1

On a roaming profile network, a user has a strange directory\file that will not delete: C:\Users\Manager1\AppData\OICE_15_974FA576_32C1D314_1A3\130544A4.

In Windows Explorer: "Could not find this item" From command prompt: "Could Not Find "

Since I can't explain the file's existence, I am suspecting malware created the file ... but it's odd I can't delete this file.

Observations:

  • Odd that the file has a trailing "." (dot) in the name. (zero-length extension?!)
  • The file is 0KB in size.
  • Trying to open it with Notepad, I get "The system cannot find the file specified."
  • This user has logged on to 2 different workstations, this directory\file exists and will not delete on either workstation.
  • Both workstations have been rebooted to ensure the file is not locked.
  • The normal AppData directories exist: Local, LocalLow, Roaming (I haven't before seen a 4th folder at this level).
  • I typically have the "Owner" column showing in WinExp, this file does not have an Owner. (The parent directory has "Manager1" as the Owner, as expected).
  • As part of the Roaming Profile, this file was copied back to the server, so this may explain why the file exists on 2 workstations. I can not delete the file on the server!
  • Trying to get an idea of what created this directory\file(s) in the first place. There are 2 other files in this odd directory, appearing to be temporary files, it appears I can delete them easy enough:
    • ~WRS{4857159A-7397-4DAD-AC26-BAF9D7AFC830}.tmp
    • msoF57A.tmp

All the tricks I know have failed:

  • delete the file through the C: drive network share, WinExp and CmdPrompt.
  • delete the file locally, logged in as an Administrator, WinExp and CmdPrompt.
  • delete the parent directory, and all sub-files (rmdir /s).
  • rename the file, using both wildcard rename and specific name.

Typical CmdPrompt message: "The system cannot find the file specified."

Wowsa, weird, especially not being able to delete from the romaing profile on the server. Any ideas?

0

It turns out I was pointed at the answer in a post I found over on Stack Overflow:

How to delete a folder that name ended with a dot(“.”)

Command:

del "\\?\C:\Users\Manager1\AppData\OICE_15_974FA576_32C1D314_1A3\130544A4."

(now if only I understood the difference between Super User and Stack Overflow, you'd think someone with 35+ years of computer experience could figure it out)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.