The reason you cannot delete the file ( assuming some kind of permission has not been modified to lock it down preventing deletion in the first place ) is because it is tied up in some active windows process. For example, many viruses will load themselves up as part of explorer.exe, which is what provides you with that pretty little taskbar you have on the bottom/left/right/top of your screen. Since the virus is " in use " by explorer.exe, which loads at startup in both normal and safe-mode, you can not remove it, pretty effectively locking the virus onto your computer semi-permenantly. Our goal, of course, is to remove that permenant part.
The easiest and most reliable way to remove a file tied up in a system process is to boot into another non-Windows OS and modify the file on your drive from there. Bootable Linux CDs are nigh infallible and pretty much the best way to go about doing this. There are other alternatives available, such as Bart PE ( Google it ), and you would be surprised how often just loading the command prompt will allow you to remove a file ( recovery console for XP ).
For those of you who havent restarted since '97 and would like to keep the record going, another alternative is killing system processes that may be using aforementioned virii ( apparently thats not a real word but I like it nonetheless ). Task Manager allows you to kill most processes, but a few processes are considered essential for Windows to function properly and cant be shut down via Task Manager ( Csrss.exe, lsass.exe, etc. ). A few apps, such as Killbox, will allow you to kill process TM wont. Of course, when you do this, a little window will pop up and say " Hey buddy, I needed that. So now Im gonna be a like ' bweeeewww ' and shut off on your *arse* ". Of course, it doesnt say that at all, but its something fairly similar. You now have approximately a minute to sob quietly before your computer restarts, whether you like it or not.
But we're going more for the not, so to stop the countdown, simply click on Run... ( which can be found in the start menu and in task manager ) and type " shutdown -a ". And there. Now the computer can be used again. Note that, obviously, you will lose any functionality related to whatever system process you kill. Its possible to kill all but one single system process and continue using the computer ( in some manner ). Csrss.exe. if terminated, will blue screen your *arse*, so dont do it. Its not often required that you kill all possible processes, as viruses arent often complicated enough to tie themselves into many processes.
In order to determine what services may need to be shutdown to hunt down a virus, simply use an application like Hijack This! or SysInternals Process Explorer to view the .dlls associated with system processes. Deleting illegitimate .dlls often "breaks" malware, just like itll break normal software. Most .dlls without any identifier other than a filename are malware-related, but its absolutely crucial that you research ALL of them before deleting them. If you dont know why, you shouldnt be monkeying around with this in the first place. Killing the appropriate process or .dll often allows you to delete the malware abusing it, but not always.
Occasionally, a file cannot be deleted in apps such as Bart PE or by killing any reasonable system process. This leaves the last option I will be covering; the registry. Normally people put big caps here and say " DONT MESS WITH THE REGISTRY UNLESS YOU KNOW WHAT YOURE DOING OR HAVE MADE BACKUPS. YOU CAN BREAK THE *BLEEP* OUT OF YOUR SYSTEM OTHERWISE ". But I wont do that. Again... Actually, the registry can be a very scary place, but isnt as dangerous as most people make it out to be. You CAN break the *BLEEP* out of your system jerking around with it, sometimes irrepairably (excluding formatting, of course ), but assuming you make sure that any entry you delete will not be associated with anything you care about ( like malware ), you can fix a lotta virii ( viruses ) this way. Open Regedit by going to " Run... " and typing regedit or regedit32.
Find the filename of the item your attempting to delete, which will often be a long string of absolute gibberish, then use the search function in Regedit ( make sure to highlight ' my computer ' on the left so you search the WHOLE registry and not just a part of it ) to find any key that mentions that file. ONLY delete the item the search function finds for you. ONLY hit delete once. When you delete an entry, the next entry is automatically selected, so beating on the delete key like a masturbating monkey will delete God only knows what and make your life Hell, which you deserve for touching your computer like that. Make sure to find every entry that mentions the filename of the file you want deleted. Once youve killed them all, try deleting the file youve grown to hate again.
This should provide a nice stepping stone for those of you who are no longer willing to leave your security to antivirus scanners alone. Feel free to chew me out if you *BLEEP* up your system using any of these tactics. I mean, I should pay for trying to enlighten you, right?
