cannot delete empty folders - until 'later'

Recent migration to W2K SP4 had me moving/sorting
files and folders. After a folder was emptied, I
could not delete it, as administrator, until the
next day.

What's going on?

RL

legg
Sat Mar 15 06:37:42 PDT 2008

I recall having the same problem with re-naming
recently moved folders, hence the 'empty' ones
with the wrong names, needing deletion.

Same question.....what's going on?

RL

John
Sat Mar 15 05:40:14 PDT 2008

In other words you couldn't delete it until you logged off and back or
or until you rebooted the machine? Something must have had an open
handle on the folder.

John

legg wrote:

> Recent migration to W2K SP4 had me moving/sorting
> files and folders. After a folder was emptied, I
> could not delete it, as administrator, until the
> next day.
>
> What's going on?
>
> RL

Andrew
Sat Mar 15 06:02:30 PDT 2008

In article <j5knt3hq9tgha41h9s3o8m3hmtmk10qtqg@4ax.com>,
legg@nospam.magma.ca says...
> I recall having the same problem with re-naming
> recently moved folders, hence the 'empty' ones
> with the wrong names, needing deletion.
>
> Same question.....what's going on?

How did you delete/rename? If you used a command prompt, did you close
the prompt or at least CD to another directory? As John John mentioned,
something was probably holding something in the directory, or the
directory itself, open. I've found Outlook can do that when you save or
read attatchments, especially if Word is your editor, and not just the
built-in editor.

There are several process explorer style programs you can use to check
open handles, and find out what program is blocking the directory or
file(s) from being deleted.

If you have a network share to your computer, you can look in Computer
Management to see what files are open on your shared directories.

--
If there is a no_junk in my address, please REMOVE it before replying!
All junk mail senders will be prosecuted to the fullest extent of the
law!!
http://home.att.net/~andyross

John
Sat Mar 15 06:50:58 PDT 2008

Adjust your clock, you're posting in the future.

As mentioned by Andrew, the application that you use to rename or delete
files may be keeping an open handle on the files or folders. Tools like
OH.exe, Handle or Process Explorer can reveal the handles.

Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Handle v3.20
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx

Open Handles (oh.exe): This command-line tool shows the handles of all
open windows. The tool can also be used to show only information that
relates to a specific process, object type, or object name. To download
this tool, click the following link:
http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe

Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

John

legg wrote:

> I recall having the same problem with re-naming
> recently moved folders, hence the 'empty' ones
> with the wrong names, needing deletion.
>
> Same question.....what's going on?
>
> RL

legg
Sat Mar 15 09:34:09 PDT 2008

On Sat, 15 Mar 2008 10:50:58 -0300, John John
<audetweld@nbnet.nb.ca> wrote:

>Adjust your clock, you're posting in the future.

Eastern Daylight Savings Time...seems to check out
from this end, and on all message time stamps.

>
>As mentioned by Andrew, the application that you use to rename or delete
>files may be keeping an open handle on the files or folders. Tools like
>OH.exe, Handle or Process Explorer can reveal the handles.
>
>Process Explorer for Windows v10.21
>http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx
>
>Handle v3.20
>http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx
>
>Open Handles (oh.exe): This command-line tool shows the handles of all
>open windows. The tool can also be used to show only information that
>relates to a specific process, object type, or object name. To download
>this tool, click the following link:
>http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe
>
>Windows Server 2003 Resource Kit Tools
>http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
>

No special processes being used. Just explorer.

Will give the recommended tools a try.

Checking permissions was the first thing I tried.
This thing is not yet on a network; there are no
users set up, save the administrator and no
sharing has been assigned.

No such trouble on the machine the files
originated from (via hard disk temporary
relocation), and in many specific cases these
were/are new folders and files created for
updating hardware drivers.

Thanks.

John
Sat Mar 15 10:24:58 PDT 2008

legg wrote:

> On Sat, 15 Mar 2008 10:50:58 -0300, John John
> <audetweld@nbnet.nb.ca> wrote:
>
>
>>Adjust your clock, you're posting in the future.
>
>
> Eastern Daylight Savings Time...seems to check out
> from this end, and on all message time stamps.

