Summary: Windows will prevent you from deleting a file that's in use by a running program. If you can't find or shut down the program a different approach is needed.
AVG Anti-virus keeps telling me that I have a threat in the file C:\WINDOWS\cdsnp1.dll. AVG can't quarantine or delete it - it says that it cannot access to the file. If I try, it tells me something about the file being in use. What do I do?
•
This is likely one of the many manifestations of a very common problem. No, not the virus - I honestly have no idea what that is. I mean the inability of a program, or even you, to delete a file because it's in use.
In some cases Windows prevents you from deleting files because they're in use by some program running on your machine - often Windows itself. Deleting it while in use by a running program could crash your machine, or worse.
So what if you know you need to delete a file, but it's in use from the very moment you boot your system, and no matter what software you shut down it's still "in use"?
•
Windows also provides the ability to perform actions when it boots - before any programs are running. How this is specified is fairly obscure, and not something you want to deal with directly (it's buried in the registry, if you're really curious). Fortunately, there's a free utility to do it for you.
MoveOnBoot is a free download that allows you to rename, copy or delete a file the next time you reboot your machine.
When run, MoveOnBoot asks you to specify a file:
In this case I've selected the file c:\t\pagra.txt.
Hit next, and you'll get a choice:
It's called MoveOnBoot because the most common, and perhaps safest action is not to delete the file, but rather rename it or move it to a different folder so that the program that eventually tries to load it won't find it. However, you can also instead make a copy of the file, or truly delete the file, if you so choose.
In my case, I'll select "Move", and then it asks:
I've left the location the same (c:\t), but simply changed the name of the file.
Finally, MoveOnBoot confirms what it's about to do:
Even though it says "Start", it simply schedules the action to occur the next time you reboot.
Now, when you reboot your machine, once it comes back up, the file specified will be renamed, (or deleted or copied, depending on what you specified) before any other program has an opportunity to place it "in use".
CAUTION: you can really hurt your system using this utility. Do not delete any Windows system files or your system may become unbootable and you'll need to reinstall Windows from your installation media.
Use this utility with care.
Related:
-
Ask Leo! - Why can't I delete this file?
Article C2828 - November 2, 2006
I also like to use ForceDelete which performs, as the name indicates, a forcible deletion of a file. It too is dangerous if the wrong file is deleted. ForceDelete is available FREE from softpedia at http://www.softpedia.com/progDownload/ForceDelete-a-Download-33438.html
Posted by: Paul Masters at November 5, 2006 5:11 PMI prefer to slave the harddrive and then run a scan. Nothing is running on the harddrive while slaved and AVG can clean the file in question usually.
Posted by: Steve Myers at November 6, 2006 5:10 PMI've been using unlocker, another free utility to delete files in use and it has never failed me. It is a "must have program", but must be used carefully as you have the power of god on all your files with it... Sometimes I may not even know that a file in a directory listing is in use and when I try to delete it, exlorer menu pops up with unlocker option ready to stop any relevant process and deletes the file(s)immediately afterwards. I used almost all available similar programs, but this one beats others by far. For comparisons and features see: "http://ccollomb.free.fr/unlocker/" and forget about junk and unnecessary file deletion problems.
Posted by: A. Orcan at November 7, 2006 7:28 AMHOW ABOUT THE FILE UNLOCKER?
Posted by: MILES STONE at November 7, 2006 12:59 PM---------------------------
This program wii get rid of any file. However, why not just copy the suspicious file to a floppy temporarily. Then delete it from your system when in safe mode. Then reboot and if ther is a problem related to its absence, copy it back from the floppy and learn to live with it!!
My IE7 was hijacked and I spent a week fruitlessly with anti virus programmes trying to remove the file/s that I had identified. No good. Then I chanced on this programme, 2 minutes later I deleted the file and now I'm hijack free..!! Brilliant programme would have paid for it if necessary.
Posted by: John at March 9, 2007 6:14 AMGo to the address below and download Sysinternals Process Explorer
http://www.loranbase.com/idx/15/025/article/Sysinternals-Process-Explorer-v1021.html
Open the program, and then;
1) Click binoculars icon, type program name (for example closeme.exe) click search
2) Click the process name you searched for
3) On the main window, right click the highlighted result and click "Close Handle"
Now you can delete or rename the program !
Posted by: delayed revenge at May 1, 2007 2:37 PMthank you leo!!!!! that program is a miracle. i didn't think i was going to find a way to solve this problem.
Posted by: oana at June 11, 2007 1:33 AMWhen I click on the MoveOnBoot link, I eventually wind up with a .MSI file, which Windows does not know what to do with. When I went to the software author's web site, I got a .EXE file, which said it could not find the .MSI file... This was just an exercise in frustration.
Posted by: Gord Campbell at August 23, 2007 3:24 PMI had a problem deleting a malware DLL that seemed impervious to the above ideas. I finally got rid of it by setting the security permissions to Deny Execute. Next time I rebooted, the dll was unable to load, and could be deleted.
Posted by: Paul at September 8, 2007 7:10 PMThanks for this, worked a treat on a file that McAfee marked as a Trojan but could not delete.
Posted by: David at September 18, 2008 3:28 AM