Hi Guys
How to enable a file to be opened when it is in use ?
I mean, the GetOpenFileName and CreateFile apis, when opens a file that is in uses returns on eax the value of 0-1, meaning tyhat this file is being used by another process.
How can i get acess to that file ? I mean, how can i open it ?
Do i need to make a copy of it ? If it is, how can i copy a file whose prcess is being used ?
Best Regards
Guga
How to enable a file to be opened when it is in use ?
I mean, the GetOpenFileName and CreateFile apis, when opens a file that is in uses returns on eax the value of 0-1, meaning tyhat this file is being used by another process.
How can i get acess to that file ? I mean, how can i open it ?
Do i need to make a copy of it ? If it is, how can i copy a file whose prcess is being used ?
Best Regards
Guga
The other process(es) that have the file open need to open the file with a non-zero share flag - ie, allow either FILE_SHARE_READ or FILE_SHARE_WRITE - or both.
If a file is locked nad NOT shared for reading/writing, then you CANNOT gain access to it in any 'normal' way.
Hi Guys
Tks..but.. iŽm still confused about this.
The problem started when i got infected and tried to remove the damn file from my computer. The only tool that was able to remove that was karpesky. It disabled somehow the attibutes of the file and deleted it.
This is what i needed to know. How this can be done. I mean, removing or changing the attibutes of a file (even when it is being used) to delete it, or jyst to allow opening it to see what a hell is happening with that file.
F00der...i know that someone may misinterpretate this kind of suject here...So, can you pls, help me ? May i explain exactly what is happenning here on PM ?
I need urgent help.
Best Regards
Guga
Tks..but.. iŽm still confused about this.
The problem started when i got infected and tried to remove the damn file from my computer. The only tool that was able to remove that was karpesky. It disabled somehow the attibutes of the file and deleted it.
This is what i needed to know. How this can be done. I mean, removing or changing the attibutes of a file (even when it is being used) to delete it, or jyst to allow opening it to see what a hell is happening with that file.
F00der...i know that someone may misinterpretate this kind of suject here...So, can you pls, help me ? May i explain exactly what is happenning here on PM ?
I need urgent help.
Best Regards
Guga
One way is to queue the file to be Moved when the system is rebooted, and create a run-once registry key to execute a small script or exe that deletes the Moved file(s) when the system has rebooted.
This is how many common antivirus-style programs achieve what you are asking, without resorting to any dirty tricks.
This is how many common antivirus-style programs achieve what you are asking, without resorting to any dirty tricks.
Guga, if you just need to delete a file, you can boot into "rescue console" mode from an XP or 2k install CD. Perhaps "safe mode with command prompt" (from the F8-at-boot) menu will even be enough.
There's probably some method to *force* all handles to a file to be closed, but I haven't looked into this. You could grab a tool like "WhoLockMe" to see which processes has your file open though, and then manually kill those processes... then you should be able to delete the file.
There's probably some method to *force* all handles to a file to be closed, but I haven't looked into this. You could grab a tool like "WhoLockMe" to see which processes has your file open though, and then manually kill those processes... then you should be able to delete the file.
Hi Guys
Tks a LOT
IŽll boot under console mode and delete that damn thing.
About wholockme iŽll take a look at it, thsi may be good to at least knows what a hell is happening with some files when i have no more access to it. And maybe trace the damn virus the next time, and not only the infected file.
Tks a LOT, guys :)
Best Regards,
Guga
Tks a LOT
IŽll boot under console mode and delete that damn thing.
About wholockme iŽll take a look at it, thsi may be good to at least knows what a hell is happening with some files when i have no more access to it. And maybe trace the damn virus the next time, and not only the infected file.
Tks a LOT, guys :)
Best Regards,
Guga
Glad to have helped :)