note: the period between \\ and \)

Also

dir /x
and try deleting them using their 8.3 short names.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

Andrew Chalk said:
How do I delete files that contain illegal characters? I just
checked my ftproot and there are a slew of obscurely named
directories that appear to have been created by some intruder. They
are protected from deletion -- presumably by an illegal charater in
the name. Is there a tool that can handle such files?

Thanks.
Click to expand...
Click to expand...
Click to expand...
 
Thanks, I'll check it out.

- A

Jim Byrd said:
Hi Andrew - From my Blog, Defending Your Machine, here:
http://defendingyourmachine.blogspot.com/ Try particularly Delete Invalid
File.


? Sometimes the tools below will find files which they are unable to delete
because they are in use.

A program called Copylock, here, http://noeld.com/programs.asp?cat=misc can
aid in the process of "replacing, moving, renaming or deleting one or many
files which are currently in use (e.g. system files like comctl32.dll, or
virus/trojan files.)"

Another is Killbox, here: http://www.downloads.subratam.org/KillBox.zip

A third which is a bit different but often very useful is Delete Invalid
File, here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem.






--
Regards, Jim Byrd, MS-MVP

Andrew Chalk said:
No joy. See my reply to Pegasus for a description.

This looks like a standard hacker trick. Is there a tool to remove
such files?

Thanks.

Dave Patrick said:
From a command prompt try;

del \\.\Drive:\directory\filename
(Note: the period between \\ and \)

Also

dir /x
and try deleting them using their 8.3 short names.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
How do I delete files that contain illegal characters? I just
checked my ftproot and there are a slew of obscurely named
directories that appear to have been created by some intruder. They
are protected from deletion -- presumably by an illegal charater in
the name. Is there a tool that can handle such files?

Thanks.
Click to expand...
Click to expand...
Click to expand...
 
Andrew said:
How do I delete files that contain illegal characters? I just checked my
ftproot and there are a slew of obscurely named directories that appear to
have been created by some intruder. They are protected from deletion --
presumably by an illegal charater in the name. Is there a tool that can
handle such files?
Click to expand...

Copy off anything you want to save, delete the ftproot folder itself,
and then recreate it.
 
You're welcome.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Correction. With corrected sysntax error on my end your first suggestion
| worked!
 
Quaestor said:
Andrew Chalk wrote:




Copy off anything you want to save, delete the ftproot folder itself,
and then recreate it.
Click to expand...

There are two other things you can easily try:

1.) Delete using the 8.3 names.
To display directories with 8.3 names: dir /x /ad

2.) Delete using the extended command syntax:
rd /s /q "\\.\c:\path to folder\folder name .ext"

The keys here are
2A.) prefix the file or folder name with "\\.\"
2B.) full paths must be used

And yes, you can use standard wild cards as well as the 8.3 names
in conjunction with this technique. Wild cards are adviseable in
this situation because they help you deal with "invisible"
characters, such as trailing spaces at the ends of file or folder
names.
 
Back
Top