You may also need to kill the Internet Explore process and change the attributes of the directory, and donโt think that this will work for Index.dat files, as MS continues to change the rules.
What is my name for code that also deletes Firefox files and flash shared objects
using System;
using System.Collections.Generic;
using System.IO;
using System.Diagnostics;
using System.Text;
namespace Fidling
{
public static class SpywareRemoval
{
private static void RemoveSpywareFiles(string RootPath, string Path,bool Recursive)
{
string FullPath = RootPath + Path + "\\";
if (Directory.Exists(FullPath))
{
DirectoryInfo DInfo = new DirectoryInfo(FullPath);
FileAttributes Attr = DInfo.Attributes;
DInfo.Attributes = FileAttributes.Normal;
foreach (string FileName in Directory.GetFiles(FullPath))
{
RemoveSpywareFile(FileName);
}
if (Recursive)
{
foreach (string DirName in Directory.GetDirectories(FullPath))
{
RemoveSpywareFiles("", DirName, true);
try { Directory.Delete(DirName); }catch { }
}
}
DInfo.Attributes = Attr;
}
}
private static void RemoveSpywareFile(string FileName)
{
if (File.Exists(FileName))
{
try { File.Delete(FileName); }catch { }
}
}
private static void DeleteFireFoxFiles(string FireFoxPath)
{
RemoveSpywareFile(FireFoxPath + "cookies.sqlite");
RemoveSpywareFile(FireFoxPath + "content-prefs.sqlite");
RemoveSpywareFile(FireFoxPath + "downloads.sqlite");
RemoveSpywareFile(FireFoxPath + "formhistory.sqlite");
RemoveSpywareFile(FireFoxPath + "search.sqlite");
RemoveSpywareFile(FireFoxPath + "signons.sqlite");
RemoveSpywareFile(FireFoxPath + "search.json");
RemoveSpywareFile(FireFoxPath + "permissions.sqlite");
}
public static void RunCleanup()
{
try { KillProcess("iexplore"); }
catch { }
try { KillProcess("FireFox"); }
catch { }
string RootPath = Environment.GetFolderPath(Environment.SpecialFolder.Personal).ToLower().Replace("documents", "");
RemoveSpywareFiles(RootPath, @"AppData\Roaming\Macromedia\Flash Player\#SharedObjects",false);
RemoveSpywareFiles(RootPath, @"AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local", false);
RemoveSpywareFiles(RootPath, @"AppData\Local\Temporary Internet Files", false);
RemoveSpywareFiles("", Environment.GetFolderPath(Environment.SpecialFolder.Cookies), true);
RemoveSpywareFiles("", Environment.GetFolderPath(Environment.SpecialFolder.InternetCache), true);
RemoveSpywareFiles("", Environment.GetFolderPath(Environment.SpecialFolder.History), true);
RemoveSpywareFiles(RootPath, @"AppData\Local\Microsoft\Windows\Wer", true);
RemoveSpywareFiles(RootPath, @"AppData\Local\Microsoft\Windows\Caches", false);
RemoveSpywareFiles(RootPath, @"AppData\Local\Microsoft\WebsiteCache", false);
RemoveSpywareFiles(RootPath, @"AppData\Local\Temp", false);
RemoveSpywareFiles(RootPath, @"AppData\LocalLow\Microsoft\CryptnetUrlCache", false);
RemoveSpywareFiles(RootPath, @"AppData\LocalLow\Apple Computer\QuickTime\downloads", false);
RemoveSpywareFiles(RootPath, @"AppData\Local\Mozilla\Firefox\Profiles", false);
RemoveSpywareFiles(RootPath, @"AppData\Roaming\Microsoft\Office\Recent", false);
RemoveSpywareFiles(RootPath, @"AppData\Roaming\Adobe\Flash Player\AssetCache", false);
if (Directory.Exists(RootPath + @"\AppData\Roaming\Mozilla\Firefox\Profiles"))
{
string FireFoxPath = RootPath + @"AppData\Roaming\Mozilla\Firefox\Profiles\";
DeleteFireFoxFiles(FireFoxPath);
foreach (string SubPath in Directory.GetDirectories(FireFoxPath))
{
DeleteFireFoxFiles(SubPath + "\\");
}
}
}
private static void KillProcess(string ProcessName)
{
ProcessName = ProcessName.ToLower();
foreach (Process P in Process.GetProcesses())
{
if (P.ProcessName.ToLower().StartsWith(ProcessName))
P.Kill();
}
}
}
}
Flash source
share