Boot Into Safe And Try To Rename It !

takeown /F D:\folder ,<<-- http://windowsitpro.com/article/art.../in-windows-vista-how-can-i-take-ownership-of-a-file-from-the-command-line.html

Open Command Prompt and type
takeown /?
cacls /?

 

Try taking ownership. This needs to be done quite a bit in Vista, so if you want you can use this to add the option to your context menu instead of doing it manually:
Vista Take Ownership Context Menu

 

d_h:
Will do.

Logged on as "Administrator", I have created 2 screen shots of catroot2's security tab for "administrators" and "users"

I want to take ownership of c:\windows\system32\catroot2

What do you suggest that I type?
I theorize:
open command prompt
type: cd\
press "enter"
type: takeown /f /r c:\windows\system32\catroot2
Press "enter"

Thanks for the link. I am glad it has an example.
WHEW!

RF123

 

Click the Advanced button and then the Ownership tab. You don't need the command prompt if you went this far.

The context menu addition above makes all of this easy.

 

E:
!
Hi there!

Thanks.

Destination - access denied refers to my attempt to rename catroot2 to catroot2_old; within Windows Explorer.

I tried, but failed.

I tried your way.

I tried using the command prompt.
Same error message [ see screen shot ] before and after trying your suggestion, E.

RF123

 

I would suggest you try booting with something like winpe or bartpe (google for them) and doing the operation from there.

It's not hard to make a pre-execution boot up disk and it is so useful for many things.

You may also want to try xcacls which I've had success with:

http://support.microsoft.com/kb/318754

 

DD:
Thanks for the link; interesting article.

I am not interested in using a PE disk, because I don't want to mess up Vista's core.

RF123

 

You need to turn off a service that is accessing the folder. I'll try to find out which and let you know.

 

Start > Run: cmd

At the prompt:

net stop cryptsvc

Rename the folder (or delete it).

Then, back to your command prompt.

net start cryptsvc

 

E:
d_h: had suggested I try to rename in safe mode. I forgot to note that I tried, and failed.

I forgot to mention, when I tried to stop cryptsvc, previoulsy, the "system error 5" message appeared.

I tried your steps.
ARGH!!!!!!!!!

**************************************
Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Users\UN>cd\

C:\>net stop cryptsvc
The following services are dependent on the Cryptographic Services service.
Stopping the Cryptographic Services service will also stop these services.

Panda TPSrv
Panda Software Controller

Do you want to continue this operation? (Y/N) [N]: y
System error 5 has occurred.

Access is denied.

C:\>

**************
RF123

 

E:
This thread http://forums.techarena.in/showthread.php?t=595122 suggests running as elevated privileges, whatever that means.
I ran "cmd" as administrator, but received the same "system error 5" message.

I switched users, to "Administrator"; same result.

I will disable UAC; restart & try again.

RF123

 

E:
WITH
1. UAC disabled;
2. In SAFE MODE;
3. NET STOP cryptsvc run

I was able to rename catroot2.

Perhaps the 2 Panda services played a part.

catroot2 remained renamed. A new "catroot2" folder is present.

WHEW!

RF123

 

Yes, most people don't have the Panda services, of course, and I never knew that they were dependencies of the cryptographic service. Most AV's are notoriously difficult to terminate for good reason. They don't want viruses turning them off. So, to end one of these services, it usually means that you have to disable them in services.msc and then reboot.

Thanks for the followup info.

 

E:
Thank you very much for your guidance!
:up:

In my summary, I forgot to mention that taking ownership may have also played a role.

d_h:
Thanks for your assistance, as well.
:up:

RF123

 

E:
How did you determine that cryptosvc was involved with the renaming process?

RF123

 

Glad you're sorted, but I was only suggesting using a PE disk to gain full control of the hard disk - nothing more.

Cheers,

Dan

 

DD:
Thanks.

I apologize if I did not state my position clearly. Vista seems so particular about that which happens to its files that I did not want to cause a major problem by using a straightforward solution such as yours. I could have removed the HDD, slaved it into another VISTA COMPUTER [ Sorry for the caps, my computer becomes weird sometimes. ] and probably renamed Catroot2.

Thanks again.

RF123

RF123

 

Fair enough, I get you now - although I do not believe that the renaming of one folder (in other words nulling its existence as far as Vista is concerned) would have caused any issue. Once again, glad it's all sorted

 

DD:
I have seen too many things blow up for seemingly unlikely reasons; XP blew up because of a mouse driver, for example.

Remember, Murphy was an optimist.



Best of success.
:up:

RF123

 

E:
How did you determine that cryptosvc was involved with the renaming process?

RF123

I remembered the fix and did a search for "catroot2" to find out which it was.

 

E:
Thanks for helping me learn.

Did you search on catroot2, or catroot2 "net stop", or something else?

My error; cryptsvc, not cryptosvc

RF123

 

Just "catroot2". I tried OpenFilesView to see what was accessing the folder, but it didn't narrow it down any finer than "svchost.exe" which, of course, hosts cryptsvc.exe.

 

E:
Again, you demonstrate your amazing mental capabilities.

Thanks again.
:up:

RF123