Can't delete dodgy file. Help??

[Iamzod]

Trying to delete a file from my hard drive under windows XP but everything i've tried is giving me "Access Denied"

Trying to delete avwavl.dll in the c:\windows\system32\ folder.

Tried the following

Deleting it with a virus scanner/antispyware software
Deleting in the WinXP recovery console
Deleting in the CMD thing
Changing its attributes in the CMD thing
Moving it
Renaming it
Using Moveonboot

Nothing works, anything else to try?

 

[233]

format c:\

d:\windows\setup.exe

 

[Beans on toast Dave]

will unlocker do it?
http://ccollomb.free.fr/unlocker/

 

[Iamzod]

format c:\

d:\windows\setup.exe

Beleive me i would, but everytime i've done that in the past i've forgotten to back something up, dont want to go that far yet.

Just tried unlocker, and no, it cannot get rid of it.

Any more ideas?

 

[MarcLister]

Will Unlocker not let you delete it when you restart the PC? Normally anything it can't delete in Windows it can/will when you restart.

 

[bledd]

disable system restore

type this in run..

regsvr32 /u avwavl.dll
then use unlocker on it, to delete it

if that fails, try it in safemode (hammer f8 after the bios post screen)

 

[Iamzod]

Will Unlocker not let you delete it when you restart the PC? Normally anything it can't delete in Windows it can/will when you restart.

Nope, it gives me the option but the file is still there after reboot.

Going to try Bledd's suggestion now

 

[Iamzod]

disable system restore

type this in run..

regsvr32 /u avwavl.dll
then use unlocker on it, to delete it

if that fails, try it in safemode (hammer f8 after the bios post screen)

The results are as follows-

Normal boot up-

Safe Mode -

File still sat on my HDD

 

[swinnie]

Is the system32 folder read only?

 

[Iamzod]

Is the system32 folder read only?

It was initially, already tried that though & got this -

 

[bledd]

use http://hijackthis.de to remove it from startup (download link is in the top right)

do a search for it in regedit too (the avwavl.dll file)

also, try taking ownership of the file (google 'take ownership of a file' ) and use the microsoft guide..

-you are logged in as an admin, yes?

 

[Dano]

Safe mode, then try and rename it first, then delete it.

 

[K.C. Leblanc]

You could try deleting it from a BartPE disk, or maybe a Linux Live CD of some sort.

 

[fatnbald]

Try Removeonboot here
Always worked for me

 

[MikeHunt79]

tried a windows livecd?

 

[Iamzod]

Try Removeonboot here
Always worked for me

Yep, that cant get rid of it.

Hijackthis is having no effect either, the file is still there & still sending my AV software nuts.

As for the windows live CD suggestion, i'm not entirely sure what that is, but i'm guessing i'm going to need a blank CD & i aint currently got one

 

[Iamzod]

I've also noticed all of the security & sharing related tabs under file properties have gone.

 

[bledd]

hmm

what av are you using?

maybe remove that and try nod32 (30 day trial version), also run avg antispyware

good luck!

-could use a live linux disc to do it as mentioned above

 

[fatnbald]

Why exactly are you trying to delete it? Has it been flagged up as a virus or spyware?

 

[Dappy]

Try this method :

(Make sure your account has administrator privileges)

1 - Open the shutdown dialog as if you're really going to shut the machine down

2 - When you have the list of shutdown options hold down CTRL-ALT-SHIFT and whilst holding these keys down click 'cancel' on
the shutdown menu. Explorer.exe will cleanly close with no task bar etc, but you're desktop will be visible still.

3 - Get the task manager up by pressing CTRL-ALT-DELETE then click File then Run and you want a command prompt, type 'cmd' as you do.

Now try and delete the file you're trying to remove. Type 'explorer' in the command prompt when you're ready to return to windows.