Cursed Folder can't be deleted

[VasekS]

Hello!
I have weird problem here! I've downloaded some *ZIP archive, extracted it and now the folder can't be deleted! It's been about 2-3 weeks now and it's still stuck here like forever. I could delete all it's contents but folder persists! I can move it everywhere around, rename it and all stuff without problem but when i want to delete it i just get "File could not be found".. I am not a computer noob I am an IT analytic, never met anything like this before - some even better technicians here to sort this thing out? ..It's not used by other program (or might be but doesn't say that).

Some stuff I tried so u don't waste your time:
- delete with CMD commands (Says it doesn't even exists)
- checking HDD for bad sectors w/ CHKDSK (all negative)
- File unlocker

is it some weird Windows error that is hiding this folder behind other sectors or smth? Or is it some really complex rootkit that exploits WinRar or some sh*t like that? Thanks in advance.

 

[clutchc]

Have you done a FULL virus scan and Malwarebytes scan?

 

[johnbl]

you would have to look at the files in the directory. the windows file system has some reserved file names that the windows interface is not allowed to delete. (any file name based on old dos device driver names)

for example, if I were to make a file on a Linux machine called con.txt
zip it up and unzip it on windows then when windows went to delete the file it would return a error.
because con is mapped to the console device. Windows interface generally will prevent these files but 3rd party programs generally do not filter out the bad names.
(try to use file manager to rename any file to con.txt to see what happens)

other special case names (com, aux, nul, con, prn, com1, ser) with any file extension

there can be file attributes that block deletion of files also (see Icacls.exe command )
maybe google "how to remove access control list from files"
(sorry, it has been a long time since I used this command, last time it was an adobe file/directory that did it to me)

there can also be hidden subdirectories. And windows hides certain directories from the user.

note: sometimes you can use the old cmd commands to see the contents of the directory.

ie start cmd, get the to directory then try
attrib *.*
or
attrib /s *.*
(to recurse down sub directories)

 

[beinik6]

Simple fix that worked for me: Go to the location that folder is, copy the name of the folder. Create a new folder in the directory the ghost folder is and name it the same as the ghost folder. (You may have to do that twice). Now try to delete the ghost folder.

 

[VasekS]

Simple fix that worked for me: Go to the location that folder is, copy the name of the folder. Create a new folder in the directory the ghost folder is and name it the same as the ghost folder. (You may have to do that twice). Now try to delete the ghost folder.

Tried that - it deleted that ghost folder but the one I created now took its position so I can't get rid of it.

 

[beinik6]

Simple fix that worked for me: Go to the location that folder is, copy the name of the folder. Create a new folder in the directory the ghost folder is and name it the same as the ghost folder. (You may have to do that twice). Now try to delete the ghost folder.

Tried that - it deleted that ghost folder but the one I created now took its position so I can't get rid of it.

Hm well. Try the same but you create the folder, then you dont delete it but create another one with the name. If that does not work, sorry, I also dont know anything else then reinstalling windows.

 

[beinik6]

Okey well the only thing a friend told me helped him with this was Ccleaner, you may try it, nothing to loose i think.

 

[VasekS]

you would have to look at the files in the directory. the windows file system has some reserved file names that the windows interface is not allowed to delete. (any file name based on old dos device driver names)

for example, if I were to make a file on a Linux machine called con.txt
zip it up and unzip it on windows then when windows went to delete the file it would return a error.
because con is mapped to the console device. Windows interface generally will prevent these files but 3rd party programs generally do not filter out the bad names.
(try to use file manager to rename any file to con.txt to see what happens)

other special case names (com, aux, nul, con, prn, com1, ser) with any file extension

there can be file attributes that block deletion of files also (see Icacls.exe command )
maybe google "how to remove access control list from files"
(sorry, it has been a long time since I used this command, last time it was an adobe file/directory that did it to me)

there can also be hidden subdirectories. And windows hides certain directories from the user.

note: sometimes you can use the old cmd commands to see the contents of the directory.

ie start cmd, get the to directory then try
attrib *.*
or
attrib /s *.*
(to recurse down sub directories)

I have tried attrib cmd in the affected folder it broke entire CMD (wrote: so i went more carefully and just navigated it to upper Downloads folder and it said the content is "desktop.ini" but not of the affected folder but of the main Downloads folder that carries all my downloads.

Content of the file:
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21798
IconResource=%SystemRoot%\system32\imageres.dll,-184

I wouldn't bother with some folder inside my downloads folder but when i'm near that cursed folder entire Windows behaves weird - it breaks entire CMD when i try to paste it's path in. I'm worried if it can't break the entire system somehow.

 

[VasekS]

Have you done a FULL virus scan and Malwarebytes scan?

I did full scan with 4 antiviruses (Avast!,HitmanPro,Malwarebytes Anti-Rootkit&anti-malware) all of them returned clean.

 

[VasekS]

Okey well the only thing a friend told me helped him with this was Ccleaner, you may try it, nothing to loose i think.

I'm using ccleaner almost everyday and unfortunately no effect.

 

[johnbl]

I would delete the desktop.ini in the bad directory.
Or see if either of the two .dll that it loads have been modified
(shell.dll and imageres.dll)

you might also confirm that your cmd.exe is the one that ships with windows and has not been replaced with a different version.
my windows 10 build 1790 os build 16299.248
version from c:\windows\system32\cmd.exe is dated 9/29/17 size = 272,896 bytes

third party programs might be using imageres.dll to load custom file icons.
look here at icon 184 to see if what you expect:http://help4windows.com/windows_7_imageres_dll.shtml
(movie/film icon?)

here is info on how to rebuild the windows icon cache if it is corrupted:
https://www.sevenforums.com/tutorials/49819-icon-cache-rebuild.html

 

[wpgwpg]

Whenever I have a problem deleting a file or folder, I boot Linux Mint and it will delete anything. It boots from a flash drive in about 1 minute, has a Windows like user interface, and requires no knowledge of Linux, and there's nothing to install on your hard drive.

 

[VasekS]

I would delete the desktop.ini in the bad directory.
Or see if either of the two .dll that it loads have been modified
(shell.dll and imageres.dll)

you might also confirm that your cmd.exe is the one that ships with windows and has not been replaced with a different version.
my windows 10 build 1790 os build 16299.248
version from c:\windows\system32\cmd.exe is dated 9/29/17 size = 272,896 bytes

third party programs might be using imageres.dll to load custom file icons.
look here at icon 184 to see if what you expect:http://help4windows.com/windows_7_imageres_dll.shtml
(movie/film icon?)

here is info on how to rebuild the windows icon cache if it is corrupted:
https://www.sevenforums.com/tutorials/49819-icon-cache-rebuild.html

Yeah no modifications there.. but Killswitch reported Disabled Safe Mode for some reason. Dunno if that is Windows update thing as my Killswitch is outdated.

 

[VasekS]

Whenever I have a problem deleting a file or folder, I boot Linux Mint and it will delete anything. It boots from a flash drive in about 1 minute, has a Windows like user interface, and requires no knowledge of Linux, and there's nothing to install on your hard drive.

I guess I'll try that then.

 

[mjslakeridge]

You may try WinDirStat to find and then delete the folder.

 

[VasekS]

You may try WinDirStat to find and then delete the folder.

WinDirStat delete function uses Windows explorer's delete function so it says "Could not be found" either, unfortunately.

 

[mjslakeridge]

I didn't know that WinDirStat uses Window's explorer's delete function. I wonder if that is something new with WinDirStat, or Windows 10. I guess you will have to try the Linux suggestion.

 

[BFG-9000]

Windows is really bad about not letting you delete files or folders containing invalid characters. If that's the case the official Microsoft way to delete them is here.

Otherwise, if the file is not deletable simply because it is in use and locked (including by malware), then you'll need an unlocker tool. As you've already tried Unlocker, Malwarebytes also offers a free tool called FileASSASSIN.

 

[VasekS]

Windows is really bad about not letting you delete files or folders containing invalid characters. If that's the case the official Microsoft way to delete them is here.

Otherwise, if the file is not deletable simply because it is in use and locked (including by malware), then you'll need an unlocker tool. As you've already tried Unlocker, Malwarebytes also offers a free tool called FileASSASSIN.

FileASSASSIN does not work on folders.

 

[VasekS]

Ok guys I solved this myself. I ran 7-zip file manager, renamed problematic folder and deleted afterwards. Done.
Thank you all for your answers . Your ideas were good and wouldn't found them myself.

 

[mjslakeridge]

Glad you got it solved!

 

[clutchc]

Ok guys I solved this myself. I ran 7-zip file manager, renamed problematic folder and deleted afterwards. Done.
Thank you all for your answers . Your ideas were good and wouldn't found them myself.

Great idea about using another file manager (like 7-Zip). Thinking outside the box.

 

[johnbl]

3rd party tools generally can delete files these files since the windows APIs does not have the file name limits.
Linux/unix connected thru the network or a hyperviser would also work. over all, without knowing the actual file, you can not tell what the problem was, it could be something simple like a trailing space in a filename. files provided by windows OS will strip out the leading and trailing spaces, third party programs may not. Some international characters do not have mappings cause bugs when windows goes to delete the file.

Ok guys I solved this myself. I ran 7-zip file manager, renamed problematic folder and deleted afterwards. Done.
Thank you all for your answers . Your ideas were good and wouldn't found them myself.

Great idea about using another file manager (like 7-Zip). Thinking outside the box.