0

I am using dual operating system on a single machine- windows and ubuntu. There is a folder in windows C:\ProgramData\Folder_name which seems to be a virus to me, as it does not get deleted whenever I try to. Also, it comes up again and again even if I try to delete it.

I tried to delete it from ubuntu. and this worked hopefully!!! But today, I got again the same folder at same location. I again tried to delete it from ubuntu, using

user@user$sudo su
root@user$rm -f /location/to/folder
rm: cannot remove `/location/to/folder': Is a directory
root@user$sudo umount /location/to/folder
umount: /location/to/folder: not mounted
root@user$rm -r /location/to/folder
rm: cannot remove `/location/to/folder': Directory not empty
root@user$ls -a /location/to/folder
ls: reading directory /location/to/folder: Input/output error

So, I tried unmounting it, which says it is not mounted. I tried rm which says it is directory. Can anybody help me please?

EDIT: here is the output with ls -la command when not inside that directory, going inside the directory and executing ls -la command gives the input/output error.

drwx------ 1 ashutosh ashutosh  8192 Apr  2 01:01 .
drwx------ 1 ashutosh ashutosh 24576 Apr  1 23:15 ..
drwx------ 1 ashutosh ashutosh     0 Feb 20 22:00 Adobe
lrwxrwxrwx 2 ashutosh ashutosh    84 Jul 14  2009 Application Data -> /media/10DC42B6DC42963E/ProgramData
drwx------ 1 ashutosh ashutosh     0 Jan 27 02:55 ATI
drwx------ 1 ashutosh ashutosh     0 Mar 20 14:40 Avangardo
drwx------ 1 ashutosh ashutosh     0 Feb 19 02:35 Connectify
drwx------ 1 ashutosh ashutosh     0 Feb 18 02:32 DAEMON Tools Lite
drwx------ 1 ashutosh ashutosh  4096 Apr  2 01:01 DC48CCC40D3C963E0000DC47F0809ABC
lrwxrwxrwx 1 ashutosh ashutosh   120 Jul 14  2009 Desktop -> /media/10DC42B6DC42963E/Users/Public/Desktop
lrwxrwxrwx 2 ashutosh ashutosh   128 Jul 14  2009 Documents -> /media/10DC42B6DC42963E/Users/Public/Documents
drwx------ 1 ashutosh ashutosh  4096 Mar  9 20:40 EPS
lrwxrwxrwx 2 ashutosh ashutosh   128 Jul 14  2009 Favorites -> /media/10DC42B6DC42963E/Users/Public/Favorites
drwx------ 1 ashutosh ashutosh  8192 Mar 13 02:26 Microsoft
drwx------ 1 ashutosh ashutosh  8192 Feb 18 02:35 Microsoft Help
-rw------- 1 ashutosh ashutosh   434 Feb  3 17:49 ntuser.pol
drwx------ 1 ashutosh ashutosh 32768 Feb 18 02:51 Package Cache
drwx------ 1 ashutosh ashutosh     0 Feb 18 03:19 PreEmptive Solutions
drwx------ 1 ashutosh ashutosh     0 Feb 18 02:48 regid.1991-06.com.microsoft
drwx------ 1 ashutosh ashutosh     0 Feb 10 14:44 Samsung
drwx------ 1 ashutosh ashutosh     0 Mar 19 12:05 Skype
lrwxrwxrwx 2 ashutosh ashutosh   200 Jul 14  2009 Start Menu -> /media/10DC42B6DC42963E/ProgramData/Microsoft/Windows/Start Menu
drwx------ 1 ashutosh ashutosh     0 Jan 29 23:28 Sun
drwx------ 1 ashutosh ashutosh     0 Mar 21 03:35 TEMP
lrwxrwxrwx 2 ashutosh ashutosh   196 Jul 14  2009 Templates -> /media/10DC42B6DC42963E/ProgramData/Microsoft/Windows/Templates
drwx------ 1 ashutosh ashutosh  4096 Feb 18 03:21 Windows App Certification Kit
5
  • I would check the windows partition for errors. Log in Windows and check the drive for errors. If none are found, then the problem is still open but at least you know if it is not a disk error.
    – To Do
    Apr 1, 2013 at 21:11
  • 1
    I would say that is is a partition or hardware issue. However, check your filesystem first with ?chkdisk? (not a windows guy), then try removing it from "safe mode" or some kind of PXE setup. Linux NTFS support is ...flaky... at best. It gets us by but is far from perfect. It does not do very well with unusual issues. Also the partition needs to be mounted so stop trying to unmount it. Also check dmesg and /var/log/message for hints.
    – coteyr
    Apr 1, 2013 at 23:24
  • yeah, chkdsk do the job. I started chkdsk which told me about offset errors on the disk.I started again the windows in safe mode and the folder was not there. Got it deleted. But how did this happed, that still is a point. It was malware as I found out later
    – ashutosh
    Apr 2, 2013 at 18:34
  • @coteyr: Can you please convert your comment to an answer, as it apparently contains the solution to the issue in the question. Dec 19, 2015 at 23:02
  • @coteyr i was unmounting just to make sure the directory is mounted.
    – ashutosh
    Dec 21, 2015 at 11:06

2 Answers 2

1

Thanks to coteyr's comment, chkdsk did the job. chkdsk reported offset errors on the disk.I started windows in safe mode and the folder was deleted already. It was actually a malware which created some illegal offest on disk, thus showing directory which it wasn't.

0

you need to make rm -rf as this is a directory and it is not empty. See man rm for more help on this command.

4
  • I tried that already, but same error pops up
    – ashutosh
    Apr 1, 2013 at 19:58
  • unmounting the volume is the wrong way for sure though. The drive has to be mounted in order to access the files. Are there any hidden files? What gives ls -la and is this an NTFS drive?
    – onse
    Apr 1, 2013 at 20:02
  • I have updated my answer and yes it is an NTFS drive, the folder nane is DC48CCC40D3C963E0000DC47F0809ABC which is causing problem. looks like a hardware issue to me
    – ashutosh
    Apr 1, 2013 at 20:07
  • 1
    Maybe there's some corruption? Have you tried CHKDSK C: /f? (I'm not quite sure if this is the correct syntax though; haven't used Windows in a while)
    – onse
    Apr 2, 2013 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .