Vista - Corrupt File in Recycle Bin... can't delete

If you have a Vista installation DVD, perhaps try booting from that. Then
use the "Repair your computer" > "System Recovery
Options" > "Command Prompt" on the DVD to delete the file. (Type c: at the
prompt to change drives, if C is where Vista is installed). You may also
want to run chkdsk /f from there, and check the drive vista is installed on.
See this as to how to get there:

http://www.bleepingcomputer.com/tuto...torial147.html

"Berns" <Berns@discussions.microsoft.com> wrote in message
news:07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com...
> The name of the file is something like: $RTDJFDG.QBW (Quickbooks file).
>
> I haven't tried copying the file to another location. I was worried that
> if
> I copied it to another location, then I would have more than one corrupt
> file
> on the system taking up more than 85MB. I can give it a shot, but I'm not
> sure if that's a route I'd like to go. However, at this point, I'm game.
>
> I've also read on another site about deleting the recycle bin all together
> and Windows will automatically create a new one??? I have not given that
> a
> try yet only because I'm not sure about Vista creating a new $recycle.bin
> if
> it can't find one. Can anyone give insite on that?
>
> Thank you again...
>
> Bernie
>
> ""Darrell Gorter[MSFT]"" wrote:
>
>> Hello,
>> What is the filename in question?
>> Can you copy it to another location?
>> Thanks,
>> Darrell Gorter[MSFT]
>>
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights
>> --------------------
>> |> Thread-Topic: Corrupt File in Recycle Bin... can't delete
>> |> thread-index: AcfOGoBZGPzgrUuxTzyhl8rtGXRR/Q==
>> |> X-WBNR-Posting-Host: 207.46.193.207
>> |> From: =?Utf-8?B?QmVybnM=?= <Berns@discussions.microsoft.com>
>> |> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
>> <sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
>> <99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
>> <E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
>> <8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
>> <OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
>> |> Subject: Re: Corrupt File in Recycle Bin... can't delete
>> |> Date: Tue, 24 Jul 2007 10:46:02 -0700
>> |> Lines: 163
>> |> Message-ID: <95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
>> |> MIME-Version: 1.0
>> |> Content-Type: text/plain;
>> |> charset="Utf-8"
>> |> Content-Transfer-Encoding: 7bit
>> |> X-Newsreader: Microsoft CDO for Windows 2000
>> |> Content-Class: urn:content-classes:message
>> |> Importance: normal
>> |> Priority: normal
>> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
>> |> Newsgroups: microsoft.public.windows.vista.general
>> |> Path: TK2MSFTNGHUB02.phx.gbl
>> |> Xref: TK2MSFTNGHUB02.phx.gbl
>> microsoft.public.windows.vista.general:141249
>> |> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
>> |> X-Tomcat-NG: microsoft.public.windows.vista.general
>> |>
>> |> dean-dean,
>> |>
>> |> Thank you, I tried both of these and they were successful in their
>> actions,
>> |> however, I still am unable to delete the files. I did find out
>> something
>> |> interesting though. I am able to Rename the file (REN). Even after
>> the
>> |> rename, I am not able to delete. It says "access denied". More
>> thoughts?
>> |>
>> |> Bernie
>> |>
>> |> "dean-dean" wrote:
>> |>
>> |> > You could try this, dunno. Using your filelist.txt, identify the
>> path
>> of
>> |> > the problem file, for example:
>> |> >
>> |> > C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
>> |> >
>> |> > At an elevated command prompt, type (or line it all up in Notepad,
>> and
>> Copy
>> |> > and Paste) the following command, and then press ENTER (note, here,
>> that *
>> |> > and ? aren't supported):
>> |> >
>> |> > takeown /f Path_And_File_Name
>> |> >
>> |> > For example, type:
>> |> > takeown /f C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
>> |> >
>> |> > Type the following command, and then press ENTER to grant
>> |> > administrators full access to the file:
>> |> >
>> |> > icacls Path_And_File_Name /GRANT ADMINISTRATORS:F
>> |> >
>> |> > For example, type:
>> |> > icacls C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab /grant
>> administrators:F
>> |> >
>> |> > Then try Darrell's commands again.
>> |> >
>> |> >
>> |> > "Berns" <Berns@discussions.microsoft.com> wrote in message
>> |> > news:8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com...
>> |> > > Yes, I made sure to right-click and run as administrator. I
>> should
>> have
>> |> > > said
>> |> > > that too in my response. Sorry about that.
>> |> > >
>> |> > > Thank you again for your help!
>> |> > >
>> |> > > Bernie
>> |> > >
>> |> > > "dean-dean" wrote:
>> |> > >
>> |> > >> Did you right-click on Command Prompt, and choose Run as
>> Administrator
>> |> > >> (even
>> |> > >> though your logged into an administrative account)?
>> |> > >>
>> |> > >> "Berns" <Berns@discussions.microsoft.com> wrote in message
>> |> > >> news:99102844-673B-4359-B42B-A1C469D3529E@microsoft.com...
>> |> > >> > Thank you for both of your help. However, I still am unable to
>> delete
>> |> > >> > the
>> |> > >> > file. Fortunately, I can now see the file in the $recycle.bin.
>> |> > >> > However,
>> |> > >> > I
>> |> > >> > can not delete it. I've tried different administrator logins,
>> but it
>> |> > >> > still
>> |> > >> > says access denied. I've done the following commands to try
>> and
>> delete
>> |> > >> > it:
>> |> > >> >
>> |> > >> > del *.*
>> |> > >> > del *.qbw
>> |> > >> > del *rtdjfdg.qbw
>> |> > >> > del $rtdjfdg.*
>> |> > >> > del ?rtdjfdg.qbw
>> |> > >> >
>> |> > >> > I have not tried to delete the folder that it sits in though.
>> I
>> have a
>> |> > >> > feeling that it will tell me that there is a file in that
>> folder
>> that I
>> |> > >> > can
>> |> > >> > not delete. Thoughts?
>> |> > >> >
>> |> > >> > Thank you again for your time and efforts in helping me out.
>> |> > >> >
>> |> > >> > Take care,
>> |> > >> >
>> |> > >> > Bernie
>> |> > >> >
>> |> > >> > ""Darrell Gorter[MSFT]"" wrote:
>> |> > >> >
>> |> > >> >> Hello,
>> |> > >> >> Open an elevated CMD prompt.
>> |> > >> >> First run chkdsk on the volume to check for file corruption.
>> |> > >> >> if that doesn't help then try.
>> |> > >> >> from the root of the C drive.
>> |> > >> >> cd $recycle.bin
>> |> > >> >> now do a dir /a /s >c:\filelist.txt
>> |> > >> >> use notepad to open filelist.txt
>> |> > >> >> Look for files or folders with non-alphanumeric characters in
>> them.
>> |> > >> >> try manually deleting those files or folders using wild cards
>> (*
>> or ?
>> |> > >> >> for
>> |> > >> >> example)
>> |> > >> >> For a file like D&lete.me you could try using del D?lete.me to
>> attempt
>> |> > >> >> to
>> |> > >> >> delete the file
>> |> > >> >> The question mark replaces the single character that may be
>> causing
>> |> > >> >> the
>> |> > >> >> isuse
>> |> > >> >>
>> |> > >> >> Thanks,
>> |> > >> >> Darrell Gorter[MSFT]
>> |> > >> >>
>> |> > >> >> This posting is provided "AS IS" with no warranties, and
>> confers
>> no
>> |> > >> >> rights
>> |> > >> >> --------------------
>> |> > >> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't delete
>> |> > >> >> |> thread-index: AcfLCEgZddd5Zq5tQzK3i+JJYQGPdQ==
>> |> > >> >> |> X-WBNR-Posting-Host: 207.46.192.207
>> |> > >> >> |> From: =?Utf-8?B?QmVybnM=?=
>> <Berns@discussions.microsoft.com>
>> |> > >> >> |> Subject: Corrupt File in Recycle Bin... can't delete
>> |> > >> >> |> Date: Fri, 20 Jul 2007 12:58:03 -0700
>> |> > >> >> |> Lines: 13
>> |> > >> >> |> Message-ID:
>> <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
>> |> > >> >> |> MIME-Version: 1.0
>> |> > >> >> |> Content-Type: text/plain;
>> |> > >> >> |> charset="Utf-8"
>> |> > >> >> |> Content-Transfer-Encoding: 7bit
>> |> > >> >> |> X-Newsreader: Microsoft CDO for Windows 2000
>> |> > >> >> |> Content-Class: urn:content-classes:message
>> |> > >> >> |> Importance: normal
>> |> > >> >> |> Priority: normal
>> |> > >> >> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
>> |> > >> >> |> Newsgroups: microsoft.public.windows.vista.general
>> |> > >> >> |> Path: TK2MSFTNGHUB02.phx.gbl
>> |> > >> >> |> Xref: TK2MSFTNGHUB02.phx.gbl
>> |> > >> >> microsoft.public.windows.vista.general:138891
>> |> > >> >> |> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
>> |> > >> >> |> X-Tomcat-NG: microsoft.public.windows.vista.general
>> |> > >> >> |>
>> |> > >> >> |> Every time I start up the computer, I get an error message
>> that
>> |> > >> >> says
>> |> > >> >> there
>> |> > >> >> |> was a corrupt file in the Recycle Bin would you like to
>> delete it?
>> |> > >> >> I
>> |> > >> >> say yes
>> |> > >> >> |> and it says that it can't be deleted and asks if I would
>> like
>> to
>> |> > >> >> retry
>> |> > >> >> or
>> |> > >> >> |> cancel. If you hit retry it just circles back to the same
>> question
>> |> > >> >> of
>> |> > >> >> |> wanting to retry or cancel. If you hit cancel, then the
>> issue goes
>> |> > >> >> away,
>> |> > >> >> |> until you try to empty your Recycle Bin. Also something
>> that
>> is
>> |> > >> >> strange; if
>> |> > >> >> |> you open the Recycle Bin or look at the icon on the
>> desktop,
>> you'll
>> |> > >> >> notice
>> |> > >> >> |> that it's empty.
>> |> > >> >> |>
>> |> > >> >> |> I've checked the settings and have restored to the default
>> |> > >> >> settings.
>> |> > >> >> Any
>> |> > >> >> |> ideas???
>> |> > >> >> |>
>> |> > >> >> |> Thank you for your time!
>> |> > >> >> |>
>> |> > >> >>
>> |> > >> >>
>> |> > >>
>> |> >
>> |> >
>> |>
>>
>>

