Windows – strange AppData directory\file will not delete

windows

On a roaming profile network, a user has a strange directory\file that will not delete:
C:\Users\Manager1\AppData\OICE_15_974FA576_32C1D314_1A3\130544A4.

In Windows Explorer: "Could not find this item"
From command prompt: "Could Not Find "

Since I can't explain the file's existence, I am suspecting malware created the file … but it's odd I can't delete this file.

Observations:

  • Odd that the file has a trailing "." (dot) in the name. (zero-length
    extension?!)
  • The file is 0KB in size.
  • Trying to open it with Notepad, I get "The system cannot find the file specified."
  • This user has logged on to 2 different workstations, this directory\file exists and will not delete on either workstation.
  • Both workstations have been rebooted to ensure the file is not locked.
  • The normal AppData directories exist: Local, LocalLow, Roaming (I haven't before seen a 4th folder at this level).
  • I typically have the "Owner" column showing in WinExp, this file does not have an Owner. (The parent directory has "Manager1" as the
    Owner, as expected).
  • As part of the Roaming Profile, this file was copied back to the server, so this may explain why the file exists on 2 workstations. I
    can not delete the file on the server!
  • Trying to get an idea of what created this directory\file(s) in the first place. There are 2 other files in this odd directory, appearing to be temporary files, it appears I can delete them easy enough:
    • ~WRS{4857159A-7397-4DAD-AC26-BAF9D7AFC830}.tmp
    • msoF57A.tmp

All the tricks I know have failed:

  • delete the file through the C: drive network share, WinExp and CmdPrompt.
  • delete the file locally, logged in as an Administrator, WinExp and CmdPrompt.
  • delete the parent directory, and all sub-files (rmdir /s).
  • rename the file, using both wildcard rename and specific name.

Typical CmdPrompt message: "The system cannot find the file specified."

Wowsa, weird, especially not being able to delete from the romaing profile on the server.
Any ideas?

Best Answer

It turns out I was pointed at the answer in a post I found over on Stack Overflow:

How to delete a folder that name ended with a dot(“.”)

Command:

del "\\?\C:\Users\Manager1\AppData\OICE_15_974FA576_32C1D314_1A3\130544A4."

(now if only I understood the difference between Super User and Stack Overflow, you'd think someone with 35+ years of computer experience could figure it out)

Related Question