Safe-deleting unmovable or locked Windows files on the next reboot is natively handled by the Windows Session Manager (smss.exe) using the MOVEFILE_DELAY_UNTIL_REBOOT API flag. This mechanism queues the deletion or renaming of system files and in-use malware components before the main operating system finishes loading and locks them.
There are three ways to execute this operation: using official Microsoft utilities, editing the Registry manually, or utilizing Command Prompt.
Method 1: The Easiest Way (Using Microsoft Sysinternals MoveFile)
Microsoft provides a tiny command-line utility called MoveFile specifically designed to queue locked files for deletion on reboot.
Download the tool from the official Microsoft Sysinternals PendMoves and MoveFile page.
Extract the file and open Command Prompt as an Administrator.
Run the tool using the target file path, specifying an empty pair of quotation marks ”” as the destination to signal a deletion: movefile.exe C:\Path\To\Your\LockedFile.sys “” Use code with caution.
Restart your computer. The file will vanish prior to login.(Note: To verify your scheduled deletions beforehand, you can run the accompanying pendmoves.exe tool.) Method 2: The Direct Native Way (Via Registry Editor)
If you prefer not to download any tools, you can manually write to the Windows Registry value that controls boot-time file operations.
Press Win + R, type regedit, and press Enter to open the Registry Editor. Navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager Use code with caution.
Look for a Multi-String Value (REG_MULTI_SZ) named PendingFileRenameOperations. If it does not exist, right-click an empty space, choose New > Multi-String Value, and name it exactly that. Double-click PendingFileRenameOperations to edit it.
Under Value data, type the raw path of the file prefixed with \??</code> (do not use quotes): \??\C:\Path\To\Your\LockedFile.sys Use code with caution.
Click OK. Right-click the same entry and select Modify Binary Data.
Go to the very end of the binary string and type 00 00 (four zeros) to tell Windows that this file has a null destination and should be deleted rather than renamed. Click OK. Reboot the PC to trigger the deletion. Method 3: The Command Line Alternative (Via RE/Safe Mode)
Leave a Reply