Delete File on Reboot

[HiJackThis1.99]

XP User.
---
Would anyone care to please tell me how to manually delete a file on reboot. Yes, I know there are programs, like HiJackThis, that do it. But I wanted to know how you make such a command yourself.

 

[Peddant]

An example of a batch file to delete "toolbar.dll" on boot.

Open Notepad and enter -

del "C:\Program Files\Toolbar\toolbar.dll"

The quotes are important in that example.

Save it with a .bat extension,then copy it into the start up folder
in Windows Explorer.

Substitute the file path for the file you want to delete,obviously

 

[HiJackThis1.99]

Save it with a .bat extension,then copy it into the start up folder
in Windows Explorer.

Which folder is that?
C:\WINDOWS\system32\

Can you explain what .bat files are? I have seen people use them to avoid viruses.

Thank you again Peddant, you are awesome with computers.

 

[Spike]

I think what you are looking to do is schedule a file to be deleted on reboot from the command line?

As it happens, I had a similar problem a little while ago, which was solved by finding this...

http://www.diamondcs.com.au/index.php?page=dellater

It also has assembler source code with it, should you wish to modify it in some way as I did (I wanted to get rid of the alert box that announced success).

3kb in size, and does exactly as it says on the tin, using the MoveFileEX() API call

The thing is, the batchfile idea doesn't always work. It depends on which file you're looking to delete. Some of them load in at such time as before logon scripts or startup programs are run.

 

[Peddant]

Which folder is that?
C:\WINDOWS\system32\

If you mean the start up folder C:\Documents and Settings\USERNAME\Start Menu\Programs\Startup".

Can you explain what .bat files are? I have seen people use them to avoid viruses.

From the dictionary -

A file that contains a sequence, or batch, of commands. Batch files are useful for storing sets of commands that are always executed together because you can simply enter the name of the batch file instead of entering each command individually.

Thank you again Peddant, you are awesome with computers.

I`m awesome with google, not computers

 

[HiJackThis1.99]

See I want to delete a file called,
"winlogon.exe"
if you kill task you get BsOd. Once the machine restarts it goes away.
But, the problem is there is no way to delete winlogon.exe everything I tried.


Note: I am doing this on a computer that needs to have XP reinstalled anyways soon, so it does not hurt to try having some evil fun.

 

[Peddant]

If that file is in C:\Windows\System32 then it is a Windows system file,and if youy try to delete it will get a freeze or a BSOD.

If it`s not in the system32 it`s a trojan.Try Killbox or MoveOnboot or the one Spike referenced.

 

[Spike]

The one I mentioned is a command line tool. Just drop it in the windows folder, open a command line, and type "dellater c:\directory\file.ext" and that's it - file is scheduled for deletion on reboot.

Do that with athe genuine winlogon.exe though, and you'll completely screw it up (and I mean completly! You'd have to use a livecd such as bart pe to replace the file)

 

[HiJackThis1.99]

Spike, not able to fully through. Can you give detailed steps to how to delete "winlogon".

 

[Spike]

You can't delete winlogon. If you do it will render your system completely useless.

If you download the command line tool dellater from the link I gave, place it in your c:\windows folder, then go to start->run-> and type "dellater C:\WINDOWS\system32\winlogon.exe" (without the quotes - or you could do it from a cmd window) and hit enter. File should then be scheduled for deletion on reboot.

I warn you though, if it does get deleted, you'll be sorry unless you know how to repair it. Winlogon.exe is an essential system file. Are you trying to remove something running under winlogon? If so, deleting winlogon itself is going about it in completely the wrong way.

 

[HiJackThis1.99]

That is exactly what I am trying to do. I have a computer which I do not need. And I want to have some fun before I throw it away.

But, my question still remains. That program, is a program. My question was without using any programs at all. Like Peddant said, using a batch file. But that batch file would not delete winlogon.

 

[Peddant]

But that batch file would not delete winlogon.

It`s a system file !!!!! Windows will keep trying to replace it,for as long as you try to delete it.Now see HERE

You must have more exciting things to do with your life

 

[Spike]

It can't be done without calling the "moveFileEx()" API, as WinLogon is one of those files that's executed right at the beginning of the startup sequence. The only real way to call said API is through programming or scripting in a high level language - and even that might not be called early enough.

It's not a program as such though. It's a simple command line utility of the type that can be found natively in the windows and system32 folders anyway. Really, it won't get any simpler, easier, or closer to "not using a program" than that - a short little 3KB script in assembler, aessmbled into an executable single purpose utility.

If you wanted to, you could take the assembler code, assemble it yourself with the assembler it was written for, and then use it, upon which time, appart from the assembler programming, you could say you'd done it from scratch. Even batch files use such programs as the one I gave you - they come pre-installed in XP.

I can think of better experiments than deleting winlogon.exe though.

 

[HiJackThis1.99]

I can think of better experiments than deleting winlogon.exe though

Like what

 

[Spike]

Well, there's all manner of registry hacks.

You could manually change your bootloader or hack the resources of explorer.exe

you could see if it floats.

All would yield potentially far more unexpected results than deleting winlogon.

Really just use your imagination. Maybe infect it with something like aurora and try to clean it up yourself manualy, devise some interesting practical jokes, try hacking into it and gaining admin control from a remote machine... whatever really.

It's your machine, it's your time, and it's your work to reformat it - your choice.