All of the suggestions to date should be tried first (delete from live, offline chkdsk). After that, (as long as you're obsessed with preventing a re-format/re-install), you have to dig deeper. For good general background on some deeper system problems, http://www.sysinternals.com is excellent. You'll want to get process explorer, and Rootkit revealer. Fire up Process Explorer, and use the find command to determine if the files are 'in use' as reported to Process Explorer. If not, suspect one of two remaining problems. 1) NTFS (MFT?) corruption. In this case, even if you do find a method to 'delete' the files, I wouldn't trust the disk for further use without a reformat. Is the source of the corruption just hidden, waiting to take out something important later? 2) The computer has (at one point) had a rootkit installed. In this case, it is still possible to remove all of the harmful components of the rootkit (maybe), it's just impossible to be 100% certain you've gotten all the pieces. If you suspect #2, run Rootkit Revealer, and carefully investigate/take action on every discrepancy between user mode and kernel mode results. Note that scanners can have a very hard time with both rootkits, and uncommon variants of infections. Or ... just reformat and put Ubuntu on it (which I'm doing more and more when I get broken Windows computers from friends). I hope this helps. Josh -------- Original Message -------- Subject: [tclug-list] OT/WinXP: Can't delete folders/files; suspect bad MFT From: Dean.Benjamin at mm.com To: tclug-list at mn-linux.org Date: Thu Mar 05 2009 21:03:42 GMT-0600 (Central Standard Time) > I'm working on a friend's WinXP system with about a dozen files and > folders that behave weirdly. Can't delete them, copy them, nor move > 'em. They appear to be phantoms of the file system; that is, their > names appear in the directory, but the associated objects have no > properties. The bad files are in an user's MyDocs folder on the C: > drive, where WinXP is also installed. The user is an Administrator, > with full privileges. > > The good news: he doesn't need the data. I merely want to delete > these "phantoms" and clean up the NTFS file structure, because I > suspect that these strange file-things are responsible for the > misbehavior of a video editing application. > > My hunch is that the NTFS master file table is broken. If so, the > bad news gleaned from the web is that my only way out is to reformat > the disk and reload the system. This ordeal I hope to avoid. > > Can anyone suggest a tool or method that will locate all the > "phantoms" on the C: drive, and repair the relevant NTFS > structures? (Recovery of phantoms optional.) > > > SYMPTOMS > > (1) Except for the filesystem glitches described here, the computer > works just fine. > > (2) No malware detected by three scanners: AVG Free, Norton System > Scan, Sunbelt VIPRE Rescue Scanner. > > (3) KillBox fails; message: "The file does not seem to exist". > > (4) A double-click on one of the bad folders yields a glimpse of what > looks like the correct contents. But within a second or two, the > window opened on the phantom folder vanishes -- just disappears, as > though I had clicked on the close button in the upper right > corner. No message, no nothing, just poof/gone. > > (5) For subsequent discussion, refer to this representative directory > structure: > TopDir\ (the parent directory, contains the rest) > BadDir\ (a "phantom" directory, behaving badly) > bad.file (a file within BadDir\) > OKDir\ (a folder that behaves normally) > ... etc ... > > (6) Ordinary Explorer Copy/Paste operation (ctrl+C/ctrl+V) fails on > BadDir\; message: "Cannot copy file: Cannot read from the source file > or disk." > > (7) Within a CMD.EXE window, after "cd TopDir\": > > (7a) "dir /q /s" lists all files and subfiles of TopDir\, as > expected. However: whereas the owner of OKDir\ appears as expected, > the owner of BadDir\ is given as "...". Stranger still: bad.file's > owner appears as expected. > > (7b) "dir BadDir\bad.file" fails; message: "The system cannot find > the file specified." > > (7c) "cd BadDir" fails; message: "The system cannot find the path specified." > > (7d) "cacls BadDir" fails; message: "The system cannot find the file > specified." > > (8) In Explorer, right-click -> Properties of BadDir\ shows size 0 > bytes, and the create/mod/access dates are all blank -- even though > the "dir" command in (7a) shows a mod date, as expected. > > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > tclug-list at mn-linux.org > http://mailman.mn-linux.org/mailman/listinfo/tclug-list >