Member Avatar for Sahil89

Few days ago I was scanning a memory card with Avast and PC got shut down. Now there is file of 4GB in C:\ProgramData\AVAST Software\Avast and I need permission from SYSTEM to delete it. I tried to take permission from administrator account but didnt work. What should I do to delete this file?

  • 7 Contributors
  • 9 Replies
  • 1K Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

A few extra notes and a compact troubleshooting path based on what worked for and the ideas from , , and .

When a file in C:\ProgramData\AVAST Software\Avast is owned by SYSTEM and cannot be removed, it is usually because the antivirus service or a driver still has the file open, or the filesystem was left inconsistent by the interrupted card scan. Safe Mode often works because most third-party services and drivers (including many AV components) are not loaded, which is why was able to delete it there.

If Safe Mode is not possible or does not help, try this ordered approach:

  • Stop or uninstall the AV cleanly (use the vendor removal/uninstall tool) so its processes and services release any handles.
  • Use a handle/search utility (Process Explorer or similar) to see which process has the file open, then stop that process or close the handle.
  • If you need a shell running as the SYSTEM account, use a supported tool that provides a SYSTEM interactive session (Sysinternals PsExec is commonly used) and delete from that context.
  • If the file comes from a corrupted memory card, copy recoverable data first, repair the card filesystem or delete the file from external media (Windows PE or a Linux live USB), then reformat the card if needed.

Cautions: always back up before forcing deletions; do not remove files you cannot identify as noncritical; prefer vendor uninstall tools for AV data. If the file persists after these steps, contacting the antivirus vendor or using a clean-boot/PE environment is the safest next move.

Recommended Answers

All 9 Replies

Member Avatar for Reverend Jim

Run the command shell (cmd.exe) as Administrator then delete the file from there.

Member Avatar for LaxLoafer

You might need to take ownership of the file before you can delete it. Log in to a command prompt as administrator and type takeown /? to get more help.

Edited by LaxLoafer
Member Avatar for sbesch

If the OS got shutdown during a critical I/O operation to the memory card, it could have creamed something in the File System Tables on the card. This can make removal of the file very difficult. Windows can be really porky about this. If neither of the previous suggestions help, you may need to copy all the readable data to another media and then reformat the memory card. However, if you know someone with a different OS (or have access to a computer running a different OS), try deleting the file on a different OS (eg, linux, unix, Mac, sun, etc), but you should still save whatever you can on a different media first. I believe there are also several "Repair" programs out there, but they may not work anyway and on Windows, they will cost you. If you're not losing anything you care about, a reformat is usually the best/easiest solution.

Member Avatar for Sahil89

Tried TAKEOWN with administrator account but didnt work. Getting error: access denied. Maybe because file owner is SYSTEM. Any other solution?

Member Avatar for gerbil

If you know what you are doing, then open a cmd window as System and run delete file from there. So, in a admin cmd window, enter:
at 12:34 /interactive cmd.exe
where 12:34 is, say, one minute ahead of your current time.

Member Avatar for LaxLoafer

Taking ownership of a file owned by SYSTEM isn't normally a problem. Perhaps something is holding the file open? Have you tried booting into safe mode and attempting to take ownership?

If you succeed I expect you'll then need to assign some permissions, to allow you to delete the file, otherwise you would see an access denied error.

Did Gerbil's suggestion work out?

Member Avatar for Sahil89

ya tried gerbii's suggestion but was getting error and finally worked in safe mode, Thanks.

Member Avatar for flapse32

Safe Mode always works ;)

Member Avatar for rubberman

Personally, I think they should rename it as "Not-so-safe Mode"! :-) That is a good way to fubar your system... Hopefully you verified that this is not a file critical to other system functions?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.