WIN2K - Undeleteable file & How to prevent in the future

I recently got something nasty downloading from kazaa. It was an undeletable file which seemed to spawn other undeleteable stuff. Reformed the hd to get rid of it. I did a post "what did I get hit by" which describes what happened. Link to that post is: http://forum.oc-forums.com/vb/showthread.php?threadid=159219

I have win2k, often put stuff off and on the computer and make changes to the system. I was lazy and had it log on by default as administrator.

Since reformatting, I now have it log on as a "user." The undeletable file that hit me would not let me go into it's properties ("access denied") even though I was logged on as administrator. How was that so?

Also, if I had been logged on, as say a "user" would the file have been able to do what it did?

Also if I'd appreciate if anyone would educate me as to what I did wrong and how one could delete such a file in the future.

Most likely the file was in use. Kazaa will share files that you just downloaded, so, that file could be uploading to someone else, or in use by Kazaa's Media Player (even if it's stopped it could still be in use.) Close Kazaa to fix that one.

If, by some weird chance, the file was executed (which wouldn't be the case with a .bmp), but if it were an exe, you wouldn't be able to touch it as long as it was running.

You should never have to do this, but taking ownership of it, and resetting the permissions is one way. (if you want more info, post back, i can run you through it).

Finally, if you can't delete it, then you can use the Recovery Console to delete it. If you have your CD handy, boot off of it and go into recovery console. Login, and delete the file. That'll kill it, kuz it won't be in use for sure.

If it's spyware that you are trying to remove, Spybot or Ad-Aware can usually remove it.

When I ran Ad-Aware it removed something (not sure what) that caused Kazaa to stop running !

Use kazaa lite instead
http://www.kazaalite.com

it's kazaa, without the spyware.

Spybot also has a feature that creates a fake spy file so the app thinks it's still there and won't break.

Right - thanks for the tips

Thanks su root for your reply.

I would appreciate if you could post instructions about taking ownership of the file. It would not allow me to access property.

I didn't know that recovery console trick. I do have the cd and will remember that for the future.

I did close Kazaa but nothing happened. I did double click on the .bmp file. Could that have launched something.

I did look in taskmanager but saw nothing out of the oridinary. Since then I've learned that processes can be hidden from task manager.

One thing that worries me, I reformated the hd. I just used the format option on the win2k install. Does that delete the partition that was there and make a new one? What exactly does it do and will it erase whatever was put there.

(Also to make reinstalling easier - I put 39 GB worth of stuff onto a spare hd before re-formating. I'm hoping that 39GB was clean.

After reformating, reinstalling win2k and reinstalling some programs yesterday morning, I was horrified to see stuff on my computer last night.

I set up with 2 users (in addition to the default administrator). Those were the only listed users under "users and there was also listed as "users and passwords" in the contol panel.

However, explorereshowed me six (!!) user folders under "documents and settings." The additional ones were: "default user", "default user.winnt" and "All Users.WINNNT" Neither "default user" or "All Users" were listed as "users" under "users and passwords" in Control Panel.

I deleted "default user" and "default user.winnt" I was unable to delete All Users.WINNT" with win telling me it was a system folder and undeleteable.

Additionally, there were 2 .exe files under the 2 users I set up (not administrator). I did not write the file name down before deleting it, but with went something like DialUp or SpdDial. One of them would not let me delete it until I found a hidden process running (which turned out to be c_dilla)

I was wondering if anything still remained on the hd after the reformat and reinstall.

I'm not so worried about the .exe files now. Today, I've done some research and one of the few programs I reinstalled - turbotax - loads c_dilla covertly. I'm hoping that were it came from and thats what the .exe files were from. I removed c_dilla, hidden process and all registry entries. (except for the LEGACY c_dilla entries - any guidance how to remove those would be appreciated.) Of course now turbotax may not work and I may have to put that junk back in until taxes are done).

Thanks for any insight and help.

rayik said:

Thanks su root for your reply.

I would appreciate if you could post instructions about taking ownership of the file. It would not allow me to access property.

Click to expand...

You need to be logged in as an administrator.
You find the file that you want to take ownership of, right click on it, and go into properties. Go into the security tab, and hit "Advanced". Then go into the ownership tab. There it'll list the current owner. Select who you want to own the file, and click OK. The ownership will have changed. Now you should be able to give yourself permission, so add yourself to the permission list by clicking add, selecting yourself, and then clicking full control checkbox.

I didn't know that recovery console trick. I do have the cd and will remember that for the future.

I did close Kazaa but nothing happened. I did double click on the .bmp file. Could that have launched something.

Click to expand...

Make sure you close kazaa in the system tray too. Clicking the "X" doesn't always close it, it just minimises it to your system tray (by the clock).

I did look in taskmanager but saw nothing out of the oridinary. Since then I've learned that processes can be hidden from task manager.

One thing that worries me, I reformated the hd. I just used the format option on the win2k install. Does that delete the partition that was there and make a new one? What exactly does it do and will it erase whatever was put there.

Click to expand...

If you are formatting the partition, it just deletes everything in the partition, and you have an empty partition. The partition table never changes, so other partitions will be uneffected.

(Also to make reinstalling easier - I put 39 GB worth of stuff onto a spare hd before re-formating. I'm hoping that 39GB was clean.

After reformating, reinstalling win2k and reinstalling some programs yesterday morning, I was horrified to see stuff on my computer last night.

I set up with 2 users (in addition to the default administrator). Those were the only listed users under "users and there was also listed as "users and passwords" in the contol panel.

However, explorereshowed me six (!!) user folders under "documents and settings." The additional ones were: "default user", "default user.winnt" and "All Users.WINNNT" Neither "default user" or "All Users" were listed as "users" under "users and passwords" in Control Panel.

I deleted "default user" and "default user.winnt" I was unable to delete All Users.WINNT" with win telling me it was a system folder and undeleteable.

Additionally, there were 2 .exe files under the 2 users I set up (not administrator). I did not write the file name down before deleting it, but with went something like DialUp or SpdDial. One of them would not let me delete it until I found a hidden process running (which turned out to be c_dilla)

Click to expand...

The stuff in the C:\Documents and Settings folder are profiles. In there you are supposed to have a profile for every user that has logged on (incl. his/her favories, history, address book, etc.). In addition, you have the "Default User". When a new user logs on for the first time, it copies he "Default User's" profile for the new user, so there is a profile for them. The "All Users" is used by everyone. The start menu, for example, has 2 types of entries, entries in:
C:\Documents and Settings\[USERNAME]\Start Menu
are for you only. Noone else will see them.
C:\Documents and Settings\All Users\Start Menu
is for the entire system, everyone will see these items in their start menu. The ones with .WINNT, or .COMPUTERNAME, or .DOMAINNAME exist because when it tried to make the folder, the folder already existed, so it made a new one with that suffix. It was probably not a good idea to delete them.

Here's an attempt at a fix: Go into Control panel/system/User Profiles. Select your profile & click "copy to" Then tell it "C:\Documents and Settings\Default User.WINNT" and give permissions to "Everyone". That should create a copy of your profile in the space where the default profile should be.

I was wondering if anything still remained on the hd after the reformat and reinstall.

I'm not so worried about the .exe files now. Today, I've done some research and one of the few programs I reinstalled - turbotax - loads c_dilla covertly. I'm hoping that were it came from and thats what the .exe files were from. I removed c_dilla, hidden process and all registry entries. (except for the LEGACY c_dilla entries - any guidance how to remove those would be appreciated.) Of course now turbotax may not work and I may have to put that junk back in until taxes are done).

Thanks for any insight and help.

Click to expand...

Nothing should remain, you can check out your C:\Program Files dir, it should be pretty empty if it's a clean install. Over time it usually gains alot of programs in there.

