On a roaming profile network, a user has a strange directory\file that will not delete: C:\Users\Manager1\AppData\OICE_15_974FA576_32C1D314_1A3\130544A4.
In Windows Explorer: "Could not find this item" From command prompt: "Could Not Find "
Since I can't explain the file's existence, I am suspecting malware created the file ... but it's odd I can't delete this file.
- Odd that the file has a trailing "." (dot) in the name. (zero-length extension?!)
- The file is 0KB in size.
- Trying to open it with Notepad, I get "The system cannot find the file specified."
- This user has logged on to 2 different workstations, this directory\file exists and will not delete on either workstation.
- Both workstations have been rebooted to ensure the file is not locked.
- The normal AppData directories exist: Local, LocalLow, Roaming (I haven't before seen a 4th folder at this level).
- I typically have the "Owner" column showing in WinExp, this file does not have an Owner. (The parent directory has "Manager1" as the Owner, as expected).
- As part of the Roaming Profile, this file was copied back to the server, so this may explain why the file exists on 2 workstations. I can not delete the file on the server!
- Trying to get an idea of what created this directory\file(s) in the first place. There are 2 other files in this odd directory, appearing to be temporary files, it appears I can delete them easy enough:
All the tricks I know have failed:
- delete the file through the C: drive network share, WinExp and CmdPrompt.
- delete the file locally, logged in as an Administrator, WinExp and CmdPrompt.
- delete the parent directory, and all sub-files (rmdir /s).
- rename the file, using both wildcard rename and specific name.
Typical CmdPrompt message: "The system cannot find the file specified."
Wowsa, weird, especially not being able to delete from the romaing profile on the server. Any ideas?