Ransomware Won't Delete? Force Remove Locked Files Now

EP
Erropedia Team
📅 August 11, 2026 📅 Updated Sep 14, 2026 👁 37 views Cybersecurity & Malware Intermediate
Locked ransomware files won't delete. Start with a quick unlock, then kill the process, or go nuclear with a bootable scan. Here's the order that works.

The 30-Second Fix: Unlock the File and Delete

Most of the time, the file isn't actually being protected by the ransomware. It's just locked by a running process or a permission flag. Windows throws the "File in Use" or "Access Denied" error and you assume the worst. The culprit here is almost always a leftover process that didn't exit cleanly.

First, try the simplest thing: rename the file. Right-click and rename it to something like test.txt. If that works, you can delete it. If you get an error, move to the unlock tool.

Grab a portable tool like LockHunter or OpenedFilesView. These tools show you which process has the file locked, and let you kill it from the right-click menu. I like LockHunter because it adds a right-click option directly. Install it, right-click the stuck file, choose What is locking this file?, and then click Unlock It! That usually releases the handle and you can delete the file normally.

Don't bother with trying to change file permissions manually. If the ransomware is still running, it will just re-lock the file. Kill the process first.

The 5-Minute Fix: Kill the Ransomware Process in Safe Mode

If the quick unlock didn't work, the ransomware is probably still running in the background. Booting into Safe Mode with Networking is the move here. Safe Mode loads only essential drivers and services, so most ransomware won't start.

  1. Open msconfig (Win+R, type msconfig), go to the Boot tab, check Safe boot and select Minimal. Click OK and restart.
  2. Once in Safe Mode, open Task Manager (Ctrl+Shift+Esc) and look for any suspicious processes. Ransomware often uses random names like svchost.exe in weird locations or random alphanumeric names. Check the CPU usage — anything pegging at 100% is suspect.
  3. Right-click the suspicious process and choose End task.
  4. Now try to delete the files. Shift+Delete bypasses the Recycle Bin entirely.

If you can't identify the process, use Process Explorer from Microsoft Sysinternals. It shows you the path of every running process. Anything running from AppData\Local\Temp, ProgramData, or a hidden folder is a red flag. Right-click, go to Properties, and check the path.

After killing the process, immediately disconnect from the network. You don't want the ransomware calling home or spreading to network shares.

The 15-Minute Fix: Boot from a Rescue USB

If you're still stuck, the ransomware is either deeply embedded or you're dealing with a variant that survives Safe Mode. This is where I go nuclear: a bootable rescue environment.

Use Kaspersky Rescue Disk or Bitdefender Rescue CD. These boot directly from USB and don't touch the infected Windows installation until you run the scan. The ransomware can't run because the OS isn't loaded.

Build the USB on a clean machine

  1. Download the ISO from the vendor's site. Don't download from random forums — only official sources.
  2. Use Rufus to write the ISO to a USB stick. Rufus is free and fast. Select the ISO, leave the default partition scheme (GPT for UEFI, MBR for legacy), and hit Start.
  3. Boot the infected machine from the USB. You may need to press F12 (Dell), Esc (HP), or F2 (Lenovo) to get the boot menu. If it doesn't work, check the BIOS settings.
  4. Once the rescue environment loads, run the scanner. It will find and quarantine the ransomware files. After the scan, reboot into Windows and try deleting the files again.

This method is the most reliable because it bypasses the OS entirely. I've seen ransomware that hooks into the file system at a low level, and only a bootable scan can catch it.

When to Give Up and Reimage

Here's the blunt truth: if the ransomware encrypted your files, deleting the ransomware doesn't bring them back. You're looking at either paying the ransom (don't) or restoring from backups. If you don't have backups, you might be SOL.

Also, if the ransomware is a new variant that's not detected by any scanner, you could spend hours fighting it. My rule: if you can't clean it within 30 minutes, back up any non-encrypted files you need, then wipe the drive and reinstall Windows. It's faster and you know the machine is clean.

One more thing — after you've deleted everything, check your scheduled tasks and startup entries. Ransomware often drops a persistence mechanism. Use Autoruns to review what starts with Windows. Disable anything that looks suspicious. That closes the door for reinfection.

Final Word

Running a scan with your regular antivirus after the fact is okay, but don't rely on it to catch everything. The steps above are the ones I trust. Start with the unlock tool, then kill the process in Safe Mode, and if that fails, go with the bootable rescue. Nine times out of ten, you'll win. The tenth time, reimage.

Keep a USB rescue disk ready before you need it. It's a five-minute investment that saves you a headache later.

Related Errors in Cybersecurity & Malware
0X8009000E NTE_NO_MEMORY 0x8009000E: Fix Crypto Memory Errors in Windows 0X0000070F Fix ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT (0X0000070F) STOP: 0x0000007B or WannaCry Ransomware Notice SMBv1 WannaCry Alert: Disable Old Protocol on Windows 0XC0000320 STATUS_PKINIT_FAILURE (0XC0000320) Fix for Kerberos Auth
ransomware file locked delete ransomware files remove ransomware virus unlock locked files ransomware cleanup kill ransomware process bootable antivirus Windows safe mode delete file permission denied ransomware decrypt ransomware files

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.