Thanks for your reply again su root.

You need to be logged in as an administrator.
You find the file that you want to take ownership of, right click on it, and go into properties. Go into the security tab, and hit "Advanced". Then go into the ownership tab. There it'll list the current owner. Select who you want to own the file, and click OK. The ownership will have changed. Now you should be able to give yourself permission, so add yourself to the permission list by clicking add, selecting yourself, and then clicking full control checkbox.

Click to expand...

I was logged on as administrator and it said "access denied" when I clicked on properties for the file.

I've found a pretty good trojan remover. It's Trojan Defense Suite 3. Their homepage is: http://tds.diamondcs.com.au/

I ran it on another machine. It found 3 spywares on it after Ad Aware (w/ the recent signature release) said it was clean. It also found 4 "data streams" where files were hidden and removed them. It comes free for 30 days. I'll run this latter on the problem machine.

The stuff in the C:\Documents and Settings folder are profiles. In there you are supposed to have a profile for every user that has logged on (incl. his/her favories, history, address book, etc.). In addition, you have the "Default User". When a new user logs on for the first time, it copies he "Default User's" profile for the new user, so there is a profile for them. The "All Users" is used by everyone. The start menu, for example, has 2 types of entries, entries in:
C:\Documents and Settings\[USERNAME]\Start Menu
are for you only. Noone else will see them.
C:\Documents and Settings\All Users\Start Menu
is for the entire system, everyone will see these items in their start menu. The ones with .WINNT, or .COMPUTERNAME, or .DOMAINNAME exist because when it tried to make the folder, the folder already existed, so it made a new one with that suffix. It was probably not a good idea to delete them.

Interesting. I've checked out 3 other win2k machines. All 3 had "All Users" folders and only 1 had "Default Users". Same win2k sp3 os. I note I had to shut down the "protected storage" process to delete the Default User folders.

I guess finding 2 .exes with names like spddial and c_dilla made me probably overreact. I know the .exes were related to c_dilla as I had to shut down c_dilla's process to delete one of the exe. c_dilla was installed by turbo tax.

Lastly,

If you are formatting the partition, it just deletes everything in the partition, and you have an empty partition. The partition table never changes, so other partitions will be uneffected.

The hd had only one partition. I reformated that partition w/ the win 2k installer. Thus, I am correct in assuming I completely wiped the drive and no files could remain?

no problem.

So when you right click on the file and goto properties, it tells you access denied and kicks you out? Or does it let you in? If it lets you in, then it's ok, it's usually just informing you that you have no authority to change permissions.

The "Default User" is a hidden folder, so that's probably why you couldn't see it on the other machines, you didn't have your view settings set to "view hidden files"

Yes, all the old files are gone.

So when you right click on the file and goto properties, it tells you access denied and kicks you out? Or does it let you in? If it lets you in, then it's ok, it's usually just informing you that you have no authority to change permissions.

Click to expand...

Denied access and kicked me out.

The "Default User" is a hidden folder, so that's probably why you couldn't see it on the other machines, you didn't have your view settings set to "view hidden files"

Click to expand...

Of course!

rayik said:

Denied access and kicked me out.

Click to expand...

That's weird. To get rid of it, I would suggest the Recovery Console method.

> put in your Windows CD, and boot off of it. When it asks whether you want to do an install or repair, choose repair.
> then it'll ask if you want automatic repair or recovery console. Choose Recovery console.
> then choose C: and log in as administrator.
> then find the file & delete it.
> then type exit.


What I recommend to everyone I know, (and all the computers I work on) is to install the recovery console, so you don't need the CD. You can do this by putting in the CD, and running:
D:\i386\WINNT32.EXE /cmdcons

Then every time you boot up, it'll ask you if you want to boot the OS, or the recovery console. I always shorten the menu time to 1 second (in Control Panel/System/Advanced/Startup & Recovery). I find it very convienient when windows won't boot.