help cannot delete a file

If all else fails, backup the partition/drive and fdisk it and start clean from scratch.
What was the sector (hex) editor that Norton used to have? You could low-level change the first letter in an fname to ? on any file and effectively delete it.
 
How did you solve this in the end?

A colleague of mine just had a similar problem but he could solve it with a program called FileAccess
 
it was very strange
i couldnt chage permissions for it
but after i ran accesschk
http://technet.microsoft.com/en-us/sysinternals/25e27bed-b251-4af4-b30a-c2a2a93a80d9.aspx
or cacls
http://www.ss64.com/nt/cacls.html
(cant remember exactly)

i could

the owner of the file was listed as owner/creator (appears to be vista install program)

TrustedInstaller SID

In the Windows Server® 2008 and Windows Vista® operating systems, most of the operating system files are owned by the TrustedInstaller security identifier (SID), which is the only SID that has full control over them. The purpose is to prevent a process that is running as an administrator or under the LocalSystem account from automatically replacing the operating system files. To delete an operating system file, you need to take ownership of the file and then add an access control entry (ACE) on the file that permits you to delete it. This helps protect against a process that is running as LocalSystem and has a System integrity label; a process that has lower integrity should not be able to elevate itself to change ownership. Some services, for instance, can run with medium integrity, even though they are running as LocalSystem. Such services cannot replace system files, thereby preventing an exploit that takes over a service from replacing operating system files.
 
Last edited by a moderator:
Back
Top