Hello,
Let's check the permissions on the file.
Run icacls $RTDJFDG.QBW

This should display the ACLS on file. There could be a specific ACL
causing this error message.
If you don't have ownership you could see this, or if there is a specific
deny ACL applied you could get this error.
post back the output.

Also are there any Quickbook processes running that may be holding onto the
file?

From the elevated CMD prompt run tasklist /svc and look for any processes
that Quickbooks may have running.

Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
|> From: "dean-dean" <dean-dean@discussions.microsoft.com>
|> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
<sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
<99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
<E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
<8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
<OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
<95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
<bLafeyizHHA.5848@TK2MSFTNGHUB02.phx.gbl>
<07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
|> In-Reply-To: <07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
|> Subject: Re: Corrupt File in Recycle Bin... can't delete
|> Date: Tue, 24 Jul 2007 16:31:09 -0500
|> Lines: 279
|> Message-ID: <75897703-225A-4A87-86B7-E02052AA42E0@microsoft.com>
|> MIME-Version: 1.0
|> Content-Type: text/plain;
|> format=flowed;
|> charset="Utf-8";
|> reply-type=original
|> Content-Transfer-Encoding: 7bit
|> X-Priority: 3
|> X-MSMail-Priority: Normal
|> X-Newsreader: Microsoft Windows Mail 6.0.6000.16480
|> X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16480
|> X-MS-CommunityGroup-PostID: {75897703-225A-4A87-86B7-E02052AA42E0}
|> X-MS-CommunityGroup-ThreadID: 83E1936A-CD59-4026-A732-2B6AF3DC56BC
|> X-MS-CommunityGroup-ParentID: 07658F52-573A-45A7-8A0F-8C6975CB4C2E
|> Newsgroups: microsoft.public.windows.vista.general
|> Path: TK2MSFTNGHUB02.phx.gbl
|> Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.general:141405
|> NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
|> X-Tomcat-NG: microsoft.public.windows.vista.general
|>
|> If you have a Vista installation DVD, perhaps try booting from that.
Then
|> use the "Repair your computer" > "System Recovery
|> Options" > "Command Prompt" on the DVD to delete the file. (Type c: at
the
|> prompt to change drives, if C is where Vista is installed). You may
also
|> want to run chkdsk /f from there, and check the drive vista is installed
on.
|> See this as to how to get there:
|>
|> http://www.bleepingcomputer.com/tuto...torial147.html
|>
|> "Berns" <Berns@discussions.microsoft.com> wrote in message
|> news:07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com...
|> > The name of the file is something like: $RTDJFDG.QBW (Quickbooks
file).
|> >
|> > I haven't tried copying the file to another location. I was worried
that
|> > if
|> > I copied it to another location, then I would have more than one
corrupt
|> > file
|> > on the system taking up more than 85MB. I can give it a shot, but I'm
not
|> > sure if that's a route I'd like to go. However, at this point, I'm
game.
|> >
|> > I've also read on another site about deleting the recycle bin all
together
|> > and Windows will automatically create a new one??? I have not given
that
|> > a
|> > try yet only because I'm not sure about Vista creating a new
$recycle.bin
|> > if
|> > it can't find one. Can anyone give insite on that?
|> >
|> > Thank you again...
|> >
|> > Bernie
|> >
|> > ""Darrell Gorter[MSFT]"" wrote:
|> >
|> >> Hello,
|> >> What is the filename in question?
|> >> Can you copy it to another location?
|> >> Thanks,
|> >> Darrell Gorter[MSFT]
|> >>
|> >> This posting is provided "AS IS" with no warranties, and confers no
|> >> rights
|> >> --------------------
|> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't delete
|> >> |> thread-index: AcfOGoBZGPzgrUuxTzyhl8rtGXRR/Q==
|> >> |> X-WBNR-Posting-Host: 207.46.193.207
|> >> |> From: =?Utf-8?B?QmVybnM=?= <Berns@discussions.microsoft.com>
|> >> |> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
|> >> <sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
|> >> <99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
|> >> <E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
|> >> <8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
|> >> <OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
|> >> |> Subject: Re: Corrupt File in Recycle Bin... can't delete
|> >> |> Date: Tue, 24 Jul 2007 10:46:02 -0700
|> >> |> Lines: 163
|> >> |> Message-ID: <95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
|> >> |> MIME-Version: 1.0
|> >> |> Content-Type: text/plain;
|> >> |> charset="Utf-8"
|> >> |> Content-Transfer-Encoding: 7bit
|> >> |> X-Newsreader: Microsoft CDO for Windows 2000
|> >> |> Content-Class: urn:content-classes:message
|> >> |> Importance: normal
|> >> |> Priority: normal
|> >> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
|> >> |> Newsgroups: microsoft.public.windows.vista.general
|> >> |> Path: TK2MSFTNGHUB02.phx.gbl
|> >> |> Xref: TK2MSFTNGHUB02.phx.gbl
|> >> microsoft.public.windows.vista.general:141249
|> >> |> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
|> >> |> X-Tomcat-NG: microsoft.public.windows.vista.general
|> >> |>
|> >> |> dean-dean,
|> >> |>
|> >> |> Thank you, I tried both of these and they were successful in their
|> >> actions,
|> >> |> however, I still am unable to delete the files. I did find out
|> >> something
|> >> |> interesting though. I am able to Rename the file (REN). Even
after
|> >> the
|> >> |> rename, I am not able to delete. It says "access denied". More
|> >> thoughts?
|> >> |>
|> >> |> Bernie
|> >> |>
|> >> |> "dean-dean" wrote:
|> >> |>
|> >> |> > You could try this, dunno. Using your filelist.txt, identify
the
|> >> path
|> >> of
|> >> |> > the problem file, for example:
|> >> |> >
|> >> |> > C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
|> >> |> >
|> >> |> > At an elevated command prompt, type (or line it all up in
Notepad,
|> >> and
|> >> Copy
|> >> |> > and Paste) the following command, and then press ENTER (note,
here,
|> >> that *
|> >> |> > and ? aren't supported):
|> >> |> >
|> >> |> > takeown /f Path_And_File_Name
|> >> |> >
|> >> |> > For example, type:
|> >> |> > takeown /f C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
|> >> |> >
|> >> |> > Type the following command, and then press ENTER to grant
|> >> |> > administrators full access to the file:
|> >> |> >
|> >> |> > icacls Path_And_File_Name /GRANT ADMINISTRATORS:F
|> >> |> >
|> >> |> > For example, type:
|> >> |> > icacls C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab /grant
|> >> administrators:F
|> >> |> >
|> >> |> > Then try Darrell's commands again.
|> >> |> >
|> >> |> >
|> >> |> > "Berns" <Berns@discussions.microsoft.com> wrote in message
|> >> |> > news:8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com...
|> >> |> > > Yes, I made sure to right-click and run as administrator. I
|> >> should
|> >> have
|> >> |> > > said
|> >> |> > > that too in my response. Sorry about that.
|> >> |> > >
|> >> |> > > Thank you again for your help!
|> >> |> > >
|> >> |> > > Bernie
|> >> |> > >
|> >> |> > > "dean-dean" wrote:
|> >> |> > >
|> >> |> > >> Did you right-click on Command Prompt, and choose Run as
|> >> Administrator
|> >> |> > >> (even
|> >> |> > >> though your logged into an administrative account)?
|> >> |> > >>
|> >> |> > >> "Berns" <Berns@discussions.microsoft.com> wrote in message
|> >> |> > >> news:99102844-673B-4359-B42B-A1C469D3529E@microsoft.com...
|> >> |> > >> > Thank you for both of your help. However, I still am
unable to
|> >> delete
|> >> |> > >> > the
|> >> |> > >> > file. Fortunately, I can now see the file in the
$recycle.bin.
|> >> |> > >> > However,
|> >> |> > >> > I
|> >> |> > >> > can not delete it. I've tried different administrator
logins,
|> >> but it
|> >> |> > >> > still
|> >> |> > >> > says access denied. I've done the following commands to
try
|> >> and
|> >> delete
|> >> |> > >> > it:
|> >> |> > >> >
|> >> |> > >> > del *.*
|> >> |> > >> > del *.qbw
|> >> |> > >> > del *rtdjfdg.qbw
|> >> |> > >> > del $rtdjfdg.*
|> >> |> > >> > del ?rtdjfdg.qbw
|> >> |> > >> >
|> >> |> > >> > I have not tried to delete the folder that it sits in
though.
|> >> I
|> >> have a
|> >> |> > >> > feeling that it will tell me that there is a file in that
|> >> folder
|> >> that I
|> >> |> > >> > can
|> >> |> > >> > not delete. Thoughts?
|> >> |> > >> >
|> >> |> > >> > Thank you again for your time and efforts in helping me out.
|> >> |> > >> >
|> >> |> > >> > Take care,
|> >> |> > >> >
|> >> |> > >> > Bernie
|> >> |> > >> >
|> >> |> > >> > ""Darrell Gorter[MSFT]"" wrote:
|> >> |> > >> >
|> >> |> > >> >> Hello,
|> >> |> > >> >> Open an elevated CMD prompt.
|> >> |> > >> >> First run chkdsk on the volume to check for file
corruption.
|> >> |> > >> >> if that doesn't help then try.
|> >> |> > >> >> from the root of the C drive.
|> >> |> > >> >> cd $recycle.bin
|> >> |> > >> >> now do a dir /a /s >c:\filelist.txt
|> >> |> > >> >> use notepad to open filelist.txt
|> >> |> > >> >> Look for files or folders with non-alphanumeric characters
in
|> >> them.
|> >> |> > >> >> try manually deleting those files or folders using wild
cards
|> >> (*
|> >> or ?
|> >> |> > >> >> for
|> >> |> > >> >> example)
|> >> |> > >> >> For a file like D&lete.me you could try using del
D?lete.me to
|> >> attempt
|> >> |> > >> >> to
|> >> |> > >> >> delete the file
|> >> |> > >> >> The question mark replaces the single character that may be
|> >> causing
|> >> |> > >> >> the
|> >> |> > >> >> isuse
|> >> |> > >> >>
|> >> |> > >> >> Thanks,
|> >> |> > >> >> Darrell Gorter[MSFT]
|> >> |> > >> >>
|> >> |> > >> >> This posting is provided "AS IS" with no warranties, and
|> >> confers
|> >> no
|> >> |> > >> >> rights
|> >> |> > >> >> --------------------
|> >> |> > >> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't
delete
|> >> |> > >> >> |> thread-index: AcfLCEgZddd5Zq5tQzK3i+JJYQGPdQ==
|> >> |> > >> >> |> X-WBNR-Posting-Host: 207.46.192.207
|> >> |> > >> >> |> From: =?Utf-8?B?QmVybnM=?=
|> >> <Berns@discussions.microsoft.com>
|> >> |> > >> >> |> Subject: Corrupt File in Recycle Bin... can't delete
|> >> |> > >> >> |> Date: Fri, 20 Jul 2007 12:58:03 -0700
|> >> |> > >> >> |> Lines: 13
|> >> |> > >> >> |> Message-ID:
|> >> <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
|> >> |> > >> >> |> MIME-Version: 1.0
|> >> |> > >> >> |> Content-Type: text/plain;
|> >> |> > >> >> |> charset="Utf-8"
|> >> |> > >> >> |> Content-Transfer-Encoding: 7bit
|> >> |> > >> >> |> X-Newsreader: Microsoft CDO for Windows 2000
|> >> |> > >> >> |> Content-Class: urn:content-classes:message
|> >> |> > >> >> |> Importance: normal
|> >> |> > >> >> |> Priority: normal
|> >> |> > >> >> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
|> >> |> > >> >> |> Newsgroups: microsoft.public.windows.vista.general
|> >> |> > >> >> |> Path: TK2MSFTNGHUB02.phx.gbl
|> >> |> > >> >> |> Xref: TK2MSFTNGHUB02.phx.gbl
|> >> |> > >> >> microsoft.public.windows.vista.general:138891
|> >> |> > >> >> |> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
|> >> |> > >> >> |> X-Tomcat-NG: microsoft.public.windows.vista.general
|> >> |> > >> >> |>
|> >> |> > >> >> |> Every time I start up the computer, I get an error
message
|> >> that
|> >> |> > >> >> says
|> >> |> > >> >> there
|> >> |> > >> >> |> was a corrupt file in the Recycle Bin would you like to
|> >> delete it?
|> >> |> > >> >> I
|> >> |> > >> >> say yes
|> >> |> > >> >> |> and it says that it can't be deleted and asks if I
would
|> >> like
|> >> to
|> >> |> > >> >> retry
|> >> |> > >> >> or
|> >> |> > >> >> |> cancel. If you hit retry it just circles back to the
same
|> >> question
|> >> |> > >> >> of
|> >> |> > >> >> |> wanting to retry or cancel. If you hit cancel, then the
|> >> issue goes
|> >> |> > >> >> away,
|> >> |> > >> >> |> until you try to empty your Recycle Bin. Also
something
|> >> that
|> >> is
|> >> |> > >> >> strange; if
|> >> |> > >> >> |> you open the Recycle Bin or look at the icon on the
|> >> desktop,
|> >> you'll
|> >> |> > >> >> notice
|> >> |> > >> >> |> that it's empty.
|> >> |> > >> >> |>
|> >> |> > >> >> |> I've checked the settings and have restored to the
default
|> >> |> > >> >> settings.
|> >> |> > >> >> Any
|> >> |> > >> >> |> ideas???
|> >> |> > >> >> |>
|> >> |> > >> >> |> Thank you for your time!
|> >> |> > >> >> |>
|> >> |> > >> >>
|> >> |> > >> >>
|> >> |> > >>
|> >> |> >
|> >> |> >
|> >> |>
|> >>
|> >>
|>
|>

Darrell, dean-dean and others,

Thanks again for the input. I did run the icacls $RTDJFDG.QBW and this is
what I got. (Note: I put in DOMAIN in place of our company domain. I don't
think that it's relevant that everyone knows our domain name. I also did the
same for “username� and “username� is the administrator of the machine.)

