Ghost files in the machine

[wiseloki]

Hi,

Minor but irritating issue. I have just completely removed Norton AV 2004 from my PC and moved to NOD32. As a part of the removal, after I'd used all the Symantec tools for NAV2004 & NAV2003, plus run Registry Mechanic and then manually deleted the folders Symantec left, I noticed that there was still an Nprotect folder in Recycler, even though I had previously turned the protected recycle bin off and then emptied it.

I got rid of the bulk of the contents left in Nprotect by deleting the various files in Explorer, with a view to then deleting the Nprotect folder. However, I still have three "ghost" files left in Nprotect that have 0 bytes size, no extension after the "." and which, when I hover over them with the mouse, Explorer recognises just as a "file". Their file names appear as: 00033147.; 00033150. and 00033181. (including the fullstop, but no extension). They were all created at 14:55 on 29/11/2005.

I have tried moving, deleting them and changing their attributes, and I get messages like "Error deleting file or folder: Cannot delete file: cannot read from the source file or disk".

I tried deleting them with Killbox, but it said that the files didn't appear to exist.

I was pointed at a Symantec site for manually emptying the recycle bin, where it said to reboot in safe mode, run "command" then do the following:

c:
cd\
cd recycler\nprotect
del *.*
cd ..
rd nprotect

I tried this in safe mode, but when it came to the delete files line, windows said

"c\recycler\nprotect\00033147. - The system cannot find the file specified"

It did this for each of the three "ghost" files.

When I then tried "rd nprotect" it said that the folder was not empty and refused.

I even tried the whole thing again, this time using the /s switch on the "rd" command, to delete the whole tree, but after the "are you sure?" when I typed "y" I got that "the system could not find the file...." error message for all three ghost files.

I checked that the Nprotect service was not running (I didn't expect it to be, as I have deleted all of Norton from my machine and don't intend to ever reinstall). It wasn't.

I even tried:

- opening the suspect files (no joy, system could not find them),

- creating a duplicate in notepad to see if I could overwrite them, then delete. I created a new file with the same name, but the original "ghost" was still there, even after I deleted my duplicate

- creating and renaming the duplicate file to be exactly the same name as the "ghost" by getting rid of the ".txt" extension to leave just the ".", but no joy there either - the system would not let me delete the extension and kept putting ".txt" back.

- renaming the "ghosts" (no joy, system could not find them)

- moving the "ghosts" (no joy, system could not find the files).

As they are in the Nprotect folder, I can only see them when I have unhidden protected operating system files & folders in the folder options.

These files and the Nprotect folder are not causing me any issues, it's just that I know that they shouldn't be there and I should be able to get rid of them.

I've never had a virus or any serious spyware, and a recent review of my HijackThis log on this forum eventually gave the machine a clean bill of health.

I'll be damned if I'm going to format my hard drive just to get rid of these three weird non-files and the Nprotect folder; I can't believe that there's not another way to fix this.

Anyone any bright ideas? C'mon, treat it as a challenge!

[mtbird]

Try this from a command prompt.....

rd /S "\\?\C:\recycler\nprotect"

[wiseloki]

Thanks mybird,

Tried that twice and each time got a message that said

Parameter format not correct - "S"\\?\C:\recycler\nprotect"".

Am I doing something wrong - I copied your script pretty well and put a space between the "rd" and the first "/", as your text appeared to have a space.

[mtbird]

Sorry, that's my bad. I should have told you where the spaces are.

There is a space after rd and a space after S.

rd /s "\\?\c:\recycler\nprotect"

[wiseloki]

Absolute bloody magic!

The Nprotect folder has gone from recycler, and I can only assume taken the "ghosts" with it.

Out of interest, what did I just do that made the machine (or windows) delete it, when all other efforts failed?

You guys at CybertechHelp are definitely the best.

[mtbird]

Some files are just buggers to try to delete. Since it's Norton, nothing really surprises me with them. It has to do with possible reserved names or invalid names in the Windows naming convention. You can override this by using that special syntax to delete the offending files.

[wiseloki]

Well thanks again, mtbird.

<continuous bowing> "we are not worthy"