cmd > attrib - Unable to change attribute

2

I'm following this tutorial because I'm having problems with the Task Scheduler service:
http://technicallyeasy.net/2010/10/how-to-fix-keyset-does-not-exist-for-scheduled-tasks-in-windows/

Basically (in case the link dies), it says that you should go to C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 and delete everything that's in there.

Here's the problem I'm having - there is a single file, marked as hidden, system and read-only. The file name is "d42cc0c3858a58db2db37658219e6400_46884bcb-8fba-461e-a2ee-e996218ba78a".
When I try to delete it, I get the following message:
Cannot delete X : Make sure you specifiy the correct path

The file is definitely there, as I can browse to it via Windows Explorer. I assumed that the problem is the "system" attribute. I ran
attrib -s "path\to\the\file"

and the output:
Unable to change attribute - "path\to\the\file"

When I try to remove the hidden or read-only attributes instead, I get:
Not resetting system file - "path\to\the\file"

Once again, this is a file, not a folder.
Any ideas greatly appreciated!

PS: OS is Windows Server 2003 r2 x64

kalatabe

Posted 2013-05-27T09:40:35.517

Reputation: 121

Have you tried LockHunter to delete the file? http://lockhunter.com/

– Sun – 2016-05-25T15:37:44.880

Did you try "attrib -s -h <file>" or "attrib -s -h -r <file>"? What is the output of "cacls <file>" (do you have enough rights on the file)? – Werner Henze – 2013-05-27T11:21:43.410

"attrib -s -h <file>" or "attrib -s -h -r <file>" both produce the second error "Not resetting system file". I am certain that the account we're using has enough privileges to perform the operation. I have no idea what else may be wrong.. – kalatabe – 2013-05-27T13:07:47.790

1"I am certain that the account we're using has enough privileges to perform the operation." I am not. Therefore I asked for cacls output. – Werner Henze – 2013-05-27T13:27:32.023

Answers

-1

Attrib is giving me some problems today too. What I would try is rd S-1-5-18 /s from a command prompt in C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA. Put the folder back if this works. There is the "take ownership" option - from the right click menu. Otherwise that file is in use and needs to be released by whatever .exe is using it. The path and file name don't exceed 256 so something is using it or windows is just mad at you.

user443117

Posted 2013-05-27T09:40:35.517

Reputation: 1

1Can you give more details about the file you linked to? While VirusTotal says it's not malware, bare links of this kind can be seen as suspicious. – bwDraco – 2015-05-01T21:27:05.267