How do I delete leaktest.exe?

Question

McAfee Security Center finds a "Potentially Unwanted Program" called leaktest.exe.

Unfortunately, McAfee cannot delete it (Cannot be completely removed) and when I tried to delete it directly under Win 7 (64 bit ultimate), I'm told I need permission to remove the file. However, I am logged in as Administrator.

How do I remove this file?

Answer 1

LockHunter is a foolproof file unlocker:

It is a free tool to delete files blocked by something you do not know. LockHunter is useful for fighting against malware, and other programs that are blocking files without a reason. Unlike other similar tools it deletes files into the recycle bin so you may restore them if deleted by mistake.

LockHunter is freeware.

Edit: of course you can always nuke the file from a BartPE Windows Live CD (unless the drive is encrypted with BitLocker).

Answer 2

Try Safe Mode. (As you're booting up, press F8. I start tapping it when my PC POSTs, and stop pressing when I see the menu :P). If that fails, there are still things you can do, but none are quite as easy as using a linux LiveCD, such as Ubuntu, which can simply be burned to a disk, and then you can boot your PC from that, look inside your hdd, and delete it. Ubuntu doesn't care about file permissions from windows, so it'll delete the file just fine. (This won't solve your problem if the virus has a secondary executable to make sure it#s still there, however)

Answer 3

You need to "take ownership" of the file. Brief guide and small application here at howtogeek.com/add-take-ownership-to-explorer-right-click-menu

Answer 4

Technically you're logged in with administrative privileges, but you're not running as admin.

the master administrator account is hidden on Windows 7, but you can re-enable it.

Answer 5

Use Unlocker:

The application removes file-access restrictions that prevent a user from moving, deleting, or renaming a file. The user right-clicks on a file and selects Unlocker, which displays information regarding the selected file, such as Path Locked, PID, Handle, and Process Path. This program also allows terminating a currently running process. In some cases, files cannot be accessed due to Windows file-access bugs, for which Windows informs the user the file is currently in use--even when it's not.

Unlocker can effectively bypass this bug's restrictions; it unlocks or disables whatever is preventing the user to access that file.

Answer 6

I had this same problem with LeakTest[1].exe alsoon my WIN7 system. McAfee said that it could not remove it. So, now it's time to go "Old School". That means working from the command prompt...or DOS window for us older people. :) You don't need to install another fancy program to get rid of it. Just use the basic commands of the operating system.

Copy the path EXACTLY that McAfee gives stating the directory of the file. On my system the file was located in:

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ\LeakTest[1].exe

You will have to use the old command line approach to delete it. Open up a command prompt window and get to the root directory of the drive on which the file resides. This is normally C: unless you installed Windows on an alternate drive.

CD\

You should see something similar to the prompt below.

C:\>

Enter the directory path where LeakTest[1].exe resides on YOUR SYSTEM. The command below is the directory path for MY SYSTEM and is being shown as an example.

C:\ CD Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ\

If you entered the path correctly you should be in that directory.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ

If you're having a problem with the entire path, try changing just one or two directories at a time then do the DIR command to verify that the next directory exists and that you are spelling it correctly with and needed spaces in the directory name.

Notice that there is a DOT in the directory \Content.IE5 on my example. Don't overlook that if it exists on yours also.

Look for the file with the DIR command.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ> dir

Once you see the file and verify that it's there, use the DEL command to DELETE it.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ>del LeakTest[1].exe

If you get an error saying that the file can't be deleted then more than likely it has the READ ONLY attribute set on the file. We can remove that attribute with the ATTRIB command and the -R switch.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ>ATTRIB -R LeakTest[1].exe

Now try to delete the file again.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ>del LeakTest[1].exe

That should do it - at least it worked for me.

Answer 7

Just found fileAssassin from the famous Malwarebytes guys: http://www.malwarebytes.org/fileassassin.php

Sounds like it would have done the trick.