BUILTIN\Administrators: (F)
DOMAIN\QBDataServiceUser17: (RX,W)
DOMAIN\QBDataServiceUser17: (I,RX,W)
BUILTIN\Administrators: (I)(F)
NT AUTHORITY\SYSTEM: (I)(F)
DOMAIN\username: (I)(F)
Mandatory Label \ High Mandatory Level: (I)(NW)
Successfully processed 1 files; Failed processing 0 files

I also checked the tasklist /svc and ended the processes that were related
to Quickbooks with no success.

I have yet to run a chkdsk /f (I just wanted to give you an update of what
I’ve done so far.)

I hope that this helps out. Thank you again for all of your efforts. Take
care and good luck.

Bernie

""Darrell Gorter[MSFT]"" wrote:

> Hello,
> Let's check the permissions on the file.
> Run icacls $RTDJFDG.QBW
>
> This should display the ACLS on file. There could be a specific ACL
> causing this error message.
> If you don't have ownership you could see this, or if there is a specific
> deny ACL applied you could get this error.
> post back the output.
>
> Also are there any Quickbook processes running that may be holding onto the
> file?
>
> From the elevated CMD prompt run tasklist /svc and look for any processes
> that Quickbooks may have running.
>
> Thanks,
> Darrell Gorter[MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no rights
> --------------------
> |> From: "dean-dean" <dean-dean@discussions.microsoft.com>
> |> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
> <sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
> <99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
> <E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
> <8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
> <OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
> <95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
> <bLafeyizHHA.5848@TK2MSFTNGHUB02.phx.gbl>
> <07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
> |> In-Reply-To: <07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
> |> Subject: Re: Corrupt File in Recycle Bin... can't delete
> |> Date: Tue, 24 Jul 2007 16:31:09 -0500
> |> Lines: 279
> |> Message-ID: <75897703-225A-4A87-86B7-E02052AA42E0@microsoft.com>
> |> MIME-Version: 1.0
> |> Content-Type: text/plain;
> |> format=flowed;
> |> charset="Utf-8";
> |> reply-type=original
> |> Content-Transfer-Encoding: 7bit
> |> X-Priority: 3
> |> X-MSMail-Priority: Normal
> |> X-Newsreader: Microsoft Windows Mail 6.0.6000.16480
> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16480
> |> X-MS-CommunityGroup-PostID: {75897703-225A-4A87-86B7-E02052AA42E0}
> |> X-MS-CommunityGroup-ThreadID: 83E1936A-CD59-4026-A732-2B6AF3DC56BC
> |> X-MS-CommunityGroup-ParentID: 07658F52-573A-45A7-8A0F-8C6975CB4C2E
> |> Newsgroups: microsoft.public.windows.vista.general
> |> Path: TK2MSFTNGHUB02.phx.gbl
> |> Xref: TK2MSFTNGHUB02.phx.gbl
> microsoft.public.windows.vista.general:141405
> |> NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
> |> X-Tomcat-NG: microsoft.public.windows.vista.general
> |>
> |> If you have a Vista installation DVD, perhaps try booting from that.
> Then
> |> use the "Repair your computer" > "System Recovery
> |> Options" > "Command Prompt" on the DVD to delete the file. (Type c: at
> the
> |> prompt to change drives, if C is where Vista is installed). You may
> also
> |> want to run chkdsk /f from there, and check the drive vista is installed
> on.
> |> See this as to how to get there:
> |>
> |> http://www.bleepingcomputer.com/tuto...torial147.html
> |>
> |> "Berns" <Berns@discussions.microsoft.com> wrote in message
> |> news:07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com...
> |> > The name of the file is something like: $RTDJFDG.QBW (Quickbooks
> file).
> |> >
> |> > I haven't tried copying the file to another location. I was worried
> that
> |> > if
> |> > I copied it to another location, then I would have more than one
> corrupt
> |> > file
> |> > on the system taking up more than 85MB. I can give it a shot, but I'm
> not
> |> > sure if that's a route I'd like to go. However, at this point, I'm
> game.
> |> >
> |> > I've also read on another site about deleting the recycle bin all
> together
> |> > and Windows will automatically create a new one??? I have not given
> that
> |> > a
> |> > try yet only because I'm not sure about Vista creating a new
> $recycle.bin
> |> > if
> |> > it can't find one. Can anyone give insite on that?
> |> >
> |> > Thank you again...
> |> >
> |> > Bernie
> |> >
> |> > ""Darrell Gorter[MSFT]"" wrote:
> |> >
> |> >> Hello,
> |> >> What is the filename in question?
> |> >> Can you copy it to another location?
> |> >> Thanks,
> |> >> Darrell Gorter[MSFT]
> |> >>
> |> >> This posting is provided "AS IS" with no warranties, and confers no
> |> >> rights
> |> >> --------------------
> |> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't delete
> |> >> |> thread-index: AcfOGoBZGPzgrUuxTzyhl8rtGXRR/Q==
> |> >> |> X-WBNR-Posting-Host: 207.46.193.207
> |> >> |> From: =?Utf-8?B?QmVybnM=?= <Berns@discussions.microsoft.com>
> |> >> |> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
> |> >> <sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
> |> >> <99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
> |> >> <E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
> |> >> <8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
> |> >> <OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
> |> >> |> Subject: Re: Corrupt File in Recycle Bin... can't delete
> |> >> |> Date: Tue, 24 Jul 2007 10:46:02 -0700
> |> >> |> Lines: 163
> |> >> |> Message-ID: <95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
> |> >> |> MIME-Version: 1.0
> |> >> |> Content-Type: text/plain;
> |> >> |> charset="Utf-8"
> |> >> |> Content-Transfer-Encoding: 7bit
> |> >> |> X-Newsreader: Microsoft CDO for Windows 2000
> |> >> |> Content-Class: urn:content-classes:message
> |> >> |> Importance: normal
> |> >> |> Priority: normal
> |> >> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
> |> >> |> Newsgroups: microsoft.public.windows.vista.general
> |> >> |> Path: TK2MSFTNGHUB02.phx.gbl
> |> >> |> Xref: TK2MSFTNGHUB02.phx.gbl
> |> >> microsoft.public.windows.vista.general:141249
> |> >> |> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
> |> >> |> X-Tomcat-NG: microsoft.public.windows.vista.general
> |> >> |>
> |> >> |> dean-dean,
> |> >> |>
> |> >> |> Thank you, I tried both of these and they were successful in their
> |> >> actions,
> |> >> |> however, I still am unable to delete the files. I did find out
> |> >> something
> |> >> |> interesting though. I am able to Rename the file (REN). Even
> after
> |> >> the
> |> >> |> rename, I am not able to delete. It says "access denied". More
> |> >> thoughts?
> |> >> |>
> |> >> |> Bernie
> |> >> |>
> |> >> |> "dean-dean" wrote:
> |> >> |>
> |> >> |> > You could try this, dunno. Using your filelist.txt, identify
> the
> |> >> path
> |> >> of
> |> >> |> > the problem file, for example:
> |> >> |> >
> |> >> |> > C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
> |> >> |> >
> |> >> |> > At an elevated command prompt, type (or line it all up in
> Notepad,
> |> >> and
> |> >> Copy
> |> >> |> > and Paste) the following command, and then press ENTER (note,
> here,
> |> >> that *
> |> >> |> > and ? aren't supported):
> |> >> |> >
> |> >> |> > takeown /f Path_And_File_Name
> |> >> |> >
> |> >> |> > For example, type:
> |> >> |> > takeown /f C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
> |> >> |> >
> |> >> |> > Type the following command, and then press ENTER to grant
> |> >> |> > administrators full access to the file:
> |> >> |> >
> |> >> |> > icacls Path_And_File_Name /GRANT ADMINISTRATORS:F
> |> >> |> >
> |> >> |> > For example, type:
> |> >> |> > icacls C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab /grant
> |> >> administrators:F
> |> >> |> >
> |> >> |> > Then try Darrell's commands again.
> |> >> |> >
> |> >> |> >
> |> >> |> > "Berns" <Berns@discussions.microsoft.com> wrote in message
> |> >> |> > news:8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com...
> |> >> |> > > Yes, I made sure to right-click and run as administrator. I
> |> >> should
> |> >> have
> |> >> |> > > said
> |> >> |> > > that too in my response. Sorry about that.
> |> >> |> > >
> |> >> |> > > Thank you again for your help!
> |> >> |> > >
> |> >> |> > > Bernie
> |> >> |> > >
> |> >> |> > > "dean-dean" wrote:
> |> >> |> > >
> |> >> |> > >> Did you right-click on Command Prompt, and choose Run as
> |> >> Administrator
> |> >> |> > >> (even
> |> >> |> > >> though your logged into an administrative account)?
> |> >> |> > >>
> |> >> |> > >> "Berns" <Berns@discussions.microsoft.com> wrote in message
> |> >> |> > >> news:99102844-673B-4359-B42B-A1C469D3529E@microsoft.com...
> |> >> |> > >> > Thank you for both of your help. However, I still am
> unable to
> |> >> delete
> |> >> |> > >> > the
> |> >> |> > >> > file. Fortunately, I can now see the file in the
> $recycle.bin.
> |> >> |> > >> > However,
> |> >> |> > >> > I
> |> >> |> > >> > can not delete it. I've tried different administrator
> logins,
> |> >> but it
> |> >> |> > >> > still
> |> >> |> > >> > says access denied. I've done the following commands to
> try
> |> >> and
> |> >> delete
> |> >> |> > >> > it:
> |> >> |> > >> >
> |> >> |> > >> > del *.*
> |> >> |> > >> > del *.qbw
> |> >> |> > >> > del *rtdjfdg.qbw
> |> >> |> > >> > del $rtdjfdg.*
> |> >> |> > >> > del ?rtdjfdg.qbw
> |> >> |> > >> >
> |> >> |> > >> > I have not tried to delete the folder that it sits in
> though.
> |> >> I
> |> >> have a
> |> >> |> > >> > feeling that it will tell me that there is a file in that
> |> >> folder
> |> >> that I
> |> >> |> > >> > can
> |> >> |> > >> > not delete. Thoughts?
> |> >> |> > >> >
> |> >> |> > >> > Thank you again for your time and efforts in helping me out.
> |> >> |> > >> >
> |> >> |> > >> > Take care,
> |> >> |> > >> >
> |> >> |> > >> > Bernie
> |> >> |> > >> >
> |> >> |> > >> > ""Darrell Gorter[MSFT]"" wrote:
> |> >> |> > >> >
> |> >> |> > >> >> Hello,
> |> >> |> > >> >> Open an elevated CMD prompt.
> |> >> |> > >> >> First run chkdsk on the volume to check for file
> corruption.
> |> >> |> > >> >> if that doesn't help then try.
> |> >> |> > >> >> from the root of the C drive.
> |> >> |> > >> >> cd $recycle.bin
> |> >> |> > >> >> now do a dir /a /s >c:\filelist.txt
> |> >> |> > >> >> use notepad to open filelist.txt
> |> >> |> > >> >> Look for files or folders with non-alphanumeric characters
> in
> |> >> them.
> |> >> |> > >> >> try manually deleting those files or folders using wild
> cards
> |> >> (*
> |> >> or ?
> |> >> |> > >> >> for
> |> >> |> > >> >> example)
> |> >> |> > >> >> For a file like D&lete.me you could try using del
> D?lete.me to
> |> >> attempt
> |> >> |> > >> >> to
> |> >> |> > >> >> delete the file
> |> >> |> > >> >> The question mark replaces the single character that may be
> |> >> causing
> |> >> |> > >> >> the
> |> >> |> > >> >> isuse
> |> >> |> > >> >>
> |> >> |> > >> >> Thanks,
> |> >> |> > >> >> Darrell Gorter[MSFT]
> |> >> |> > >> >>
> |> >> |> > >> >> This posting is provided "AS IS" with no warranties, and
> |> >> confers
> |> >> no
> |> >> |> > >> >> rights
> |> >> |> > >> >> --------------------
> |> >> |> > >> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't
> delete
> |> >> |> > >> >> |> thread-index: AcfLCEgZddd5Zq5tQzK3i+JJYQGPdQ==
> |> >> |> > >> >> |> X-WBNR-Posting-Host: 207.46.192.207
> |> >> |> > >> >> |> From: =?Utf-8?B?QmVybnM=?=
> |> >> <Berns@discussions.microsoft.com>
> |> >> |> > >> >> |> Subject: Corrupt File in Recycle Bin... can't delete
> |> >> |> > >> >> |> Date: Fri, 20 Jul 2007 12:58:03 -0700
> |> >> |> > >> >> |> Lines: 13
> |> >> |> > >> >> |> Message-ID:
> |> >> <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>

On Mon, 23 Jul 2007 16:32:01 -0700, Berns

Jumping in; has this been covered?

>Thank you for both of your help. However, I still am unable to delete the
>file. Fortunately, I can now see the file in the $recycle.bin.

>del *.*
>del *.qbw
>del *rtdjfdg.qbw
>del $rtdjfdg.*
>del ?rtdjfdg.qbw

>I have not tried to delete the folder that it sits in though. I have a
>feeling that it will tell me that there is a file in that folder that I can
>not delete. Thoughts?

Some malware runs from Recycled, and as it is there in the directory
location without being integrated into the "Recycle Bin" namespace
folder, it can be hard to see or delete.

Background...

Windows Explorer navigates a namespace made up of folders, and the
Recycle Bin folder is an overlay of "known" items in the relevant
recycle bin directory of all hard drive volumes.

In contrast, a file system explorer navigates the file system, seeing
each raw "recycled" location as a directory full of files in that
location. You will notice the names will differ, and things merged
from other volumes will not be there.

If malware writes itself to the underlying directory and runs from
there (as opposed to being "deleted" to "the bin") then the bin's
indexing will not reference the file, as seen as the "Recycle Bin"
namespace object.

Also, if the file is actively running, and you are somehow able to see
it, you won't be able to delete it because it is "in use". That's
just Windows, before you raise the possibility of the malware code
actively hiding or protecting the file (or other files).


The definitive answer is, as always, to formally scan the system for
malware, without running the infected installation. That means
booting off something else that can safely process the file system, as
well as resolving registry and other integration references.

You may be able to do this from the Vista installation DVD (if you got
one, i.e. weren't ripped off by royalty OEM "Dubious Advantage")...

0) Disconnect the infected PC from ALL networks

And that definitely includes wireless and the Internet.

1) Prepare antivirus tools from a clean PC

Download Trend SysClean, Avast Cleaner, McAfee Stinger, amd any other
free cleanup tools you can find that aren't from the 200+ list of fake
free "antispyware" tools. The tools will have to work "live", without
being installed, as the ones I mentioned will do.

A Vista64 DVD will not run 32-bit tools, so good luck finding anything
in 64-bit. A Vista32 DVD will run many 32-bit tools, but neither DVD
types will run any "DOS" tools - so that kills quite a few
command-line scanners that would otherwise be great here.

Do not attept to prepare these materials from the infected PC, duh...
you'd be relying on the malware being ineffectively-written to make
use of opportunities to defend itself or strike back.

2) Put these tools onto USB, CDR, DVDR etc.

If you use USB flash, it's best to write-protect it if you can (just
in case the malware gets active while you wrassle it).

3) Boot your PC from the Vista DVD

Keep your wita about you! If the system is allowed to boot
unattended, it will "fall through" to booting the (infected) HD, even
if you'd suppressed that in CMOS Setup.

When booted, find your way to the "repair" or "recovery" section, but
DO NOT FALL INTO RE-INSTALLING WINDOWS!! Remember, Vista (at last)
has off-HD maintenance capabilities, but the disk is still orientated
around the old "installation disk" mindset. Be careful and alert.

When you get to the relevant section, choose Command Prompt. That is
the only UI to the WinPE OS that will be running from DVD boot.

4) Copy the tools to the hard drive

This is necessary for tools that write to themselves, as SysClean
does, and others may. Such attempts will fail if you try to run the
tools from CDR or other read-only storage.

You can create a new directory on the HD and drop them there, to
reduce the risk of running the wrong executable and thus potentially
running the malware you are hunting for.

5) Run the tool(s)

Save any logs you can.

David Lipman has an excellent set of tools bound together as
"Multi-AV". These include 4 av scanners, and generally update
themselves and then scan. You'd install this on the clean PC, let
them update, but not scan; then you could do (2) - (5) as long as the
things don't insist on updating - remember Step (0) - before scanning.



>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -

Hello Bernie,
The domain doesn't make a difference.
Administrators have full control which is what we should have seen.
There isn't any deny access which is again what we should have seen.
It's not obvious as to why this is failing
Chkdsk should be the next option
Thanks,
Darrell Gorter[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights
--------------------
|> Thread-Topic: Corrupt File in Recycle Bin... can't delete
|> thread-index: AcfPBgmJjC7AclnkRxi9RVKsSamiiA==
|> X-WBNR-Posting-Host: 207.46.193.207
|> From: =?Utf-8?B?QmVybnM=?= <Berns@discussions.microsoft.com>
|> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
<sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
<99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
<E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
<8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
<OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
<95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
<bLafeyizHHA.5848@TK2MSFTNGHUB02.phx.gbl>
<07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
<75897703-225A-4A87-86B7-E02052AA42E0@microsoft.com>
<Ltj5IBkzHHA.4844@TK2MSFTNGHUB02.phx.gbl>
|> Subject: Re: Corrupt File in Recycle Bin... can't delete
|> Date: Wed, 25 Jul 2007 14:52:04 -0700
|> Lines: 329
|> Message-ID: <4D1510A9-8F59-4CF8-B12B-31E4D6ADB21B@microsoft.com>
|> MIME-Version: 1.0
|> Content-Type: text/plain;
|> charset="Utf-8"
|> Content-Transfer-Encoding: 8bit
|> X-Newsreader: Microsoft CDO for Windows 2000
|> Content-Class: urn:content-classes:message
|> Importance: normal
|> Priority: normal
|> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
|> Newsgroups: microsoft.public.windows.vista.general
|> Path: TK2MSFTNGHUB02.phx.gbl
|> Xref: TK2MSFTNGHUB02.phx.gbl
microsoft.public.windows.vista.general:142282
|> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
|> X-Tomcat-NG: microsoft.public.windows.vista.general
|>
|> Darrell, dean-dean and others,
|>
|> Thanks again for the input. I did run the icacls $RTDJFDG.QBW and this
is
|> what I got. (Note: I put in DOMAIN in place of our company domain. I
don't
|> think that it's relevant that everyone knows our domain name. I also
did the
|> same for “username� and “username� is the administrator of the
machine.)
|>
|> BUILTIN\Administrators: (F)
|> DOMAIN\QBDataServiceUser17: (RX,W)
|> DOMAIN\QBDataServiceUser17: (I,RX,W)
|> BUILTIN\Administrators: (I)(F)
|> NT AUTHORITY\SYSTEM: (I)(F)
|> DOMAIN\username: (I)(F)
|> Mandatory Label \ High Mandatory Level: (I)(NW)
|> Successfully processed 1 files; Failed processing 0 files
|>
|> I also checked the tasklist /svc and ended the processes that were
related
|> to Quickbooks with no success.
|>
|> I have yet to run a chkdsk /f (I just wanted to give you an update of
what
|> I’ve done so far.)
|>
|> I hope that this helps out. Thank you again for all of your efforts.
Take
|> care and good luck.
|>
|> Bernie
|>
|> ""Darrell Gorter[MSFT]"" wrote:
|>
|> > Hello,
|> > Let's check the permissions on the file.
|> > Run icacls $RTDJFDG.QBW
|> >
|> > This should display the ACLS on file. There could be a specific ACL
|> > causing this error message.
|> > If you don't have ownership you could see this, or if there is a
specific
|> > deny ACL applied you could get this error.
|> > post back the output.
|> >
|> > Also are there any Quickbook processes running that may be holding
onto the
|> > file?
|> >
|> > From the elevated CMD prompt run tasklist /svc and look for any
processes
|> > that Quickbooks may have running.
|> >
|> > Thanks,
|> > Darrell Gorter[MSFT]
|> >
|> > This posting is provided "AS IS" with no warranties, and confers no
rights
|> > --------------------
|> > |> From: "dean-dean" <dean-dean@discussions.microsoft.com>
|> > |> References: <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
|> > <sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
|> > <99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
|> > <E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
|> > <8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
|> > <OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
|> > <95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
|> > <bLafeyizHHA.5848@TK2MSFTNGHUB02.phx.gbl>
|> > <07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
|> > |> In-Reply-To: <07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com>
|> > |> Subject: Re: Corrupt File in Recycle Bin... can't delete
|> > |> Date: Tue, 24 Jul 2007 16:31:09 -0500
|> > |> Lines: 279
|> > |> Message-ID: <75897703-225A-4A87-86B7-E02052AA42E0@microsoft.com>
|> > |> MIME-Version: 1.0
|> > |> Content-Type: text/plain;
|> > |> format=flowed;
|> > |> charset="Utf-8";
|> > |> reply-type=original
|> > |> Content-Transfer-Encoding: 7bit
|> > |> X-Priority: 3
|> > |> X-MSMail-Priority: Normal
|> > |> X-Newsreader: Microsoft Windows Mail 6.0.6000.16480
|> > |> X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16480
|> > |> X-MS-CommunityGroup-PostID: {75897703-225A-4A87-86B7-E02052AA42E0}
|> > |> X-MS-CommunityGroup-ThreadID: 83E1936A-CD59-4026-A732-2B6AF3DC56BC
|> > |> X-MS-CommunityGroup-ParentID: 07658F52-573A-45A7-8A0F-8C6975CB4C2E
|> > |> Newsgroups: microsoft.public.windows.vista.general
|> > |> Path: TK2MSFTNGHUB02.phx.gbl
|> > |> Xref: TK2MSFTNGHUB02.phx.gbl
|> > microsoft.public.windows.vista.general:141405
|> > |> NNTP-Posting-Host: TK2MSFTNGHUB02.phx.gbl 127.0.0.1
|> > |> X-Tomcat-NG: microsoft.public.windows.vista.general
|> > |>
|> > |> If you have a Vista installation DVD, perhaps try booting from
that.
|> > Then
|> > |> use the "Repair your computer" > "System Recovery
|> > |> Options" > "Command Prompt" on the DVD to delete the file. (Type c:
at
|> > the
|> > |> prompt to change drives, if C is where Vista is installed). You
may
|> > also
|> > |> want to run chkdsk /f from there, and check the drive vista is
installed
|> > on.
|> > |> See this as to how to get there:
|> > |>
|> > |> http://www.bleepingcomputer.com/tuto...torial147.html
|> > |>
|> > |> "Berns" <Berns@discussions.microsoft.com> wrote in message
|> > |> news:07658F52-573A-45A7-8A0F-8C6975CB4C2E@microsoft.com...
|> > |> > The name of the file is something like: $RTDJFDG.QBW (Quickbooks
|> > file).
|> > |> >
|> > |> > I haven't tried copying the file to another location. I was
worried
|> > that
|> > |> > if
|> > |> > I copied it to another location, then I would have more than one
|> > corrupt
|> > |> > file
|> > |> > on the system taking up more than 85MB. I can give it a shot,
but I'm
|> > not
|> > |> > sure if that's a route I'd like to go. However, at this point,
I'm
|> > game.
|> > |> >
|> > |> > I've also read on another site about deleting the recycle bin all
|> > together
|> > |> > and Windows will automatically create a new one??? I have not
given
|> > that
|> > |> > a
|> > |> > try yet only because I'm not sure about Vista creating a new
|> > $recycle.bin
|> > |> > if
|> > |> > it can't find one. Can anyone give insite on that?
|> > |> >
|> > |> > Thank you again...
|> > |> >
|> > |> > Bernie
|> > |> >
|> > |> > ""Darrell Gorter[MSFT]"" wrote:
|> > |> >
|> > |> >> Hello,
|> > |> >> What is the filename in question?
|> > |> >> Can you copy it to another location?
|> > |> >> Thanks,
|> > |> >> Darrell Gorter[MSFT]
|> > |> >>
|> > |> >> This posting is provided "AS IS" with no warranties, and confers
no
|> > |> >> rights
|> > |> >> --------------------
|> > |> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't delete
