How to delete folder that has virus

The folder is likely blocked by NTFS permissions or by something still using it. Use the following steps to both clean the system and force-delete the folder.

1. Scan and clean the system

• Run a full scan with Microsoft Defender (and any other trusted AV already installed) to remove active malware first.
• Restart the device after cleaning so any malicious processes are stopped.

2. Take ownership and grant full control If the folder is on an NTFS volume and access is denied because of its ACL:
3. Open an elevated Command Prompt (Run as administrator).
4. Take ownership of the folder: cmd

takeown /f "C:\path\to\virus-folder" /r /d y

3. Grant Administrators full control using `cacls` (or `icacls` on newer systems):
```cmd
cacls "C:\path\to\virus-folder" /t /g administrators:F

This rewrites the ACL so Administrators have full control and can delete it. 4. Try deleting the folder again in File Explorer or with:

rd /s /q "C:\path\to\virus-folder"

3. If the folder is “in use” If the error indicates the source file is in use, a process may still have a handle open:
4. Restart the device and try deleting immediately after sign-in.
5. If it still fails, boot into Safe Mode and delete the folder there.
6. If the file system is corrupted If deletion still fails and there are signs of disk or file system issues:
7. Open an elevated Command Prompt.
8. Run CHKDSK on the volume (example for C:): cmd

chkdsk C: /f

3. If prompted to schedule at next restart, press `Y` and restart. After CHKDSK completes, try deleting the folder again.

5. If the folder is on a mounted volume
If the folder is on a mounted drive (mounted into a folder instead of a drive letter) and you see “Access is denied” when deleting via Explorer:
- Delete it using one of these methods (note: this permanently deletes the data):
- Select the folder in Explorer and press `Shift+Delete`.
- Or use an elevated Command Prompt:
 ```cmd
rd /s /q "C:\mount-point\virus-folder"

6. If the folder name is invalid (strange trailing space/period) If the folder name looks odd (for example, has a trailing space or period) and won’t delete normally:
7. Use the extended path syntax in an elevated Command Prompt:

del "\\?\C:\path\to\problem-folder"
rd  "\\?\C:\path\to\problem-folder" /s /q

This bypasses normal Win32 name parsing and can remove names with trailing spaces/periods.

7. If all else fails

• Ensure the system is clean (Defender full scan, no active malware).
• Back up important data.
• Consider a repair install or reset of Windows if system behavior remains unstable after malware removal.

References:

• You can't delete a file or a folder on an NTFS file system volume
• How to delete a Windows Live OneCare Backup file
• "Access Denied" When You Delete Folders from a Mounted Drive
• Virus alert about the Win32/Conficker worm