+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Found random 4gb file (/showthread.php?tid=5580670)
Found random 4gb file - Estonia - Mar 21, 2017
How can i remove the file c:\Recovery\Customizations\usmt.ppkg when it is locked by System of windows 10?
I cannot remove it because it seems to be used by another process.
I used process explorer to find out which process locks usmt.ppkg, it seems it is "System".
I am aware of the consequences of removing this file, but it should be possible to remove this file even if it is completly unsafe.
Safe mode doesn't seem to work either. And i can't kill the "System" process. I can't also use "close handle" feature of process explorer cause a error popsup: error opening process: the handle is invalid.
http://prntscr.com/emjxav
Can anybody offer a helping brain?
* - ｋａ＄ｈ - Mar 21, 2017
Did you read the comments of the post?
https://superuser.com/questions/1170547/remove-the-file-c-recovery-customizations-usmt-ppkg-when-it-is-locked-by-system
* - Leroy Jethro Gibbs - Mar 21, 2017
(Mar 21, 2017 02:53 AM)ｋａ＄ｈ Wrote: Did you read the comments of the post?
https://superuser.com/questions/1170547/remove-the-file-c-recovery-customizations-usmt-ppkg-when-it-is-locked-by-system
I too am curious. The guy posting on that says hes glad to hear it was resolved. So OP, was it resolved?