1

How to delete specific files in System32/drivers?

I need to remove a software manually.Guide says that I need to remove some .sys files that are related to that software from System32/drivers but I can't. I get the "You need permission to perform this action". The permission is required from SYSTEM. I'm logged in as local administrator. Tried using Unlocker, giving myself full access to the files and even to Everyone. Tried deleting through safe mode. One of the files I took ownership with takeown and cacls and now it's asking me I need permission from myself(administrator account)!

How to delete system files if I'm logged in as local admin and still need permission from SYSTEM?

Some of the files I need to delete: srtspx64.sys and srtspl64.sys

http://www.symantec.com/business/support/index?page=content&id=TECH91038&locale=en_US

  • Use a linux live system. Rename the files and reboot. – davidbaumann Apr 22 '14 at 15:13
  • 1
    Please read superuser.com/questions/100360/…. Summary: Removal is never guaranteed. Before ever using that PC again for anything sensitive (such as Internet banking) first nuke the OS from orbit. Do a clean reinstall. – Hennes Nov 27 '15 at 13:48
2

Files in System32 are typically owned by "TrustedInstaller" and are locked down really tightly. If you really, absolutely feel you must do this, the easiest way is to boot from a Linux LiveCD or a Windows install disk.

Using Linux, mount the drive R/W with the ntfs-3g utility (or just use mount; all modern Linux distros default to using ntfs-3g) and delete the files like you would any others (from a shell, the command is rm). I know this approach works.

Using Windows install media, you need to enter repair / recovery mode. That will give you the option to open a command prompt. This prompt can be used to browse to the folder (note that it may not be on the C: drive, if the install media is putting itself as C:) and try deleting the file, potentially using the same kinds of things you did above (taking ownership, changing ACLs, etc.). This should work, but I haven't tested it.

0

Note That deleting any thing under the windows folder can cause the entire system to stop working! Just because you are logged in as a local admin does not mean that all processes you start run with full access you have to start them in admin mode!

You could try to start CMD in administrator mode and then delete the files with the DEL command.

If you still can't delete the file you could use handle.exe found in Sysinternals to see if some other process is locking the file.

  • 2
    DEL says 'Access denied'. Sysinternals doesn't work, says "Error loading driver: A". Yes, just "A". – user317441 Apr 22 '14 at 16:18
  • @user317441 Sorry i have no more ideas.. but if you ask me i would rather reinstall the computer then fiddle with the system32 folder. – Peter Apr 22 '14 at 18:41
0

You can do it easily via:
Executing :

takeown /f srtspx64.sys
cacls srtspx64.sys /E /P /g abc:f
del srtspl64.sys /f /p
del srtspx64.sys /f /p

Replace abc with your username

  • Please do not post links to files in random download locations. – DavidPostill Jun 4 '17 at 21:27
0

Use IOBit Unlocker, it's a great tool, super easy to use, free, and I can vouch that it deleted my rogue drivers from System32\drivers. See other options here (but I only tried Unlocker).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.