Hmmm. Looking at it from this ends it appears that Andrew and I have
replied to your posts before you even asked a question or reported a
problem! I replied to your 10:32AM post at 9:40AM and Andrew replied to
your 10:37AM post at 10:02AM, I may have to check my crystal ball to see
if it's cracked...


> No special processes being used. Just explorer.
>
> Will give the recommended tools a try.
>
> Checking permissions was the first thing I tried.
> This thing is not yet on a network; there are no
> users set up, save the administrator and no
> sharing has been assigned.
>
> No such trouble on the machine the files
> originated from (via hard disk temporary
> relocation), and in many specific cases these
> were/are new folders and files created for
> updating hardware drivers.

Checking the permissions was a good troubleshooting measure but being
that you can delete the folders after a reboot I don't think that this
is a permissions issue, your investigation seems to have confirmed this.

John

legg
Mon Mar 17 12:19:52 PDT 2008

On Sat, 15 Mar 2008 10:50:58 -0300, John John
<audetweld@nbnet.nb.ca> wrote:

>Adjust your clock, you're posting in the future.
>
>As mentioned by Andrew, the application that you use to rename or delete
>files may be keeping an open handle on the files or folders. Tools like
>OH.exe, Handle or Process Explorer can reveal the handles.
>
>Process Explorer for Windows v10.21
>http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx
>
>Handle v3.20
>http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx
>
>Open Handles (oh.exe): This command-line tool shows the handles of all
>open windows. The tool can also be used to show only information that
>relates to a specific process, object type, or object name. To download
>this tool, click the following link:
>http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe
>
>Windows Server 2003 Resource Kit Tools
>http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
>
I'd updated the time displayed, manually. Have
just run the DST patch. Perhaps this helps time
stamps. My news agent may have a mind of its own.

Running SysInternal's Process Explorer reveals no
handles.

Folders whose contents are emptied/transferred can
still not be deleted, until reboot.

I disabled some Seagate acronis disk imaging tools
that were hovering in the background, without
effect. Open processes are listed below.

RL

Process PID CPU Description Company
Name
System Idle Process 0 98.44
Interrupts n/a 1.56 Hardware
Interrupts
DPCs n/a Deferred Procedure Calls
System 8
SMSS.EXE 384 Windows NT Session
Manager Microsoft Corporation
CSRSS.EXE 412 Client Server
Runtime Process Microsoft Corporation
WINLOGON.EXE 432 Windows NT Logon
Application Microsoft Corporation
SERVICES.EXE 460 Services
and Controller app Microsoft Corporation
svchost.exe 648 Generic
Host Process for Win32 Services Microsoft
Corporation
spoolsv.exe 688 Spooler
SubSystem App Microsoft Corporation
schedul2.exe 716 Acronis
Scheduler 2 Acronis
svchost.exe 756 Generic
Host Process for Win32 Services Microsoft
Corporation
FormatM.exe 788 MacOpener
Mac Formatter DataViz Inc.
nod32krn.exe 812 NOD32
Kernel Service Eset
nvsvc32.exe 872 NVIDIA
Driver Helper Service, Version 91.48 NVIDIA
Corporation
PERSFW.exe 884 Kerio Personal
Firewall Engine Kerio Technologies
regsvc.exe 564 Remote Registry
Service Microsoft Corporation
mstask.exe 932 Task Scheduler
Engine Microsoft Corporation
WinMgmt.exe 996 Windows
Management Instrumentation Microsoft
Corporation
svchost.exe 1072 Generic
Host Process for Win32 Services Microsoft
Corporation
LSASS.EXE 472 LSA Executable and
Server DLL (Export Version) Microsoft
Corporation
procexp.exe 1324 Sysinternals
Process Explorer Sysinternals -
www.sysinternals.com
agent.exe 1680 Forte Agent Forte
Internet Software Inc.
explorer.exe 1292 Windows Explorer
Microsoft Corporation

John
Mon Mar 17 12:53:14 PDT 2008

legg wrote:

