1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Strange undeleteable folder

Discussion in 'Windows XP' started by Volks, Nov 12, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. Volks

    Volks Thread Starter

    Joined:
    Sep 12, 2010
    Messages:
    39
    Hi again all. Hope someone can help.
    I have a new file in C windows. No idea where it came from. The name of the folder is:
    $NtUninstallKB10051$. Have not done any xp updates since this folder showed up.
    It will not delete with any fashion that normally works to delete stubborn files or folders.
    What made me aware of this file is when I ran the defrag and saw that this folder contains two files that could not be defragmented, yet the folder says it's empty.
    First question, does anyone know what this folder is ?
    Then, any idea how to delete this file folder ?
    Have tried Killbox, Unlocker,dos and check disk.
    Always the same message...cannot delete file: the directory is not empty
     
  2. SUEOHIO

    SUEOHIO

    Joined:
    Jan 30, 2007
    Messages:
    3,754
    First Name:
    SUE
    If im understanding this correctly is it in your local disk C:windows file? If it is its part of the xp operating system and shouldnt be deleted but if im wrong someone will be by to correct me and with a better solution.
     
  3. Volks

    Volks Thread Starter

    Joined:
    Sep 12, 2010
    Messages:
    39
    Since it just showed up very recently, without me doing any updates, I don't think it's part of the windows xp operating system. There is no listing of this in the add and remove list.
    The only thing I can add that might help is this showed up after a friend used my computer recently and managed to infect my pc with a virus that has been completely removed since.
     
  4. SUEOHIO

    SUEOHIO

    Joined:
    Jan 30, 2007
    Messages:
    3,754
    First Name:
    SUE
    Well you can try the free version of revo uninstaller and see if it gets rid of it.
     
  5. Volks

    Volks Thread Starter

    Joined:
    Sep 12, 2010
    Messages:
    39
    Revo can't delete it.
     
  6. Frank4d

    Frank4d Retired Trusted Advisor

    Joined:
    Sep 10, 2006
    Messages:
    9,126
    I would check the folder name again, because all Microsoft KB numbers I know of have six digits after KB; if it has five then Windows update didn't put it there. You can right click on the folder and verify Read Only isn't checked, then the Security tab to see if the Administrators and Users groups have full control, no boxes are checked in the Deny column, and there are no Special permissions.
     
  7. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    If you find that the number refers to an update that was installed, you can delete it safely only after you are sure that you never want to remove the update. After it is gone, the update is permanent.

    One question does come to mind, however. Why would you go into the Windows folder and try to delete something when you didn't know what it was? That's a good way to break Windows.
     
  8. Volks

    Volks Thread Starter

    Joined:
    Sep 12, 2010
    Messages:
    39
    Gentlemen, the file name is correct and it is NOT a windows update.
    I suspect a virus infection may have created it, even though the system is clean now other than this folder.
    I have googled the file name to death and am unable to find ANY reference to it. What is interesting, is that the windows defrag is able to list the files inside, which are as follows:
    1167811288\U\[email protected]
    1167811288\U\[email protected]
     
  9. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    Win32:Malware-gen creates folders like that, but usually in a different place.

    Using a file unlocker may get rid of it, but you have to watch that it doesn't come back. Scan with at least 2 different scanners (even though they miss the majority of viruses, some say 80%, if you have heuristics turned on, anything bad should be picked up. With nearly 1000 new pieces of malware released onto the internet every hour, it would be impossible for anti-vrus to even begin to have signatures for them all.). I'd suggest Malwarebytes for one. Or you could go to our Malware forum for help making sure you are clean.

    UnlockIt
    FreeFile
    Emco Move On Boot
    Unlocker
    Advanced File Remover

    You might want to check with OpenedFilesView to see if any process has handles to that folder. That may point to the source (though rootkits would have invisible files and registry entries, of course).
     
  10. helpful

    helpful

    Joined:
    Sep 17, 2009
    Messages:
    697
    Sounds like your infected. Your issue is similar to rhe post in http://community.norton.com/t5/Nort...ty-2-threat-pop-ups-but-not-found/td-p/540984.

    I would suggest moving your thread to malware removal. I am no malware expert but multiple websites suggest your pc is infected with "ZeroAccess rootkit" which is a

    "Max++, is a nasty piece of malware which is designed to start its persistent campaign just after infiltration. The infiltration of this malware is quite simple and done through security holes together with infected downloads, often Adobe Reader or Java fake updates. It can be said that additional purpose of ZeroAccess rootkit is to set up a stealthy, undetectable and un-removable platform which should help to download malware into the target PC. As you can see, itÂ’s a rootkit which is advanced and sophisticated."

    http://www.2-viruses.com/remove-zeroaccess-rootkit

    Best to leave to the experts. Do not follow any advice execpt one with a shield icon.
     
  11. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    The folders could actually already have been locked by your antivirus. Many versions, including Avast, will lock files so that nothing, especially not the system, can access them so that they can cause harm. If they don't delete on boot using one of those unlockers, that may be the reason, or they are being re-created. Check time-stamps if that happens.
     
  12. Volks

    Volks Thread Starter

    Joined:
    Sep 12, 2010
    Messages:
    39
    First, thanks for all the input and suggestion. Tried all suggestions and programs. Nothing will delete that file.
    Ran Tdds Killer after the infection and it did find an infection and removed it. Everything seems fine now other than being unable to delete or remove that file.
    My computer tech guy that I normally use as a last resort was only able to relocate the file to another place.
    Maybe I have to reformat if it bugs me enough.
     
  13. raybro

    raybro

    Joined:
    Apr 26, 2003
    Messages:
    5,836
    Have you tried deleting the folder in Safe Mode?
     
  14. DoubleHelix

    DoubleHelix Banned

    Joined:
    Dec 9, 2004
    Messages:
    24,388
    Where did he "relocate it" to? If it can be moved to another folder or drive, it can be moved to the recycle bin.
     
  15. Volks

    Volks Thread Starter

    Joined:
    Sep 12, 2010
    Messages:
    39
    Tried safe mode, no luck.
    Regarding moving the folder, he somehow manged to move to new folder C:
    Won't move from there either. Will go back to my tech guy tomorrow and see if he can indeed move it to the recycle bin.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1026636

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice