Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

How to Create and Enter the nameless folder

- - - - -

  • Please log in to reply
16 replies to this topic

#1
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag

I’ve two nameless folders (created by virus in Flash Drive). I tried to find out the name with dir /x. One shows short name but another one shows nothing (Attached Screenshot). How to find out the actual name or enter to this folder? How to create nameless folder with batch? 

 

Attached File  Nameless_Folder_1.png   9.66KB   1 downloads

 

Attached File  Nameless_Folder_2.png   11.32KB   1 downloads




How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,824 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Try what 7-zip sees, only seemingly unrelated, JFYI:

http://www.msfn.org/...can-be-omitted/

 

jaclaz


  • kali likes this

#3
Tripredacus

Tripredacus

    K-Mart-ian Legend

  • Super Moderator
  • 10,009 posts
  • Joined 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Donator

My first guess is that the folder's name is the delete character, ALT+255. In Windows 98, you could create a folder with the delete and only be able to access it from the command prompt. Trying to enter it from Explorer would result in a "folder does not exist" message. Explorer starting with XP has been able to enter a folder with this name... so if that is the case you should be able to get to it. Do you get an error when you try to open it from Explorer?


MSFN RULES | GimageX HTA for PE 3-5 | lol probloms
tpxmsfn1_zps393339c1.jpg

#4
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag

Try what 7-zip sees, only seemingly unrelated, JFYI:

http://www.msfn.org/...can-be-omitted/

 

jaclaz

 

Useful link. But no direction for entering into nameless directory (my screenshot).

Attached File  Nameless_Folder_3.png   8.4KB   1 downloads

 

I want this to find and delete some specific files from a directory and it’s subdirectory (including nameless directory). Is there any way to delete all exe and inf file from a directory and it’s subdirectory? For example I want to delete all exe and inf extension files from my D: drive (from it’s directory and it’s subdirectory). For your kind attraction a clue here. (for /f %%i in ('"dir /s /b /ad "%temp%"" 2^>nul') do RD /S /Q %%i 1>nul 2>nul)

 

I tried like below. 

for /f %%i in ('"dir /s /b /ad "d:"" 2^>nul') do del *.lnk *.exe /f /q %%i 1>nul 2>nul

 

I attached a test folder to try.Attached File  Test.zip   12.01KB   3 downloads



#5
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag

My first guess is that the folder's name is the delete character, ALT+255. In Windows 98, you could create a folder with the delete and only be able to access it from the command prompt. Trying to enter it from Explorer would result in a "folder does not exist" message. Explorer starting with XP has been able to enter a folder with this name... so if that is the case you should be able to get to it. Do you get an error when you try to open it from Explorer?

 

I tried with windows 8.1 and 7. I don't get any error massage. I attached the folder as a test folder to try.



#6
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,824 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
Whatever you attached does open fine in 7-zip (as expected).
 
The contents of the zip extracted to a temporary disk image mounted as drive K: \ show here (XP SP2):
 

K:\>dir /b/s
K:\Test
K:\Test\Nameless
K:\Test\á
K:\Test\Nameless\Exe.lnk
K:\Test\Nameless\Wise Disk Cleaner.lnk
K:\Test\Nameless\á
K:\Test\Nameless\á\a
K:\Test\Nameless\á\b
K:\Test\Nameless\á\Exe.lnk
K:\Test\Nameless\á\New Microsoft Word Document.doc
K:\Test\Nameless\á\New Text Document.exe
K:\Test\Nameless\á\Wise Disk Cleaner.lnk
K:\Test\Nameless\á\a\exe.lnk
K:\Test\Nameless\á\a\Wise Disk Cleaner.lnk
K:\Test\Nameless\á\b\1
K:\Test\Nameless\á\b\Exe.lnk
K:\Test\Nameless\á\b\New Text Document.exe
K:\Test\Nameless\á\b\Wise Disk Cleaner.lnk
K:\Test\Nameless\á\b\1\Exe.lnk
K:\Test\Nameless\ \b\1\New Text Document.exe
K:\Test\Nameless\ \b\1\Wise Disk Cleaner.lnk
K:\Test\ \New Text Document.exe

  and also it opens in my Explorer (though listed as "blank")
 The "á" is ALT+160 (am I allowed to say "as expected" :unsure: ?), it is displayed fine in my command window (possibly because of some codepage/font/whatever).

