Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On Windows XP, When I try and delete a specific file it says :

Cannot delete blah.blah: Make sure the disk is not full or write-protected and that the file is not currently in use.

How can I go around this warning and delete it anyway?

share|improve this question
    
I know the file in question is a Trojan like virus that is trying to send spam email from my computer. But I don't know how to delete the stupid thing. I do have an Anti Virus but for some reason it is not picking up this file, although it pick up a number of similar files. –  Ron Tuffin Jul 26 '09 at 19:49
    
The answers to my question here: superuser.com/questions/6607/… may be of help to you too... –  jerryjvl Jul 26 '09 at 22:01
    
Given you know a trojan has run on your system you cannot trust it anymore, the safe way out of this is reinstalling from a known good media. –  Shadok Aug 26 '11 at 12:25
add comment

8 Answers 8

up vote 40 down vote accepted

To successfully delete a locked file, you will need to identify the process which has locked the file. You need to exit the process first and then delete the file. To know which process has locked a file you need a tool such as Microsoft Sysinternals' Process Explorer (PE).

Once you have PE installed ...

  1. Click the Find menu, and choose Find Handle or DLL ...
  2. Type the file name (name of the file which is locked by some process.)
  3. After typing the search phrase, click the Search button

You should see the list of applications which are accessing the file :

Process Explorer

Now you can kill the offending process using PE or something else.

share|improve this answer
    
Thanks, this got me out of a jam. –  Herb Caudill Aug 12 '09 at 2:27
    
SysInternals Utilities are great tools, explore the others here it's worth ten minutes: technet.microsoft.com/en-us/sysinternals/bb795533 –  Shadok Aug 26 '11 at 12:27
    
In Windows 7, if you try to delete a file that is locked, the error message will tell you which process has it locked –  Garry English Sep 25 '12 at 17:16
add comment

With Unlocker. You could also try booting into safe mode (or just rebooting) and see if you can delete it then.

Edit (2013-02-09): I've found something better. LockHunter.

share|improve this answer
1  
when I download this, my virusscanner says there is a Trojan: Yabector.A ?????? –  Natrium Oct 8 '09 at 7:07
    
A small FYI - the author of Unlocker states these alerts are a false positive: ccollomb.free.fr/blog/?p=69 –  Isxek Apr 6 '10 at 6:25
    
Whatever it was, it appears to have been remedied. –  raven Oct 1 '10 at 12:51
    
Unlocker now bundles Adware and toolbars. Stay away!!! –  Computer Linguist Aug 15 '11 at 18:35
2  
Or just uncheck the boxes asking if you want to install them? –  ultrasawblade Aug 7 '12 at 20:30
add comment

Unlocker is good, but personally I prefer MalwareByte's FileAssassin.

share|improve this answer
add comment

Seeing your comments, it's best to have a different antivirus do it for you then. All of the other files associated with it will also be removed from the system.

Raven's answer is correct, of course, but if you're pretty sure the file is part of a worm/virus, it's better to have it deleted by an actual antivirus.

share|improve this answer
add comment

When I have a file I can't delete, say from some application I wanted to try out, I reboot and see if I can delete it then. If that fails, I either:

  1. Boot into Safe Mode and delete (as has been mentioned elsewhere)
  2. Boot using a Live CD or Rescue CD, and use the CD tools to mount the drive and then delete the file.

This is one reason why I used Sandboxie(http://www.sandboxie.com/) to test new applications. Sanboxie makes it very easy to clean about the detritus of an application install.

If you computer has been compromised, most security experts would strongly recommend that you clean install you system.

If you have been infected by a Trojan:

  1. You should back up all you data, perhaps including important configurations files (e.g., your Browser settings, or at least you bookmarks).
  2. Then you should clean install your system, apply all available security patches, and install some kind of virus and/or malware scanner.
  3. Finally, scan all the files you backed up, using you newly cleaned system or some other clean system, before restoring them.

Trying to manually clean a system is only possible in the luckiest of cases, and you never know if something was left behind. I would recommend not taking the chance.

share|improve this answer
add comment

Try a program such as Unlocker (only available for x86). You can use it to see all the locks and remove them if you want.

For x64, there might be similar programs as well. A more complicated and more general approach if there isn't is to use program such as Process Explorer, where you search for handles containing the file or program name, and delete all the handles you see.

share|improve this answer
add comment

A good and neat tutorial about this can be found here:

http://rajendrakhope.wordpress.com/2013/08/23/finding-out-which-process-is-locking-a-file-or-folder-in-windows-or-deleting-a-locked-file-in-windows/

Edit:

Normally this is not easy, but Microsoft had made this really easy for us. Microsoft has created a software suit called “Windows Sysinternals” for IT pro and System administrators. This suit consists of various tiny but powerful software tools to manage, troubleshoot and diagnose your Windows systems and applications.

You can download the entire Suit

or any single utility

What we need today for our problem is “Process Explorer”, which can be downloaded from:

http://technet.microsoft.com/en-us/sysinternals/bb896653

Download and Run “procexp.exe” tool from there.

It will take some time to populate all running process.

Look for the find tool in toolbar or menu bar.

Open this find handle or DLL box to search for the blocking handle.

In this find box just type the exact name of file or folder is being locked.

The search utility will find the handle for process or software that were using or opened your file. Click on the search result to see detail in lower pan of main window.

In this case it was notepad opened a handle to my file preventing me from deleting the file/folder.

Right click on the file handle entry and just select Close Handle.

And yes this is really important! You must be aware of what you are closing.!

Click yes to go ahead!

Now you are free to rename/delete/move or edit your file/folder

share|improve this answer
1  
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Mokubai Aug 22 '13 at 19:09
add comment

An easy CLI way is:

  • download handle, it's just a small command-line tool
  • open a command prompt as administrator, go to handle directory
  • run handle <part_of_the_path_of_the_locked_file>
  • from the output determine the PID
  • now you can
    • kill the process running taskkill /pid <the_PID> /f (/f means "force")
    • or close the handle without killing the process: handle -p <the_PID> -c <hexadecimal_code_of_the_handle>
  • now you can delete the locked file
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.