How to remove the error "File is being used by another process"?

Question

Hi Friends,

I am trying to delete a file (malicious file) that places itself in the system32 directory. When i try to delete that file it shows cannot access file that is being used by another process. I found out that the process that uses the file is winlogon.exe . How can i remove this handle from the winlogon.exe process. I want to remove this from the winlogon.exe process. Can anybody suggest any ideas for this. Thnx in advance...

Answer 1

If you try google there are a few possible solutions.

However, if it is truly a malicious file I'd look at using antivirus or spyware removal tool. I doubt that a VB program would help. Which s what this forum deals with.

---

Regards David R
---------------------------------------------------------------
The great thing about Object Oriented code is that it can make small, simple problems look like large, complex ones.
Object-oriented programming offers a sustainable way to write spaghetti code. - Paul Graham.
Every program eventually becomes rococo, and then rubble. - Alan Perlis
The only valid measurement of code quality: WTFs/minute.

Answer 2

Vb is not of any use in this.

If you know what you're doing, try to boot from a Linux CD and delete that file manually.

---

---

Muscalu Ștefan ~~~~ Student

---

Answer 3

Good call Muscula - though I suspect the OP will not be comfortable with this. :)

---

Regards David R
---------------------------------------------------------------
The great thing about Object Oriented code is that it can make small, simple problems look like large, complex ones.
Object-oriented programming offers a sustainable way to write spaghetti code. - Paul Graham.
Every program eventually becomes rococo, and then rubble. - Alan Perlis
The only valid measurement of code quality: WTFs/minute.

Answer 4

You need to go to a site like bleepingcomputer.com and join, then post your issue there, including filename(s), and symptoms. They may ask for logs from Trend Micro's "Hijack This" and one of their specialists will give you specific instructions on removing the malware.

As was already stated, VB is not really useful in this case.

Answer 5

You need to go to a site like bleepingcomputer.com and join, then post your issue there, including filename(s), and symptoms. They may ask for logs from Trend Micro's "Hijack This" and one of their specialists will give you specific instructions on removing the malware.

As was already stated, VB is not really useful in this case.

Maybe i could write a dll and inject it in the winlogon.exe process that may remove the handle to the file. Then i can delete that file after the dll removes the handle from the winlogon.exe process.

Is that possible.

Answer 6

Nope, sorry

You cannot make a Win32 application(or any other) use an external dll if that isn't coded.

---

---

Muscalu Ștefan ~~~~ Student

---

Answer 7

Nope, sorry

You cannot make a Win32 application(or any other) use an external dll if that isn't coded.

---

---

Muscalu Ștefan ~~~~ Student

---

Ok but that application runs inside the winlogon process or is used by the winlogon .exe process. How can i close its association or remove from the winlogon.exe process. Maybe i may stop winlogon from using that process.

Answer 8

Metagoth,

Software for which you ask is in itself in the category Malicious. It is not what you can do with it, but what others can do with code supplied here. 

Look at this thread Reed has placed in top of this forum.

http://social.msdn.microsoft.com/Forums/en-US/vbgeneral/thread/053a0a87-e9b8-42e7-b483-d6d47c41278e

However, that is already written by David.

---

Success
Cor

Answer 9

Metagoth,

Software for which you ask is in itself in the category Malicious. It is not what you can do with it, but what others can do with code supplied here. 

Look at this thread Reed has placed in top of this forum.

http://social.msdn.microsoft.com/Forums/en-US/vbgeneral/thread/053a0a87-e9b8-42e7-b483-d6d47c41278e

However, that is already written by David.

---

Success
Cor

I understand the risks involved in asking for such help. But my intent is curing the malicious activity. I am tryin to develop a cure for a malicious file activity.

All my question to community was whether i could stop winlogon.exe from using this file so that i could delete this file without any dependency error.

Answer 10

Your intent is not important like you can read in the message from Reed. 

Like most regulars here was Davids reply meant to help you, but the chance that somebody will visit this forum to search for malicious code is to high to help you.

David wrote in fact: "Don't try it here, find another place. Sorry we cannot help you".

 

---

Success
Cor