But you cannot select/copy/paste to (say) Notepad, as the "á" becomes a "blank".
 
It is very possible that there is simply NO way to "enter" into that folder from command line/batch, unless you manipulate directly the filesystem structures or you use an alternate program/shell/command processor, BUT double quotes may help:

K:\>dir "K:\test\á"
Il volume nell'unità K non ha etichetta.
Numero di serie del volume: FCAB-B3B8

Directory di K:\test\á

12/12/2014 17.28 <DIR> .
12/12/2014 17.28 <DIR> ..
12/12/2014 16.58 0 New Text Document.exe
1 File 0 byte
2 Directory 1.424.896 byte disponibili

i.e. this *almost* works:

@ECHO OFF
@FOR /F "tokens=*" %%A IN ('dir /B/S/AD') DO (
ECHO "%%A"
DIR /B/A-D "%%A"
)


jaclaz

#7
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag

Whatever you attached does open fine in 7-zip (as expected).
 
The contents of the zip extracted to a temporary disk image mounted as drive K: \ show here (XP SP2):
  and also it opens in my Explorer (though listed as "blank")

 The "á" is ALT+160 (am I allowed to say "as expected" :unsure: ?), it is displayed fine in my command window (possibly because of some codepage/font/whatever).

But you cannot select/copy/paste to (say) Notepad, as the "á" becomes a "blank".
 
It is very possible that there is simply NO way to "enter" into that folder from command line/batch, unless you manipulate directly the filesystem structures or you use an alternate program/shell/command processor, BUT double quotes may help

@ECHO OFF
@FOR /F "tokens=*" %%A IN ('dir /B/S/AD') DO (
ECHO "%%A"
DIR /B/A-D "%%A"
)


jaclaz

 

 

I tested in XP. Your command above shows the file index correctly. That means name of nameless folder can be varied depending on OS version. So how can I delete  *.lnk, *.exe file or a folder (new folder) from a directory and it’s subdirectory (including nameless directory)? I tried your command slightly changing. Is it OK?

 

@ECHO OFF

set file=*.lnk *.exe

@FOR /F "tokens=*" %%A IN ('dir /B/S %file% 2^>nul') DO (

del /f /q "%%A"

RD “new folder” /S /Q "%%A"

)



#8
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,824 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

No. :no:

The DEL command should work but it uncnditionally removes ALL .exe and .lnk files from current directory and all it's subfolders :w00t: a teeny/tiny error (like running it from another drive/path) and you could create havoc on a system :ph34r: .

The RD one cannot, and it is potentially dangerous with the /S switch:

http://ss64.com/nt/rd.html

 

Try posting the output of your actual directory structure and explain what exactly you need to do (or if the "test" you posted is OK, post how that structure should be changed after running the batch).

 

 

jaclaz



#9
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag

No. :no:

The DEL command should work but it uncnditionally removes ALL .exe and .lnk files from current directory and all it's subfolders :w00t: a teeny/tiny error (like running it from another drive/path) and you could create havoc on a system :ph34r: .

The RD one cannot, and it is potentially dangerous with the /S switch:

http://ss64.com/nt/rd.html

 

Try posting the output of your actual directory structure and explain what exactly you need to do (or if the "test" you posted is OK, post how that structure should be changed after running the batch).

 

 

jaclaz

 

I got some virus affected Laptop from my friends. When Flash drive plugins, virus copies all the files and folders of flash drive into a folder and renames the folder as nameless and also makes the folder hidden. Then virus creates some shortcut and exe file matching with original file and folder name. User only can see the shortcut and exe. New user can’t understand the matter and tries double click. Surprise is that Avast can’t detect the virus. MS Defender removes as threat but original file folder remains hidden. So I made a batch file on the desktop with the following command.

 

@echo off

title Clean USB

echo.

echo.

set /p Letter= Enter your Flash drive/USB Drive Letter here:

%Letter%:

cls

echo.

echo.

ECHO Please wait...

ECHO Windows is Cleaning Virus from your Flash drive.

attrib -h -s -a -r  *.* /s /d

del *.exe /f /q

del *.lnk /f /q

del *.vbs /f /q

del *.inf /f /q

del *.cmd /f /q

del *.bat /f /q

rd Recycler /S /Q

RD /S /Q RECYCLER

exit

 

The batch removes all the shortcut and exe files from target drive (flash drive) and makes the hidden folder (nameless folder) visible. But I found same shortcut and exe files, recycler folder in the nameless folder (also in the sub directory). So I need modify my command above to remove shortcut and exe files, recycler folder from flash drive and also from subdirectory. I think your command (modified by me) below is working (I tested) for the shortcut and exe files but recycler folder. I need the batch for both files and folders.

 

@echo off

title Clean USB

echo.

echo.

set /p Letter= Enter your Pendrive/USB Drive Letter here:

%Letter%:

set file=*.lnk *.exe *.inf *.vbs *.cmd *.bat

@FOR /F "tokens=*" %%A IN ('dir /B/S %file% 2^>nul') DO (

del /f /q "%%A" 1>nul 2>nul

rd Recycler /S /Q "%%A" 1>nul 2>nul

)

exit



#10
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,824 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Yes, but you cannot "invent" syntax.

RD is used:
http://ss64.com/nt/rd.html
wit this syntax:
 

Syntax
RD pathname
RD /S pathname
RD /S /Q pathname

 
Your line is:

rd Recycler /S /Q "%%A"

or:
 
 

RD <a folder name that SHOULD NOT be here> /S /Q <a full path to a file that makes NO SENSE as it is NOT a directory>

 

 

So, you want something more *like*

REM rd Recycler /S /Q "%%A" 1>nul 2>nul

ECHO RD /S/Q "%%~dpA" | FIND /i "Recycler"

 

 

but your batch as is represents more generally (in my perverted mind) a reckless, dangerous and potentially destructive tool :ph34r:, and you should IMHO restart from scratch, adding each and every possible check (+1) to make sure that it CANNOT be run on anything else but a such infected USB stick and that it will ONLY delete the files and folders added by the "virus" in that (those) nameless folders.

 

What I am trying to tell you is that - no offence intended :) - your current approach is way too aggressive and it can potentially destroy the "good" contents of a USB stick or even of an internal disk volume in the hands of a "new user" and that you should rethink the thingy making it - within limits - as foolproof as possible.

 

 

jaclaz.


  • kali likes this

#11
Yzöwl

Yzöwl

    Wise Owl

  • Super Moderator
  • 4,573 posts
  • Joined 13-October 04
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

jaclaz is correct, reckless is a fair assessment of what you are intending to do.

 

If you are going to delete most of the executable files from my pen drive then you may as well have just formatted the thing because apart from a few pictures there'd be very little left worth keeping!


  • kali likes this

#12
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag

but your batch as is represents more generally (in my perverted mind) a reckless, dangerous and potentially destructive tool :ph34r:, and you should IMHO restart from scratch, adding each and every possible check (+1) to make sure that it CANNOT be run on anything else but a such infected USB stick and that it will ONLY delete the files and folders added by the "virus" in that (those) nameless folders.

 

What I am trying to tell you is that - no offence intended :) - your current approach is way too aggressive and it can potentially destroy the "good" contents of a USB stick or even of an internal disk volume in the hands of a "new user" and that you should rethink the thingy making it - within limits - as foolproof as possible.

 

 

jaclaz.

 

Good instruction. Yes, It’s right that it may harm if we use the batch in another place. We generally put class tutorial (Office file, pdf, audio, video, Image) in our flash drive and share it with each other. We are aware about exe, inf, vbs, reg, cmd and can delete these files. So can I use the command bellow and will it work perfectly (for directory and subdirectory)?

 

@echo off
title Clean USB
echo.
echo.
set /p Letter= Enter your Pendrive/USB Drive Letter here:
%Letter%:
set file=*.lnk *.exe *.inf *.vbs *.cmd *.bat
@FOR /F "tokens=*" %%A IN ('dir /B/S %file% 2^>nul') DO (
del /f /q "%%A" 1>nul 2>nul
)
exit

 

2 of my foolish questions: Answer pleas.

