Can't delete file or folder with weird name

There are certain ways of naming files so that they become very difficult to delete. This can occur if files are named using reserved words and special characters. Often times when a network has been compromised by an attacker, they will use these techniques to create files which are difficult for a system administrator to remove.

We have found that the most effective to actually delete these files is to use the rm.exe tool which is available in the Resource Kit. You can also download the resource kit utililties, or try this set of sourceforge UNIX utilities. The Resource Kit tool has been tested to work (we have not seen it fail), however we have not tried the sourceforge UNIX utilities to delete a file which cannot be deleted using conventional methods.

If the file cannot be deleted using Windows® Explorer, you can also try some of these other options:

Ensure you have correct permissions to the file
(Note: if you are running Windows XP, you must be running in Safe Mode to be able to see the Security tab, or view this TechByte for alternatives):

• Ensure you are logged in as an account with administrative privileges.
• Find the offending file or folder in Windows Explorer.
• Right-click on it and choose Properties.
• Click the Security tab.
• Ensure the Administrators group has Full Control. If it does not, click the Full Control box.
• Click OK to save the changes and close the window.
• Attempt to delete from Explorer again.

Delete from the command line:

• Open a command-prompt window: Start -> Run -> cmd
• cd to the parent folder containing the offending file/folder.
• Type dir /x to view the short version (8.3) of the filename. It will appear between the file size and the long filename columns and may contain a tilde (~) if the name is longer than 8 characters.
• Type del filename where filename is the short filename.

More information on removing special files is available in Microsoft KB article 120716.

Warning: By visiting this site and/or by using any information contained herein, you agree to the Techbytes.ca terms of use.

Add a comment about this TechByte

If you wish to add a comment regarding this TechByte, please use the form below. Please note that by submitting comments using this form you are allowing all of the information submitted to be visible on this website. Any comments submitted using this form will only be shown on the website if they are approved by the administrators of this site. IF APPROVED, COMMENTS MAY TAKE SEVERAL DAYS TO BE POSTED.

Other TechBytes:

• WPA security using older wireless network cards
• Declaring an array of objects WithEvents
• Timer objects in a formless project