Hi Guys


How to enable a file to be opened when it is in use ?

I mean, the GetOpenFileName and CreateFile apis, when opens a file that is in uses returns on eax the value of 0-1, meaning tyhat this file is being used by another process.

How can i get acess to that file ? I mean, how can i open it ?

Do i need to make a copy of it ? If it is, how can i copy a file whose prcess is being used ?


Best Regards

Guga
Posted on 2006-04-22 11:35:37 by Beyond2000!
The other process(es) that have the file open need to open the file with a non-zero share flag - ie, allow either FILE_SHARE_READ or FILE_SHARE_WRITE - or both.
Posted on 2006-04-22 14:14:04 by f0dder
If a file is locked nad NOT shared for reading/writing, then you CANNOT gain access to it in any 'normal' way.
Posted on 2006-04-22 14:14:55 by ti_mo_n
Hi Guys

Tks..but.. iŽm still confused about this.

The problem started when i got infected  and tried to remove the damn file from my computer. The only tool that was able to remove that was karpesky. It disabled somehow the attibutes of the file and deleted it.


This is what i needed to know. How this can be done. I mean, removing or changing the attibutes of a file (even when it is being used) to delete it, or jyst to allow opening it to see what a hell is happening with that file.

F00der...i know that someone may misinterpretate this kind of suject here...So, can you pls, help me ? May i explain exactly what is happenning here on PM ?

I need urgent help.

Best Regards

Guga
Posted on 2006-04-23 17:18:59 by Beyond2000!
One way is to queue the file to be Moved when the system is rebooted, and create a run-once registry key to execute a small script or exe that deletes the Moved file(s) when the system has rebooted.
This is how many common antivirus-style programs achieve what you are asking, without resorting to any dirty tricks.
Posted on 2006-04-23 20:38:06 by Homer
Guga, if you just need to delete a file, you can boot into "rescue console" mode from an XP or 2k install CD. Perhaps "safe mode with command prompt" (from the F8-at-boot) menu will even be enough.

There's probably some method to *force* all handles to a file to be closed, but I haven't looked into this. You could grab a tool like "WhoLockMe" to see which processes has your file open though, and then manually kill those processes... then you should be able to delete the file.
Posted on 2006-04-24 01:16:03 by f0dder
Hi Guys

Tks a LOT

IŽll boot under console mode and delete that damn thing.

About wholockme iŽll take a look at it, thsi may be good to at least knows what a hell is happening with some files when i have no more access to it. And maybe trace the damn virus the next time, and not only the infected file.

Tks a LOT, guys :)

Best Regards,
Guga

Posted on 2006-04-24 11:53:07 by Beyond2000!
Glad to have helped :)
Posted on 2006-04-24 13:49:18 by f0dder