|> > |> >> |> thread-index: AcfOGoBZGPzgrUuxTzyhl8rtGXRR/Q==
|> > |> >> |> X-WBNR-Posting-Host: 207.46.193.207
|> > |> >> |> From: =?Utf-8?B?QmVybnM=?= <Berns@discussions.microsoft.com>
|> > |> >> |> References:
<83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
|> > |> >> <sqpqZ9yyHHA.5204@TK2MSFTNGHUB02.phx.gbl>
|> > |> >> <99102844-673B-4359-B42B-A1C469D3529E@microsoft.com>
|> > |> >> <E359C3FF-EE23-4BF9-9B3E-BA6F2225AC5B@microsoft.com>
|> > |> >> <8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com>
|> > |> >> <OPuxd3ZzHHA.5376@TK2MSFTNGP03.phx.gbl>
|> > |> >> |> Subject: Re: Corrupt File in Recycle Bin... can't delete
|> > |> >> |> Date: Tue, 24 Jul 2007 10:46:02 -0700
|> > |> >> |> Lines: 163
|> > |> >> |> Message-ID:
<95282585-135F-425C-B100-ADCD585FEC4D@microsoft.com>
|> > |> >> |> MIME-Version: 1.0
|> > |> >> |> Content-Type: text/plain;
|> > |> >> |> charset="Utf-8"
|> > |> >> |> Content-Transfer-Encoding: 7bit
|> > |> >> |> X-Newsreader: Microsoft CDO for Windows 2000
|> > |> >> |> Content-Class: urn:content-classes:message
|> > |> >> |> Importance: normal
|> > |> >> |> Priority: normal
|> > |> >> |> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
|> > |> >> |> Newsgroups: microsoft.public.windows.vista.general
|> > |> >> |> Path: TK2MSFTNGHUB02.phx.gbl
|> > |> >> |> Xref: TK2MSFTNGHUB02.phx.gbl
|> > |> >> microsoft.public.windows.vista.general:141249
|> > |> >> |> NNTP-Posting-Host: tk2msftsbfm01.phx.gbl 10.40.244.148
|> > |> >> |> X-Tomcat-NG: microsoft.public.windows.vista.general
|> > |> >> |>
|> > |> >> |> dean-dean,
|> > |> >> |>
|> > |> >> |> Thank you, I tried both of these and they were successful in
their
|> > |> >> actions,
|> > |> >> |> however, I still am unable to delete the files. I did find
out
|> > |> >> something
|> > |> >> |> interesting though. I am able to Rename the file (REN).
Even
|> > after
|> > |> >> the
|> > |> >> |> rename, I am not able to delete. It says "access denied".
More
|> > |> >> thoughts?
|> > |> >> |>
|> > |> >> |> Bernie
|> > |> >> |>
|> > |> >> |> "dean-dean" wrote:
|> > |> >> |>
|> > |> >> |> > You could try this, dunno. Using your filelist.txt,
identify
|> > the
|> > |> >> path
|> > |> >> of
|> > |> >> |> > the problem file, for example:
|> > |> >> |> >
|> > |> >> |> > C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
|> > |> >> |> >
|> > |> >> |> > At an elevated command prompt, type (or line it all up in
|> > Notepad,
|> > |> >> and
|> > |> >> Copy
|> > |> >> |> > and Paste) the following command, and then press ENTER
(note,
|> > here,
|> > |> >> that *
|> > |> >> |> > and ? aren't supported):
|> > |> >> |> >
|> > |> >> |> > takeown /f Path_And_File_Name
|> > |> >> |> >
|> > |> >> |> > For example, type:
|> > |> >> |> > takeown /f C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
|> > |> >> |> >
|> > |> >> |> > Type the following command, and then press ENTER to grant
|> > |> >> |> > administrators full access to the file:
|> > |> >> |> >
|> > |> >> |> > icacls Path_And_File_Name /GRANT ADMINISTRATORS:F
|> > |> >> |> >
|> > |> >> |> > For example, type:
|> > |> >> |> > icacls C:\$Recycle.Bin\S-1-5-21-9999\$1P&0NP.cab
/grant
|> > |> >> administrators:F
|> > |> >> |> >
|> > |> >> |> > Then try Darrell's commands again.
|> > |> >> |> >
|> > |> >> |> >
|> > |> >> |> > "Berns" <Berns@discussions.microsoft.com> wrote in message
|> > |> >> |> > news:8644FC1B-0A79-4A75-9778-DBF730043AA4@microsoft.com...
|> > |> >> |> > > Yes, I made sure to right-click and run as administrator.
I
|> > |> >> should
|> > |> >> have
|> > |> >> |> > > said
|> > |> >> |> > > that too in my response. Sorry about that.
|> > |> >> |> > >
|> > |> >> |> > > Thank you again for your help!
|> > |> >> |> > >
|> > |> >> |> > > Bernie
|> > |> >> |> > >
|> > |> >> |> > > "dean-dean" wrote:
|> > |> >> |> > >
|> > |> >> |> > >> Did you right-click on Command Prompt, and choose Run as
|> > |> >> Administrator
|> > |> >> |> > >> (even
|> > |> >> |> > >> though your logged into an administrative account)?
|> > |> >> |> > >>
|> > |> >> |> > >> "Berns" <Berns@discussions.microsoft.com> wrote in
message
|> > |> >> |> > >>
news:99102844-673B-4359-B42B-A1C469D3529E@microsoft.com...
|> > |> >> |> > >> > Thank you for both of your help. However, I still am
|> > unable to
|> > |> >> delete
|> > |> >> |> > >> > the
|> > |> >> |> > >> > file. Fortunately, I can now see the file in the
|> > $recycle.bin.
|> > |> >> |> > >> > However,
|> > |> >> |> > >> > I
|> > |> >> |> > >> > can not delete it. I've tried different administrator
|> > logins,
|> > |> >> but it
|> > |> >> |> > >> > still
|> > |> >> |> > >> > says access denied. I've done the following commands
to
|> > try
|> > |> >> and
|> > |> >> delete
|> > |> >> |> > >> > it:
|> > |> >> |> > >> >
|> > |> >> |> > >> > del *.*
|> > |> >> |> > >> > del *.qbw
|> > |> >> |> > >> > del *rtdjfdg.qbw
|> > |> >> |> > >> > del $rtdjfdg.*
|> > |> >> |> > >> > del ?rtdjfdg.qbw
|> > |> >> |> > >> >
|> > |> >> |> > >> > I have not tried to delete the folder that it sits in
|> > though.
|> > |> >> I
|> > |> >> have a
|> > |> >> |> > >> > feeling that it will tell me that there is a file in
that
|> > |> >> folder
|> > |> >> that I
|> > |> >> |> > >> > can
|> > |> >> |> > >> > not delete. Thoughts?
|> > |> >> |> > >> >
|> > |> >> |> > >> > Thank you again for your time and efforts in helping
me out.
|> > |> >> |> > >> >
|> > |> >> |> > >> > Take care,
|> > |> >> |> > >> >
|> > |> >> |> > >> > Bernie
|> > |> >> |> > >> >
|> > |> >> |> > >> > ""Darrell Gorter[MSFT]"" wrote:
|> > |> >> |> > >> >
|> > |> >> |> > >> >> Hello,
|> > |> >> |> > >> >> Open an elevated CMD prompt.
|> > |> >> |> > >> >> First run chkdsk on the volume to check for file
|> > corruption.
|> > |> >> |> > >> >> if that doesn't help then try.
|> > |> >> |> > >> >> from the root of the C drive.
|> > |> >> |> > >> >> cd $recycle.bin
|> > |> >> |> > >> >> now do a dir /a /s >c:\filelist.txt
|> > |> >> |> > >> >> use notepad to open filelist.txt
|> > |> >> |> > >> >> Look for files or folders with non-alphanumeric
characters
|> > in
|> > |> >> them.
|> > |> >> |> > >> >> try manually deleting those files or folders using
wild
|> > cards
|> > |> >> (*
|> > |> >> or ?
|> > |> >> |> > >> >> for
|> > |> >> |> > >> >> example)
|> > |> >> |> > >> >> For a file like D&lete.me you could try using del
|> > D?lete.me to
|> > |> >> attempt
|> > |> >> |> > >> >> to
|> > |> >> |> > >> >> delete the file
|> > |> >> |> > >> >> The question mark replaces the single character that
may be
|> > |> >> causing
|> > |> >> |> > >> >> the
|> > |> >> |> > >> >> isuse
|> > |> >> |> > >> >>
|> > |> >> |> > >> >> Thanks,
|> > |> >> |> > >> >> Darrell Gorter[MSFT]
|> > |> >> |> > >> >>
|> > |> >> |> > >> >> This posting is provided "AS IS" with no warranties,
and
|> > |> >> confers
|> > |> >> no
|> > |> >> |> > >> >> rights
|> > |> >> |> > >> >> --------------------
|> > |> >> |> > >> >> |> Thread-Topic: Corrupt File in Recycle Bin... can't
|> > delete
|> > |> >> |> > >> >> |> thread-index: AcfLCEgZddd5Zq5tQzK3i+JJYQGPdQ==
|> > |> >> |> > >> >> |> X-WBNR-Posting-Host: 207.46.192.207
|> > |> >> |> > >> >> |> From: =?Utf-8?B?QmVybnM=?=
|> > |> >> <Berns@discussions.microsoft.com>
|> > |> >> |> > >> >> |> Subject: Corrupt File in Recycle Bin... can't
delete
|> > |> >> |> > >> >> |> Date: Fri, 20 Jul 2007 12:58:03 -0700
|> > |> >> |> > >> >> |> Lines: 13
|> > |> >> |> > >> >> |> Message-ID:
|> > |> >> <83E1936A-CD59-4026-A732-2B6AF3DC56BC@microsoft.com>
|>

