A single file has become unusable, unmodifiable, undeletable. Cannot take ownership

Question

A single file, at /MyFolder/images/file1.png, has become, suddenly, a god entity as I've never seen one before. I'm the only account on the PC, full admin rights. UAC turned off always, ever since the beginning. What has failed:

• Windows Explorer -> Properties -> Security:
• • "You do not have permissions to view or edit this object's permission settings"
• • Advanced -> Owner: Current owner: Unable to display current owner
• takeown /f file1.png /r /d y: ERROR: Access is denied.
• icacls file1.png /grant administrators:F /T: file1.png: Access is denied. Succesfully processed 0 files; Failed processing 1 files.
• net user administrator /active:yes in an elevated command prompt, switching to Administrator user, trying to take ownership through Windows Explorer & repeated above steps.

Whatever I do, I cannot retake control of this file. What have I missed, what can I do?

Answer 1

This could be caused by a corruption of the NTFS ACLs; try running chkdsk on the volume.

Or it could be that the system security policy doesn't grant Administrators the right to take ownership of files (either because it was changed or because it became corrupted); run gpedit.msc, go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment and make sure the Administrators group has the Take ownership of files or other objects privilege.

Answer 2

1a. First navigate to the directory in Windows Explorer. Hold down CTRL + Right click – Open Command Window here. You may have to close that CMD prompt and open CMD as administrator.

2. Type:

rmdir (foldername) /s # gives error del . # gives error takeown /f (foldername) /r /d y # gives error

3. Since those don’t work, lets try doing it running as NTAUTHORITY\SYSTEM: type psexec -sid cmd.exe whoami #should return system Try step 2 again, still no go #NOTE: This assumes you have PSTools installed and added to your PATH variable.

NOTE: You used to be able to run “at (time) /interactive cmd.exe” #Where (time) is the current time (HH:MM 24 hour) plus 1 minute. The /interactive switch has been depreciated though.

4. Right click each file with the Unlocker windows explorer extension – Delete on next reboot. This works!

5. If you have a “path too long” error, just type:

robocopy c:\empty C:\deleteme /purge

NOTE: This will delete that folder (c:\deleteme) and all subfolders for you!

Answer 3

Boot a live *nix distro.
Depending on what you want to do with the file:

chown user .../file1.png && chmod 7777 .../file1.png

reboot in windows and you should be able to have your way with it.

or just delete it.

If you can be bothered trying to get your head around windows syntax, icalcs might work. Not being a windows user, I couldn't tell you how.

Answer 4

Hit start, type cmd, open as administrator. Type: net user administrator /active:yes Log off your account, log in as administrator You should now be able to delete the file. Log off, then log in your user account. At the cmd prompt, type: net user administrator /active:no

Scan for malware