  1. What is the deference between dir /B /S /AD and dir /B/S/AD, RD /S/Q and RD /S /Q, 2^>nul and 2>nul ? (space and "^" sign).
  2. No way to rename nameless folder with batch?


#13
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,824 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

1. The intended separator for switches on these command line tools is "/" (forward slash), for all the command interpreter knows there is NO difference between:
dir /B /S /AD 
and:
dir /B/S/AD 
 
2. Why not?



@ECHO OFF
SETLOCAL ENABLEEXTENSIONS
@FOR /F "tokens=*" %%A IN ('dir /B/S/AD') DO (
CALL :do_ren "%%A"
)
GOTO :EOF

:do_ren
SET nameless=%1
SET nameless=%nameless:~-2,1%
REM The character> <below is created by typing ALT+0160
IF "%nameless%"==" " ECHO Nameless is found:&& ECHO REN %1 MickeyMouse
REM The character> <above is created by typing ALT+0160
GOTO :EOF

jaclaz


Edited by jaclaz, 14 December 2014 - 01:16 PM.


#14
Yzöwl

Yzöwl

    Wise Owl

  • Super Moderator
  • 4,573 posts
  • Joined 13-October 04
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

kali, you need to understand that you will not get any responsible Member here to condone what you intend to do.

 

If the problem is with a 'nameless' directory and its content, then that is all any responsible code should be targeting; not the device containing that directory.



#15
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,824 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

kali, you need to understand that you will not get any responsible Member here to condone what you intend to do.
 
If the problem is with a 'nameless' directory and its content, then that is all any responsible code should be targeting; not the device containing that directory.

Well said :thumbup , and I would add that allowing a "new user" to type *any* drive letter (actually *anything* as there is NO input control of any kind) at the SET /P prompt may result, besides likely breaking the batch execution, in targeting ANOTHER device, where each and every *.lnk *.exe *.inf *.vbs *.cmd *.bat will be deleted :ph34r:.
You need to be d@mn sure that the user cannot enter anything but a drive letter, actually anything but a drive letter related to a USB stick, and check (and double check) that the nameless directory(ies) exist on that drive BEFORE EVEN THINKING of deleting (or renaming) ANYTHING.

 

In this sense the last snippet I posted is much safer, in the sense that it will only rename the directory(ies) which name is only "ALT+0160", and in any case a "wrong rename" is usually easier to revert than undeleting tens, huindreds or thousands of files.

 

jaclaz

 

P.S. And now, for NO apparent reason, marriedtothesea :w00t:

Spoiler
http://www.marriedto...-what-i-get.gif

 

P.S.: Oneliner:

@ECHO OFF&FOR /F "tokens=*" %%A IN ('dir /B/S/AD ^|FIND "\ " ^|FIND /V "\ \"') DO ECHO Nameless is found:&& ECHO REN "%%A" MickeyMouse

Edited by jaclaz, 14 December 2014 - 01:33 PM.


#16
Yzöwl

Yzöwl

    Wise Owl

  • Super Moderator
  • 4,573 posts
  • Joined 13-October 04
  • OS:Windows 7 x64
  • Country: Country Flag

Donator

Another possible one liner: (Untested - This may name the offending folder to HexA0)

ForFiles /C "Cmd /C If @IsDir==TRUE (If @File==0x220xA00x22 Ren @File HexA0)"

It may in your case not even need to check whether or not it is a directory:

ForFiles /C "Cmd /C If @File==0x220xA00x22 Ren @File HexA0"

Or to remove the offending directory:

ForFiles /C "Cmd /C If @IsDir==TRUE (If @File==0x220xA00x22 RD/S/Q @File)"


#17
kali

kali

    KamrulCox

  • Member
  • PipPip
  • 111 posts
  • Joined 17-April 11
  • OS:Windows 8.1 x64
  • Country: Country Flag
Thanks a lot for the great advice jaclaz and Yzöwl
 
You are a man of deep talent as well as helpful, jaclaz




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users