Deleting files

[Andrew Chalk]

How do I delete files that contain illegal characters? I just checked my
ftproot and there are a slew of obscurely named directories that appear to
have been created by some intruder. They are protected from deletion --
presumably by an illegal charater in the name. Is there a tool that can
handle such files?

Thanks.

 

[Pegasus \(MVP\)]

How do I delete files that contain illegal characters? I just checked my
ftproot and there are a slew of obscurely named directories that appear to
have been created by some intruder. They are protected from deletion --
presumably by an illegal charater in the name. Is there a tool that can
handle such files?

Thanks.

Most can be deleted with a "wildcard" command from a Command
Prompt. If you post an example then someone can give you further
instructions.

 

[Dave Patrick]

From a command prompt try;

del \\.\Drive:\directory\filename
(Note: the period between \\ and \)

Also

dir /x
and try deleting them using their 8.3 short names.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| How do I delete files that contain illegal characters? I just checked my
| ftproot and there are a slew of obscurely named directories that appear to
| have been created by some intruder. They are protected from deletion --
| presumably by an illegal charater in the name. Is there a tool that can
| handle such files?
|
| Thanks.
|
|

 

[Andrew Chalk]

I tried that. No luck. The names appear to use non-printing characters. Even
*.* does not work. I am assuming that it is the illegal characters that are
the cause of the problem as that was an old trick from DOS days. I have also
stopped the ftp service so that is not holding them open..

Any other ideas?

Thanks.

 

[Andrew Chalk]

No joy. See my reply to Pegasus for a description.

This looks like a standard hacker trick. Is there a tool to remove such
files?

Thanks.

 

[Jim Byrd]

Hi Andrew - From my Blog, Defending Your Machine, here:
http://defendingyourmachine.blogspot.com/ Try particularly Delete Invalid
File.


? Sometimes the tools below will find files which they are unable to delete
because they are in use.

A program called Copylock, here, http://noeld.com/programs.asp?cat=misc can
aid in the process of "replacing, moving, renaming or deleting one or many
files which are currently in use (e.g. system files like comctl32.dll, or
virus/trojan files.)"

Another is Killbox, here: http://www.downloads.subratam.org/KillBox.zip

A third which is a bit different but often very useful is Delete Invalid
File, here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem.






--
Regards, Jim Byrd, MS-MVP

No joy. See my reply to Pegasus for a description.

This looks like a standard hacker trick. Is there a tool to remove
such files?

Thanks.

From a command prompt try;

del \\.\Drive:\directory\filename
(Note: the period between \\ and \)

Also

dir /x
and try deleting them using their 8.3 short names.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

How do I delete files that contain illegal characters? I just
checked my ftproot and there are a slew of obscurely named
directories that appear to have been created by some intruder. They
are protected from deletion -- presumably by an illegal charater in
the name. Is there a tool that can handle such files?

Thanks.

 

[Andrew Chalk]

Correction. With corrected sysntax error on my end your first suggestion
worked!

Also:

http://support.microsoft.com/default.aspx?scid=kb;en-us;120716

- Andrew

 

[Andrew Chalk]

Thanks, I'll check it out.

- A

Hi Andrew - From my Blog, Defending Your Machine, here:
http://defendingyourmachine.blogspot.com/ Try particularly Delete Invalid
File.


? Sometimes the tools below will find files which they are unable to delete
because they are in use.

A program called Copylock, here, http://noeld.com/programs.asp?cat=misc can
aid in the process of "replacing, moving, renaming or deleting one or many
files which are currently in use (e.g. system files like comctl32.dll, or
virus/trojan files.)"

Another is Killbox, here: http://www.downloads.subratam.org/KillBox.zip

A third which is a bit different but often very useful is Delete Invalid
File, here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem.






--
Regards, Jim Byrd, MS-MVP

No joy. See my reply to Pegasus for a description.

This looks like a standard hacker trick. Is there a tool to remove
such files?

Thanks.

From a command prompt try;

del \\.\Drive:\directory\filename
(Note: the period between \\ and \)

Also

dir /x
and try deleting them using their 8.3 short names.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
How do I delete files that contain illegal characters? I just
checked my ftproot and there are a slew of obscurely named
directories that appear to have been created by some intruder. They
are protected from deletion -- presumably by an illegal charater in
the name. Is there a tool that can handle such files?

Thanks.

 

[Quaestor]

How do I delete files that contain illegal characters? I just checked my
ftproot and there are a slew of obscurely named directories that appear to
have been created by some intruder. They are protected from deletion --
presumably by an illegal charater in the name. Is there a tool that can
handle such files?

Copy off anything you want to save, delete the ftproot folder itself,
and then recreate it.

 

[Dave Patrick]

You're welcome.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Correction. With corrected sysntax error on my end your first suggestion
| worked!

 

[Rob Stow]

Andrew Chalk wrote:




Copy off anything you want to save, delete the ftproot folder itself,
and then recreate it.

There are two other things you can easily try:

1.) Delete using the 8.3 names.
To display directories with 8.3 names: dir /x /ad

2.) Delete using the extended command syntax:
rd /s /q "\\.\c:\path to folder\folder name .ext"

The keys here are
2A.) prefix the file or folder name with "\\.\"
2B.) full paths must be used

And yes, you can use standard wild cards as well as the 8.3 names
in conjunction with this technique. Wild cards are adviseable in
this situation because they help you deal with "invisible"
characters, such as trailing spaces at the ends of file or folder
names.