Thanks again guys (and/or girls). I have yet to try these options. I'll do
what I can to get an update for you soon. I just wanted to let you know that
I appreciate the help. Be back soon.

Bernie

"cquirke (MVP Windows shell/user)" wrote:

> On Mon, 23 Jul 2007 16:32:01 -0700, Berns
>
> Jumping in; has this been covered?
>
> >Thank you for both of your help. However, I still am unable to delete the
> >file. Fortunately, I can now see the file in the $recycle.bin.
>
> >del *.*
> >del *.qbw
> >del *rtdjfdg.qbw
> >del $rtdjfdg.*
> >del ?rtdjfdg.qbw
>
> >I have not tried to delete the folder that it sits in though. I have a
> >feeling that it will tell me that there is a file in that folder that I can
> >not delete. Thoughts?
>
> Some malware runs from Recycled, and as it is there in the directory
> location without being integrated into the "Recycle Bin" namespace
> folder, it can be hard to see or delete.
>
> Background...
>
> Windows Explorer navigates a namespace made up of folders, and the
> Recycle Bin folder is an overlay of "known" items in the relevant
> recycle bin directory of all hard drive volumes.
>
> In contrast, a file system explorer navigates the file system, seeing
> each raw "recycled" location as a directory full of files in that
> location. You will notice the names will differ, and things merged
> from other volumes will not be there.
>
> If malware writes itself to the underlying directory and runs from
> there (as opposed to being "deleted" to "the bin") then the bin's
> indexing will not reference the file, as seen as the "Recycle Bin"
> namespace object.
>
> Also, if the file is actively running, and you are somehow able to see
> it, you won't be able to delete it because it is "in use". That's
> just Windows, before you raise the possibility of the malware code
> actively hiding or protecting the file (or other files).
>
>
> The definitive answer is, as always, to formally scan the system for
> malware, without running the infected installation. That means
> booting off something else that can safely process the file system, as
> well as resolving registry and other integration references.
>
> You may be able to do this from the Vista installation DVD (if you got
> one, i.e. weren't ripped off by royalty OEM "Dubious Advantage")...
>
> 0) Disconnect the infected PC from ALL networks
>
> And that definitely includes wireless and the Internet.
>
> 1) Prepare antivirus tools from a clean PC
>
> Download Trend SysClean, Avast Cleaner, McAfee Stinger, amd any other
> free cleanup tools you can find that aren't from the 200+ list of fake
> free "antispyware" tools. The tools will have to work "live", without
> being installed, as the ones I mentioned will do.
>
> A Vista64 DVD will not run 32-bit tools, so good luck finding anything
> in 64-bit. A Vista32 DVD will run many 32-bit tools, but neither DVD
> types will run any "DOS" tools - so that kills quite a few
> command-line scanners that would otherwise be great here.
>
> Do not attept to prepare these materials from the infected PC, duh...
> you'd be relying on the malware being ineffectively-written to make
> use of opportunities to defend itself or strike back.
>
> 2) Put these tools onto USB, CDR, DVDR etc.
>
> If you use USB flash, it's best to write-protect it if you can (just
> in case the malware gets active while you wrassle it).
>
> 3) Boot your PC from the Vista DVD
>
> Keep your wita about you! If the system is allowed to boot
> unattended, it will "fall through" to booting the (infected) HD, even
> if you'd suppressed that in CMOS Setup.
>
> When booted, find your way to the "repair" or "recovery" section, but
> DO NOT FALL INTO RE-INSTALLING WINDOWS!! Remember, Vista (at last)
> has off-HD maintenance capabilities, but the disk is still orientated
> around the old "installation disk" mindset. Be careful and alert.
>
> When you get to the relevant section, choose Command Prompt. That is
> the only UI to the WinPE OS that will be running from DVD boot.
>
> 4) Copy the tools to the hard drive
>
> This is necessary for tools that write to themselves, as SysClean
> does, and others may. Such attempts will fail if you try to run the
> tools from CDR or other read-only storage.
>
> You can create a new directory on the HD and drop them there, to
> reduce the risk of running the wrong executable and thus potentially
> running the malware you are hunting for.
>
> 5) Run the tool(s)
>
> Save any logs you can.
>
> David Lipman has an excellent set of tools bound together as
> "Multi-AV". These include 4 av scanners, and generally update
> themselves and then scan. You'd install this on the clean PC, let
> them update, but not scan; then you could do (2) - (5) as long as the
> things don't insist on updating - remember Step (0) - before scanning.
>
>
>
> >-------------------- ----- ---- --- -- - - - -
> Running Windows-based av to kill active malware is like striking
> a match to see if what you are standing in is water or petrol.
> >-------------------- ----- ---- --- -- - - - -
>