> On Sat, 15 Mar 2008 10:50:58 -0300, John John
> <audetweld@nbnet.nb.ca> wrote:
>
>
>>Adjust your clock, you're posting in the future.
>>
>>As mentioned by Andrew, the application that you use to rename or delete
>>files may be keeping an open handle on the files or folders. Tools like
>>OH.exe, Handle or Process Explorer can reveal the handles.
>>
>>Process Explorer for Windows v10.21
>>http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx
>>
>>Handle v3.20
>>http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx
>>
>>Open Handles (oh.exe): This command-line tool shows the handles of all
>>open windows. The tool can also be used to show only information that
>>relates to a specific process, object type, or object name. To download
>>this tool, click the following link:
>>http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe
>>
>>Windows Server 2003 Resource Kit Tools
>>http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
>>
>
> I'd updated the time displayed, manually. Have
> just run the DST patch. Perhaps this helps time
> stamps. My news agent may have a mind of its own.
>
> Running SysInternal's Process Explorer reveals no
> handles.
>
> Folders whose contents are emptied/transferred can
> still not be deleted, until reboot.
>
> I disabled some Seagate acronis disk imaging tools
> that were hovering in the background, without
> effect. Open processes are listed below.
>
> RL
>
> Process PID CPU Description Company
> Name
> System Idle Process 0 98.44
> Interrupts n/a 1.56 Hardware
> Interrupts
> DPCs n/a Deferred Procedure Calls
> System 8
> SMSS.EXE 384 Windows NT Session
> Manager Microsoft Corporation
> CSRSS.EXE 412 Client Server
> Runtime Process Microsoft Corporation
> WINLOGON.EXE 432 Windows NT Logon
> Application Microsoft Corporation
> SERVICES.EXE 460 Services
> and Controller app Microsoft Corporation
> svchost.exe 648 Generic
> Host Process for Win32 Services Microsoft
> Corporation
> spoolsv.exe 688 Spooler
> SubSystem App Microsoft Corporation
> schedul2.exe 716 Acronis
> Scheduler 2 Acronis
> svchost.exe 756 Generic
> Host Process for Win32 Services Microsoft
> Corporation
> FormatM.exe 788 MacOpener
> Mac Formatter DataViz Inc.
> nod32krn.exe 812 NOD32
> Kernel Service Eset
> nvsvc32.exe 872 NVIDIA
> Driver Helper Service, Version 91.48 NVIDIA
> Corporation
> PERSFW.exe 884 Kerio Personal
> Firewall Engine Kerio Technologies
> regsvc.exe 564 Remote Registry
> Service Microsoft Corporation
> mstask.exe 932 Task Scheduler
> Engine Microsoft Corporation
> WinMgmt.exe 996 Windows
> Management Instrumentation Microsoft
> Corporation
> svchost.exe 1072 Generic
> Host Process for Win32 Services Microsoft
> Corporation
> LSASS.EXE 472 LSA Executable and
> Server DLL (Export Version) Microsoft
> Corporation
> procexp.exe 1324 Sysinternals
> Process Explorer Sysinternals -
> www.sysinternals.com
> agent.exe 1680 Forte Agent Forte
> Internet Software Inc.
> explorer.exe 1292 Windows Explorer
> Microsoft Corporation

What are these undeletable folders? What error messages are you getting
when you try to delete them? How about the Event Viewer, are any errors
showing in the logs?

How are you deleting the files and folders, with Explorer.exe or with
another application? Can you use the RD command at the command prompt
to delete the folders? If no what does the RD command return?

Try using the Task Manager and Kill Explorer.exe and its process tree,
then, using the File | New Task menu, restart Explorer.exe again and see
if you can delete the folders.

Try the other Handle tools on the actual folders to make sure that there
are no handles on the folders, try using OH.exe on the actual folder
instead of querying processes.

John

legg
Mon Mar 17 14:34:43 PDT 2008

On Mon, 17 Mar 2008 16:53:14 -0300, John John
<audetweld@nbnet.nb.ca> wrote:


>
>What are these undeletable folders? What error messages are you getting
>when you try to delete them? How about the Event Viewer, are any errors
>showing in the logs?

It doesn't seem to matter what the folder is, or
where. (C:\, other drives, floppy) If I move its
non-executable (pdf txt doc etc) contents to a
renamed folder, the emptied folder cannot be
deleted or renamed, using the standard windows
explorer GUI. I am not opening the 'windows
explorer' process, just using the standard desktop
GUI, which is the explorer process listed in the
SysInt report.

>
>How are you deleting the files and folders, with Explorer.exe or with
>another application? Can you use the RD command at the command prompt
>to delete the folders? If no what does the RD command return?

The error message is "Cannot delete <folder name>:
There has been a sharing violation. The source or
destination file may be in use."

If I then move the original contents back into the
original folder, I am prevented from deleting the
now-empty new folder. If I attempt to move the
now-empty new folder to a new directory, I get the
same error message, but, strangely, the move is
completed. The empty folder can then be deleted
without errors.

I have used no command instructions and am
basically ignorant of all but the simplest
functions used in performing tasks off a boot
floppy.

>
>Try using the Task Manager and Kill Explorer.exe and its process tree,
>then, using the File | New Task menu, restart Explorer.exe again and see
>if you can delete the folders.
>
>Try the other Handle tools on the actual folders to make sure that there
>are no handles on the folders, try using OH.exe on the actual folder
>instead of querying processes.

Attempts to use the OH.exe resulted in rapid
display and termination of the dos window that
were unreadable and left no identifiable log
results.

TaskInfo.exe, normally resident on this machine,
sees innumerable handles associated with each
process, previously listed. How would one handle
be identified as having relevance to file
deletion, relocation or renaming processes?

RL

legg
Mon Mar 17 15:20:23 PDT 2008

On Mon, 17 Mar 2008 16:53:14 -0300, John John
<audetweld@nbnet.nb.ca> wrote:


>
>What are these undeletable folders? What error messages are you getting
>when you try to delete them? How about the Event Viewer, are any errors
>showing in the logs?

I made a couple of failed folder manipulation
operations while composing the last message, but
there are no events listed by event viewer within
two hours of that time.

RL

John
Mon Mar 17 17:31:21 PDT 2008

legg wrote:


> Attempts to use the OH.exe resulted in rapid
> display and termination of the dos window that
> were unreadable and left no identifiable log
> results.

Issue OH against the name of the file or folder, for example:

OH filename

or

OH Foldername

If there are spaces in the object name surround it with quotation marks:

OH "Folder Name"

You may find that SysInternals Handle works better than OH.exe, both are
used at the Command Prompt, Handle.exe handles fully qualified paths and
returns an easier to read output:

Handle C:\Foldername\filename

John

John
Mon Mar 17 18:16:41 PDT 2008

legg wrote:

> I disabled some Seagate acronis disk imaging tools
> that were hovering in the background, without
> effect. Open processes are listed below.

> System Idle Process
> System
> SMSS.EXE
> CSRSS.EXE
> WINLOGON.EXE
> SERVICES.EXE
> svchost.exe
> spoolsv.exe
> schedul2.exe Acronis
> Scheduler 2 Acronis
> svchost.exe
> FormatM.exe MacOpener Mac Formatter DataViz Inc.
> nod32krn.exe NOD32 Kernel Service Eset
> nvsvc32.exe NVIDIA Driver Helper Service,
> PERSFW.exe Kerio Personal Firewall Engine


**********************************************
> regsvc.exe Remote Registry Service

Why do you have this running? Is your machine part of a domain or is it
administered remotely by another machine on a LAN? It most probably has
nothing to do with your folder deletion problem but this service should
not be running unless you have very good reasons to want it running, for
most parts it just presents an additional unwanted security risk.


