Files that are in use by a program are locked from being changed by other programs. Usually this is a good thing but sometimes you have a file that is locked when you don't think it should be. What is using that file? Is it malicious?

There are several ways to identify which program is locking-up a file:

• OH.EXE from the 2000 and 2003 resource kit

• NET SESSION at the command line

• NET FILE at the command line

• HANDLE.EXE from www.sysinternals.com

• PROCESSEXPLORE.EXE from www.sysinternals.com

• PROCESSMONITOR.EXE from www.sysinternals.com

• COMPMGMT.MSC and "shared folders" -> "open files"

• FSMGMT.MSC

To get a list of programs that hold a specific file open:
C:\> oh <locked file>