Unable to delete 3 files in Root and Users folders

Hi @Chuck Balogh

The fact that the files can be deleted but then reappear changes the troubleshooting direction. Instead of trying increasingly aggressive ways to delete them, first identify which process is recreating them.

Running Microsoft Defender Offline as you've planned is a good precaution. The offline scan restarts Windows into the Defender recovery environment and scans without normal Windows processes running, which can help detect malware that hides while Windows is active.

After that, if Defender doesn't find anything, use Microsoft's Process Monitor (ProcMon). It records real-time file-system, Registry, and process activity, so it can show exactly which executable creates or writes those files.

Download/run Process Monitor as administrator, then add a filter for the exact filename, for example:

Path contains <exact filename> Include

Delete the file and leave ProcMon running until it reappears. Then look for operations such as:

CreateFile, WriteFile, and SetDispositionInformationFile

The Process Name column should identify the executable responsible for recreating it.

Also check Autoruns. It shows startup applications, scheduled tasks, services, drivers, Run/RunOnce entries, and many other locations where software can launch automatically. Its option to hide Microsoft-signed entries is particularly useful for narrowing the investigation to third-party software.

Don't manually delete or disable anything found by ProcMon/Autoruns until you've identified what it belongs to. A legitimate application can also recreate temporary, diagnostic, or configuration files, so recurrence alone doesn't prove malware.

Could you also provide the exact filenames and full paths of all six files? For example:

C:\filename.log

C:\Users\filename.txt

The filenames may immediately identify the application responsible.

If possible, right-click each file and check Properties > Details, and open the .log and .txt files in Notepad. Their contents may contain an application name, process path, timestamp, or other clue. Don't post anything containing passwords, tokens, email addresses, or other personal information.

Since SFC already found corruption, after Defender finishes, also run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

again and verify that SFC subsequently reports no integrity violations. But don't expect SFC/DISM to solve files being recreated by a third-party process.

So your next step would be Defender Offline → ProcMon reproduction → identify the process → investigate that process/startup entry rather than repeatedly deleting the files.

References:

Process Monitor - Microsoft Sysinternals

Autoruns - Microsoft Sysinternals

Microsoft Sysinternals Utilities

=============================================================================

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.