How can I find out who is using a "file in use"?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I have used that and discoverd that a certain trojan (deluxe communications) is not actually in use, though it claims to be and prevents me or anything else from changing it even when using MoveOnBoot or DelLater.

Thanks for the advice. Here we have a similar set up, where we have the users archive their PST files on to our server. I am trying to allow two users to access an old employees archived .pst, but when I try and add the pst to the user's account it says it is in use by the other user. It only allows one user to access the .pst at a time. Is there a way around this?

No. Outlook does not allow multiple simultaneous access of PST files.

Thanks! - Although procexp.exe helped me to find the culprit that had the file open... It strangely did not report that *anything* directly had the file open(!?) -- I basically saw that the Logitech Webcam tray app had a number of other mapi files open, and this was a mapi dll, so I killed the Logitech process and was finally able to delete the file.

Other solutions...

The Windows Server 2003 Resource Toolkit comes with the console app OH.exe (open handles).

http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en

WhoLockMe is a freeware GUI app.

http://www.dr-hoiby.com/WhoLockMe/index.php

unlocker is the simplest (and therefore the best) utility I've found for deleting files and folders when that annoying "in use" message appears - you don't even have to kill the process to unlock the file. And it's free! http://ccollomb.free.fr/unlocker/

I have a trojan on my computer that various anti virus programs can detect but not delete. it is a windows system32 dll file that can't be deleted manually. Is there anyway to remove it. Also the link for SysInternals just takes me to massive microsoft site

Hi Leo, I'm trying to rename a file that is on one of the servers, but it gives this damn message, but I'm not authorized to send applications in the servers to do this analysis, so, here is the question. There is some way to discover what program is using the file, or a software that remotely do this job??

Thanks for your attention.

Hi Leo,

I am dealing with an Ad-Ware virus detected by Avast. It appears that the infected files are generated on the fly by.

For instance Avast reports a virus detection for
C:\WINDOWS\system32\xxywVOfC.dll
Even if I delete this file it comes back at a later time. I also have performed a boot time complete virus scan on the disk and the virus remains.

I have run find handle using ProcessExplorer for this file and it reports the following:
winlogon.exe 1688 DLL C:\WINDOWS\system32\xxywVOfC.dll
winlogon.exe 1688 handle C:\WINDOWS\system32\xxywVOfC.dll
Explorer.exe 3140 DLL C:\WINDOWS\system32\xxywVOfC.dll

Is there a way I can find which process is generating these files?
Could it be that the virus is within either winlogon.exe or Explorer.exe?

Thanks
JM

Thanks for the procexp.exe tip. It helped me track down a pesky WordPerfect problem, when some of my most used files were giving me the "must be read-only or in use" error. When procexp.exe told me it was WordPerfect that had the files open, I realized that I had two WordPerfect processes open (one must have failed days ago...)

Ta da! Problem solved by opening the Windows Task Manager and killing the duplicate WordPerfect process.

To post a comment on "How can I find out who is using a "file in use"?", please return to that article's main page.