4

I can't delete C:\Config.Msi\75ce84f.rbf.

  • it's not readonly, system or hidden
  • it's not in use by another process (according to Process Explorer)
  • the NT security permissions aren't the problem either - I am the owner and have Full Control ; as a double-check, the Effective Permissions tab shows that I have permission to delete.

Yet trying to delete the file gives "Access is Denied" from both Explorer and cmd. I can however rename it or move it to another folder on the same drive. I can also read it and Virustotal says it's clean which is what I would expect (it's just a Windows Installer temp file - a copy of some DLL I think). The relevant line from Process Monitor is:

6:52:14.3726983 PM  112 Explorer.EXE    SetDispositionInformationFile   C:\Config.Msi\75ce84f.rbf   CANNOT DELETE   Delete: True    Write   1232

Background: I'm using XP SP2. I recently repaired my Adobe Reader installation to make it the default browser plugin again instead of Foxit. (there seems to be no UI to do it otherwise?) So the installer did its thing and then asked to reboot. As is my habit when rebooting is inconvenient I declined the offer and ran pendmoves to find out what files the installer had scheduled to move / delete. It wanted to delete two files with .rbf extension (rollback files) located in C:\Config.msi\. (this applies to both even though I've been speaking about one). So I tried to delete them manually and couldn't.

Does anyone have any ideas what could be preventing deletion? (and I don't think it's malware even though I'm not running AV at the moment)

2 Answers 2

4

I figured out what's going on. It seems that you can rename and move (within the same partition) executables and DLLs that are in use, but can't delete them. (when was this feature introduced?) Two things which make it confusing are the error message ("Access is Denied" rather than "it is being used by another [process]"), and that the moved / renamed modules are still listed under their original names in Process Explorer, which is why I couldn't use it to figure out what process was using the files. (it was Adobe Reader, which the installer didn't shut down while doing its work)

I'd like to find the proper (Microsoft) documentation regarding this behaviour. Wikipedia has a paragraph that I found here:

Any file that is executing on the computer system as a program (e.g., an EXE, COM, DLL, CPL or other binary program file format) is normally prevented by the file system from being opened for write or delete access, reporting a sharing violation, despite the fact that the program is not opened by any application. However, some access is still allowed. For example, a running application file can be renamed or copied (read) even when executing.

Microsoft's DeleteFile mentions

The DeleteFile function fails if an application attempts to delete a file that is open for normal I/O or as a memory-mapped file.

The latter presumably includes loaded executables / DLLs.

Microsoft also has a page "Dynamic-Link Library Updates" which sort of implies this behaviour but doesn't document it properly.

1

Just a thought - can you delete it in Safe Mode? Also, when you rename it or move it around, then can you delete it?

1
  • Renaming and moving doesn't make them deletable. I haven't tried rebooting at all yet. I guess I'll delete the PendingFileRenameOperations entries before doing so (or move/rename the files). +1 for the suggestions.
    – Hugh Allen
    Apr 5, 2010 at 5:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .