Summary: Windows will prevent you from deleting a file that's in use by a running program. If you can't find or shut down the program a different approach is needed.
AVG Anti-virus keeps telling me that I have a threat in the file C:\WINDOWS\cdsnp1.dll. AVG can't quarantine or delete it - it says that it cannot access to the file. If I try, it tells me something about the file being in use. What do I do?
•
This is likely one of the many manifestations of a very common problem. No, not the virus - I honestly have no idea what that is. I mean the inability of a program, or even you, to delete a file because it's in use.
In some cases Windows prevents you from deleting files because they're in use by some program running on your machine - often Windows itself. Deleting it while in use by a running program could crash your machine, or worse.
So what if you know you need to delete a file, but it's in use from the very moment you boot your system, and no matter what software you shut down it's still "in use"?
•
Windows also provides the ability to perform actions when it boots - before any programs are running. How this is specified is fairly obscure, and not something you want to deal with directly (it's buried in the registry, if you're really curious). Fortunately, there's a free utility to do it for you.
MoveOnBoot is a free download that allows you to rename, copy or delete a file the next time you reboot your machine.
When run, MoveOnBoot asks you to specify a file:
In this case I've selected the file c:\t\pagra.txt.
Hit next, and you'll get a choice:
It's called MoveOnBoot because the most common, and perhaps safest action is not to delete the file, but rather rename it or move it to a different folder so that the program that eventually tries to load it won't find it. However, you can also instead make a copy of the file, or truly delete the file, if you so choose.
In my case, I'll select "Move", and then it asks:
I've left the location the same (c:\t), but simply changed the name of the file.
Finally, MoveOnBoot confirms what it's about to do:
Even though it says "Start", it simply schedules the action to occur the next time you reboot.
Now, when you reboot your machine, once it comes back up, the file specified will be renamed, (or deleted or copied, depending on what you specified) before any other program has an opportunity to place it "in use".
CAUTION: you can really hurt your system using this utility. Do not delete any Windows system files or your system may become unbootable and you'll need to reinstall Windows from your installation media.
Use this utility with care.
Article C2828 - November 2, 2006
Go to the address below and download Sysinternals Process Explorer
http://www.loranbase.com/idx/15/025/article/Sysinternals-Process-Explorer-v1021.html
Open the program, and then;
1) Click binoculars icon, type program name (for example closeme.exe) click search
2) Click the process name you searched for
3) On the main window, right click the highlighted result and click "Close Handle"
Now you can delete or rename the program !
Posted by: delayed revenge at May 1, 2007 2:37 PMthank you leo!!!!! that program is a miracle. i didn't think i was going to find a way to solve this problem.
Posted by: oana at June 11, 2007 1:33 AMWhen I click on the MoveOnBoot link, I eventually wind up with a .MSI file, which Windows does not know what to do with. When I went to the software author's web site, I got a .EXE file, which said it could not find the .MSI file... This was just an exercise in frustration.
Posted by: Gord Campbell at August 23, 2007 3:24 PMI had a problem deleting a malware DLL that seemed impervious to the above ideas. I finally got rid of it by setting the security permissions to Deny Execute. Next time I rebooted, the dll was unable to load, and could be deleted.
Posted by: Paul at September 8, 2007 7:10 PMThanks for this, worked a treat on a file that McAfee marked as a Trojan but could not delete.
Posted by: David at September 18, 2008 3:28 AM