INCLUDE_DATA

Posts Tagged ‘file’

Deleting Files

Monday, September 1st, 2008

Yesterday, I read at Hacking Truths, an article entitled Delete an “UnDeletable” File. I largely disagree with the post and am thus making a post on how to delete most “undeletable” files on Windows systems.

Die, file, DIE!!!

Access Denied
Cannot delete file: Cannot read from soruce file or disk
There has been a sharing violation
The source or desination file may be in use
The file is in use by another program or user
Make sure the disk is not full or write-protected and that the file is not currently in use

Usually, these error messages occur when another process is accessing the file, with or without you knowing it. However, Windows does have its false-detection times. Below are some methods that may assist you -

1. AUTOEXEC.BAT is your best friend

Windows, by default, includes a file called AUTOEXEC.BAT in your Windows root drive (C:\ by default). The .BAT extension refers to a MSDOS batch file and the file is executed right before a user logs on. In prior versions of Windows (Windows 95, Windows 98, Windows ME) executed AUTOEXEC.BAT right after Windows has booted up and CONFIG.SYS loaded. It is usually used to set environment variables and initiate drivers. This means that the file is run before any process starts.

Simply edit your AUTOEXEC.BAT file and include, on the first line -

del /s/f/q [Drive]:\[Folder]\[File].[Extension]

For example,

del /s/f/q C:\Unwanted\File.doc

Save it and restart your computer afterwards.

2. Processed misery

If you don’t feel like restarting your computer, you can, of course, attempt to identify the source of your misery and terminate it. ;)

Enabler is a tool whereby all processes running in the background are shown. It detects all dialogs/windows that are displayed and hidden and allows you to terminate them. If you have good idea of what process is causing your file to be “undeletable”, this might be your solution.

Unlocker is a tool which “unlocks” a file and avails it for deletion.  It is much more detailed and suited for file deletion than Enabler, showing you all the processes that are currently using your file, then allowing you to delete the file and even unload a DLL. Highly recommended!

Of course, if the above two methods are too elaborated for your liking, there’s always the Windows Task Manager and the option of ending explorer.exe. That might work for you too. :)

3. Being attached is tricky

This is something which I have learnt in my experiences of dealing with viruses and their un-terminate-able status. Apparently, processes can be “attached” to another. This particular virus I was trying to get rid of was attached to winlogon.exe, a SYSTEM process which cannot be terminated.

To solve this, use Process Explorer from Winternals (Microsoft). You can suspend the process in question, detatch the malicious bugger, terminate it and resume the process afterwards. Nifty, eh?