I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute itself in Windows?
Unless you have some program that is able to run compressed programs from archive, no it can't.
You inability to suppress the file is more likely due to the fact that the file itself is being used or access restricted by some program (e.g. antivirus quarantine).
Normally a program cannot execute itself, but must be launched from something else(*). That something else is normally:
- a command line shell (
/bin/sh(or bash, zsh, etc.) )
- a GUI explorer (Windows explorer, gnome file manager, etc.)
Those can only start programs in a standard executable format.
But a program can also be started by another program that starts it as a child subprocess. Here almost everything is possible, because it depends how that other program was designed. Anyway, on common operating system (at least Windows and Unix or Unix-like), the system can only execute an uncompressed file, so in that case, the launcher program should first unzip the file in a temporary one and then execute the temporary. That means that the zipped file should not be kept open, because the system does not use it directly.
TL/DR: A zipped file could probably be executed via a specialized laucher, but even in that case, it is very unlikely that it would be kept open all its execution time: it should be kept open only for being uncompressed.
(*) beware, the launcher could be a normal program such as a mail reader or a browser, through an exploitable vulnerability