C++ | Windows - Is there a way to find out which process has ownership of the locked file?

Question

What I want to know is it possible to try an open a file (and when it fails because it's opened with another process with sharing off) to figure out which process is using said file?

The reason I am wanting to know this information is because I am making a little application that will "fix" malicious files.

For example, some malicious/adware etc set the file security descriptor so the user can't delete the file, etc. My application just resets the security descriptor allowing the user to regain control.

I have also seen a file open up its child process with for example (CreateFile) and have Shared Mode turned off so the file can't be touched, then the application would execute the childprocess from memory.

Answer 1

I have developed a function to locate such process, kill it and delete the locked file.

bool ForceDeleteFile(LPWSTR FileName);

Here is the full source code:

bool KillFileProcess(LPWSTR FileName)
{
    HANDLE hProcessSnap;
    HANDLE hProcess;
    PROCESSENTRY32 pe32;
    DWORD dwPriorityClass;
    bool result = false;
    // Take a snapshot of all processes in the system.
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE)
    {
        //printError(TEXT("CreateToolhelp32Snapshot (of processes)"));
        return(FALSE);
    }

    // Set the size of the structure before using it.
    pe32.dwSize = sizeof(PROCESSENTRY32);

    // Retrieve information about the first process,
    // and exit if unsuccessful
    if (!Process32First(hProcessSnap, &pe32))
    {
        //printError(TEXT("Process32First")); // show cause of failure
        CloseHandle(hProcessSnap);          // clean the snapshot object
        return(FALSE);
    }

    // Now walk the snapshot of processes, and
    // display information about each process in turn
    do
    {
        // Retrieve the priority class.
        dwPriorityClass = 0;
        hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
        if (hProcess == NULL)
        {
            //printError(TEXT("OpenProcess"));
        }
        else
        {
            dwPriorityClass = GetPriorityClass(hProcess);
            if (!dwPriorityClass)
            {
                //printError(TEXT("GetPriorityClass"));
            }
            CloseHandle(hProcess);
            if (HANDLE hProcess = ::OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pe32.th32ProcessID))
            {
                WCHAR filename[MAX_PATH] = {};

                if (GetModuleFileNameEx(hProcess, NULL, filename, MAX_PATH))
                {
                    if (_wcsicmp((const wchar_t *)FileName, (const wchar_t *)filename) == NULL)
                    {
                        if (TerminateProcess(pe32.th32ProcessID, 0))
                        {
                            _tprintf(L"Found: Process full killed\nKILLED!\n");
                            result = true;

                        }
                        else
                        {
                            _tprintf(L"Found: Process full \nFailed to terminate\n");
                            DoRun(((CString)L"taskkill /F /IM " + (CString)pe32.szExeFile).GetBuffer());

                            result = false;

                        }
                    }
                }
                else
                {
                    // handle error
                }

                CloseHandle(hProcess);
            }
        }


    } while (Process32Next(hProcessSnap, &pe32));

    CloseHandle(hProcessSnap);
    return(result);
}
bool ForceDeleteFile(LPWSTR FileName)
{
    bool result = DeleteFile(FileName);
    if (!result)
    {
        _tprintf(L"Can't delete file. using DeleteFile(). Trying to locate process and kill it\n");
        result = KillFileProcess(FileName);
        if (!result)
            _tprintf(L"Couldn't find the process\n");
        else
        {
            Sleep(1000);
            result = DeleteFile(FileName);
            if (result)
                _tprintf(L"DeleteFile success");
            else
                _tprintf(L"DeleteFile  ============== failed ===============");

        }
    }
    return result;
}
BOOL TerminateProcess(DWORD dwProcessId, UINT uExitCode)
{
    DWORD dwDesiredAccess = PROCESS_TERMINATE;
    BOOL  bInheritHandle = FALSE;
    HANDLE hProcess = OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
    if (hProcess == NULL)
        return FALSE;

    BOOL result = TerminateProcess(hProcess, uExitCode);

    CloseHandle(hProcess);

    return result;
}

Answer 2

Yes, you can in general just use the openfiles command, after having enabled collection of this information via, it appears, openfiles /local on.

In Windows NT up to and including (it seems) Windows XP there was a similar Resource Kit command named oh, short for open handles.

An alternative to both is to use SysInternal's Process Explorer.

---

Note: In some cases openfiles will fail to list some handle. This happens for me when Windows refuses to unmount an USB disk, claiming that some process is using a file on that disk. No such process ever shows up.