Anyone who has to use Windows and suffers this, PowerToys is your friend. Locksmith identifies what’s locking your file and allows you to free it up. Dunno why PowerToys isn’t bundled by default tbh.
Dunno why PowerToys isn’t bundled by default tbh.
PowerToys give the user more power, which goes directly against Microsoft’s own goal.
Also, less seriously, “toys” implies the user might enjoy the experience, and you know they can’t let that happen.
Shut up. It is literally made by Microsoft. As a place to experiment what to include in Windows. Don’t argue with strawmen
Shut up. I also think power toys that feature basic functionality and have been around for decades should be included in Windows. I can’t always install this on a computer that needs it.
Psexec can be pretty dangerous. Psexec.exe -i -s gives you access to the NTAUTHORITY/SYSTEM account, which is higher than Administrator. One time at work I was trying to do something and was getting permission denied so I decided to use that to get around the problem, I got to spend the afternoon talking to our security administrator because he got a bunch of alerts from our antivirus.
Never thought about that, but since these tools just work, when you copy them to your PC… how does psexec do that? It’d either need you to be an administrator (and then it’s not really a privilege escalation as you could have registered any program into the task scheduler or as a service to run as SYSTEM) or it’d need a delegate service, that should only be available when you use an installer - which again wasn’t was has been done when just copying the tool.
I always thought it wasn’t included by default to mitigate malware damage to a system. Malware needs to be just a little bit more advanced if it can’t hijack Powertools to do what it wants
Any self-respecting malware writer will download and decompile the Powertools to find out what API calls are being used. Especially if they’re calls to an undocumented API.
Having Powertools on your computer is thus not the security hole it might appear to be.
The fact they exist at all - well that’s not really a security hole either. Their existence just more quickly dissolves any security-by-obscurity that might have existed. Someone would have found those calls another way.
One might suppose that they contain something special that’s not in the stock OS, but then we’re back to the malware writer’s reverse engineering which would lead them to learn and implement their own versions of whatever it is that Powertools does.
will download and decompile the Powertools
PowerToys is open-source, so no need to decompile. https://github.com/microsoft/PowerToys.
This is the code that determines which processes are holding on to the specified files (or any files in the specified folders): https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithLibInterop/FileLocksmith.cpp#L18
Called from the UI code here: https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithUI/ViewModels/MainViewModel.cs#L112 which also has the code to kill the processes
I would not say
any self-respecting malware writer will download [powertools] and…
I’m not as familiar with mass-market malware, but APT-level gear generally doesn’t try to make use of such easily observed events. The more network traffic malware appropriates, the greater the probability that it’s caught.
Simply put, Powertools puts several functions within arms reach for malware looking to stay under the radar. Without it, malware needs to bring more of its own code which increases footprint. Living off the land exploits in particular love the presence of these kinds of programs
mv: cannot move 'a' to 'b': Device or resource busy
Sorry, but disk erasure is not available in the trial version of Disk© Partition® Wizard™ 2002. To use this feature, please upgrade to Disk© Partition® Wizard™ Pro 2002 for just $49.99 at Whythefuckdoievenneedthis.co.uk/shop
Nowadays it would be $19.99 per month and it’s a one year contract that renews three months before expiration.
My first attempt at running Arch, I managed to fuck it up so badly that I had to write a script to write zeros to every bit of my HDD. Fun times.
Honestly don’t even remember, but it was in my peak “know enough to be dangerous” days in college. I almost certainly didn’t have to go that nuclear to fix it, but that’s what I did.
Take 2 of Arch, after that wipe was completed, went pretty well. It revived an old piece of shit laptop for another few years before its motherboard gave out.
I’ll wager guess it was something to do with confusing GPT and MBR partitioning. There was a time where some BIOSs and loaders only understood or preferred one over the other, leading to weird incongruences depending on what you’re using to look at the disk. You have to actually overwrite the partition tables to get a clean start.
“oh you want to delete your entire root directory lol go right ahead”
