Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

McAfee Security Center finds a "Potentially Unwanted Program" called leaktest.exe.

Unfortunately, McAfee cannot delete it (Cannot be completely removed) and when I tried to delete it directly under Win 7 (64 bit ultimate), I'm told I need permission to remove the file. However, I am logged in as Administrator.

How do I remove this file?

share|improve this question
add comment

7 Answers 7

LockHunter is a foolproof file unlocker:

It is a free tool to delete files blocked by something you do not know. LockHunter is useful for fighting against malware, and other programs that are blocking files without a reason. Unlike other similar tools it deletes files into the recycle bin so you may restore them if deleted by mistake.

alt text

LockHunter is freeware.

Edit: of course you can always nuke the file from a BartPE Windows Live CD (unless the drive is encrypted with BitLocker).

share|improve this answer
    
Great idea but LockHunter crashes when I'm trying to navigate to the folder with the file. –  user1413 Jan 10 '10 at 12:21
    
then i suppose something more sinister might be going on, did you run a check with MBAM? –  Molly7244 Jan 10 '10 at 13:38
add comment

Try Safe Mode. (As you're booting up, press F8. I start tapping it when my PC POSTs, and stop pressing when I see the menu :P). If that fails, there are still things you can do, but none are quite as easy as using a linux LiveCD, such as Ubuntu, which can simply be burned to a disk, and then you can boot your PC from that, look inside your hdd, and delete it. Ubuntu doesn't care about file permissions from windows, so it'll delete the file just fine. (This won't solve your problem if the virus has a secondary executable to make sure it#s still there, however)

share|improve this answer
    
Tried it but it still says that I can't delete it. –  user1413 Jan 10 '10 at 13:08
    
@user1413 What did you try? Safe Mode or a Linux Live CD? –  foraidt Mar 9 '10 at 13:17
add comment

You need to "take ownership" of the file. Brief guide and small application here at howtogeek.com/add-take-ownership-to-explorer-right-click-menu

share|improve this answer
    
This does not install the right-click menu item on my computer. –  user1413 Jan 10 '10 at 13:24
add comment

Technically you're logged in with administrative privileges, but you're not running as admin.

the master administrator account is hidden on Windows 7, but you can re-enable it.

share|improve this answer
    
Still says "Access denied" from master administrator account. –  user1413 Jan 10 '10 at 13:18
    
next step is to take ownership (admins may not have security access, but they can always take ownership and then alter it), or it is in-use by a running application. –  gbjbaanb Jan 11 '10 at 0:01
add comment

Use Unlocker:

The application removes file-access restrictions that prevent a user from moving, deleting, or renaming a file. The user right-clicks on a file and selects Unlocker, which displays information regarding the selected file, such as Path Locked, PID, Handle, and Process Path. This program also allows terminating a currently running process. In some cases, files cannot be accessed due to Windows file-access bugs, for which Windows informs the user the file is currently in use--even when it's not.

Unlocker can effectively bypass this bug's restrictions; it unlocks or disables whatever is preventing the user to access that file.

share|improve this answer
add comment

I had this same problem with LeakTest[1].exe alsoon my WIN7 system. McAfee said that it could not remove it. So, now it's time to go "Old School". That means working from the command prompt...or DOS window for us older people. :) You don't need to install another fancy program to get rid of it. Just use the basic commands of the operating system.

Copy the path EXACTLY that McAfee gives stating the directory of the file. On my system the file was located in:

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ\LeakTest[1].exe

You will have to use the old command line approach to delete it. Open up a command prompt window and get to the root directory of the drive on which the file resides. This is normally C: unless you installed Windows on an alternate drive.

CD\

You should see something similar to the prompt below.

C:\>

Enter the directory path where LeakTest[1].exe resides on YOUR SYSTEM. The command below is the directory path for MY SYSTEM and is being shown as an example.

C:\ CD Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ\

If you entered the path correctly you should be in that directory.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ

If you're having a problem with the entire path, try changing just one or two directories at a time then do the DIR command to verify that the next directory exists and that you are spelling it correctly with and needed spaces in the directory name.

Notice that there is a DOT in the directory \Content.IE5 on my example. Don't overlook that if it exists on yours also.

Look for the file with the DIR command.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ> dir

Once you see the file and verify that it's there, use the DEL command to DELETE it.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ>del LeakTest[1].exe

If you get an error saying that the file can't be deleted then more than likely it has the READ ONLY attribute set on the file. We can remove that attribute with the ATTRIB command and the -R switch.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ>ATTRIB -R LeakTest[1].exe

Now try to delete the file again.

C:\Users\"USER NAME"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUHZ17CJ>del LeakTest[1].exe

That should do it - at least it worked for me.

share|improve this answer
    
Wayne, Do you know what leaktest.exe is? –  user1413 Mar 3 '10 at 12:16
add comment

Just found fileAssassin from the famous Malwarebytes guys: http://www.malwarebytes.org/fileassassin.php

Sounds like it would have done the trick.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.