Solved

Is there a way to delete a locked file without using a 3rd party app, a script perhaps?

Posted on 2009-04-06
12
685 Views
Last Modified: 2012-05-06
I have done extensive research on this and cant seem to find a way to delete a locked file without using a 3rd party app. I know I can rename it, then on reboot delete but this is not enough. I have also tried the trick of closing 'explorer.exe'- delete the file via cmd prompt, then relaunching 'explore.exe'---- no dice..

tx
0
Comment
Question by:geewizzz
  • 6
  • 4
  • 2
12 Comments
 
LVL 38

Expert Comment

by:Shift-3
ID: 24079589
The trick is to find out which process has the file locked.  You can find this using the Microsoft utility Process Explorer.

Then either get it to release the file gracefully or kill the process.
0
 

Author Comment

by:geewizzz
ID: 24082820
I dont want to rely on a third party app. Issue is some files run under the 'svrhost' process and it is not so easy to pinpoint which 'svrhosts' to kill. Some even relaunch themselves as soon as you kill them.


0
 
LVL 38

Expert Comment

by:Shift-3
ID: 24082854
Process Explorer was developed by Sysinternals, but it's under the Microsoft umbrella now.  If you're running Windows then Microsoft isn't third-party.

You can see which processes are running under which instance of svchost by using tasklist with the /svc switch.
0
 

Author Comment

by:geewizzz
ID: 24093181
To clarify, I know I can locate a process, kill it and delete a file. (tasklist and taskkill..)

So specifically for a specific example now. Oracle locks the file oci.dll, it runs under a svchost service- I can pinpoint the one using a number of different tools. Problem is, by the time you kill the process and delete the file it is already relaunched, coming up under a different PID.
When I use the tool 'Unlocker' it tell me the process and gives me the option to kill it quickly and delete the file successfully. If a program like that can do it, then why not a script?
Another issue is I want to be able to delete it on a remote computer as well, unfortunately the PID will be different on each machine.
To understand it further, what are these tools tapping into to know which process has a file locked?

0
 
LVL 67

Expert Comment

by:sirbounty
ID: 24196033
I would suspect there's some details being pulled from wmi that could determine this, though I have no way of testing it.

However, when you say the process 'restarts',I'd imagine that is coming from the service definition.

Start->Run->services.msc <Enter>
Locate the service, double-click it and under Recovery tab, change all actions to "Take No Action" and then click OK.
0
 

Author Comment

by:geewizzz
ID: 24199562
Ahhh
As an example I am 'playing' with an uninstall script for Oracle. Cannot delete the oci.dll file (its locked) and when I trackdown the process id, it's a 'service host' one not listed on the services console.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 67

Expert Comment

by:sirbounty
ID: 24200621
But that's a dll - some service would be loading the overlay, no?
0
 

Author Comment

by:geewizzz
ID: 24204110
Some research online pointed to the possibility of the 'Distributed Transaction Coordinator' service. However even after I stop the service, set it to 'manual' startup and reboot, still no go.. No other oracle/database services are running.
Is there a way to disable windows file proctection on a single file?
0
 
LVL 67

Accepted Solution

by:
sirbounty earned 500 total points
ID: 24205258
Oh - is that's what's creating it...
Yes, there is, but you'd have to be 'quick' about it.  I've done it a couple of times myself - best to do from a batch file.

What I would do is use something like this:



Set file=oci.dll

Set fld=%systemroot%\system32\

REM Un-REM next line if you need a backup...

REM COPY %SYSTEMROOT%\SYSTEM32\%FILE% C:\

for /f %%a in (%fld% %fld\dllcache) do del /q %%a\%file%

Open in new window

0
 

Author Comment

by:geewizzz
ID: 24230581
Sorry for not checking back up on this one sooner.. I will test it on monday. Thanks again for your help.
Have a great weekend!
0
 

Author Closing Comment

by:geewizzz
ID: 31567106
Thank you again for your help. Will definitely copy you on future questions if you are interested.

0
 
LVL 67

Expert Comment

by:sirbounty
ID: 24276112
Glad I could help - thanx for the grade! :^)
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

Introduction: I have always been a big fan of Windows but my liking towards it is slowly being eroded by the variety of other Applications that I encounter, when I browse the Web. Most of the software available is free and maybe Open Source too. …
The password reset disk is often mentioned as the best solution to deal with the lost Windows password problem. In Windows 2008, 7, Vista and XP, a password reset disk can be easily created. But besides Windows 7/Vista/XP, Windows Server 2008 and ot…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now