*************************************************
> mstask.exe Task Scheduler
> WinMgmt.exe Windows Management Instrumentation
> svchost.exe Generic Host Process for Win32 Services
> LSASS.EXE LSA Executable and Server DLL
> procexp.exe Sysinternals Process Explorer
> agent.exe Forte Agent Forte
> explorer.exe Windows Explorer

legg
Mon Mar 17 18:25:25 PDT 2008

On Mon, 17 Mar 2008 21:31:21 -0300, John John <audetweld@nbnet.nb.ca>
wrote:


I ran handle.exe v3.3 from the command prompt on an undeletable folder,
created earlier, solely to illustrate the problem:

Handle C:\DOCS\BUSINESS\APPS080317

This returned 13 nearly identical entrys:

explorer.exe PID: 1292 XXX: C:\DOCS\BUSINESS\APPS080317

where XXX is

9C0
9F0
A40
A54
A5C
AC0
ACC
AD0
B04
B0C
B24
B48
B50

This empty folder;
IS currently in it's the original location as listed above;
WAS apparently relocated earlier into C:\DOCS\ (with warnings);
WAS deleted from that new location;
and
DOES currently appear in the recycle bin.

What the hell is going on?

RL

legg
Mon Mar 17 18:41:20 PDT 2008

On Mon, 17 Mar 2008 22:16:41 -0300, John John <audetweld@nbnet.nb.ca>
wrote:


>
>**********************************************
>> regsvc.exe Remote Registry Service
>
>Why do you have this running? Is your machine part of a domain or is it
>administered remotely by another machine on a LAN? It most probably has
>nothing to do with your folder deletion problem but this service should
>not be running unless you have very good reasons to want it running, for
>most parts it just presents an additional unwanted security risk.
>
>
>*************************************************

The nearest it gets to a network is in sharing a NAT router.

There are a lot of processes I'd like to unload from start-up, but this
isn't one I can currently access through familiar methods.

RL

John
Mon Mar 17 19:16:30 PDT 2008

legg wrote:

> On Mon, 17 Mar 2008 22:16:41 -0300, John John <audetweld@nbnet.nb.ca>
> wrote:
>
>
>
>>**********************************************
>>
>>>regsvc.exe Remote Registry Service
>>
>>Why do you have this running? Is your machine part of a domain or is it
>>administered remotely by another machine on a LAN? It most probably has
>>nothing to do with your folder deletion problem but this service should
>>not be running unless you have very good reasons to want it running, for
>>most parts it just presents an additional unwanted security risk.
>>
>>
>>*************************************************
>
>
> The nearest it gets to a network is in sharing a NAT router.
>
> There are a lot of processes I'd like to unload from start-up, but this
> isn't one I can currently access through familiar methods.

It can be disabled or set to Manual Start in the Services Management
Console, to open the console enter services.msc in the Start Menu Run box.

John

John
Mon Mar 17 20:25:28 PDT 2008

legg wrote:
> On Mon, 17 Mar 2008 21:31:21 -0300, John John <audetweld@nbnet.nb.ca>
> wrote:
>
>
> I ran handle.exe v3.3 from the command prompt on an undeletable folder,
> created earlier, solely to illustrate the problem:
>
> Handle C:\DOCS\BUSINESS\APPS080317
>
> This returned 13 nearly identical entrys:
>
> explorer.exe PID: 1292 XXX: C:\DOCS\BUSINESS\APPS080317
>
> where XXX is
>
> 9C0
> 9F0
> A40
> A54
> A5C
> AC0
> ACC
> AD0
> B04
> B0C
> B24
> B48
> B50

Those are just handle ID's, normal but it seems that Explorer has a lot
of open handles on one empty folder. You can run the Handle command
against the process or PID to find out more about the handles:

handle -p 1292

The Explorer PID was obtained from the first output of the command or it
can be obtained from the Task Manager or TLIST command.

You can use the Handle command or Process Explorer to kill the handle
but beware the warning that killing handles may make the system unstable.



> This empty folder;
> IS currently in it's the original location as listed above;
> WAS apparently relocated earlier into C:\DOCS\ (with warnings);
> WAS deleted from that new location;
> and
> DOES currently appear in the recycle bin.

I'm not sure that I follow, "was apparently relocated" by whom or what?


> What the hell is going on?

I don't know, this is unusual behaviour. You say that this happens with
different folders in different locations? Is the machine free of virus
and other pests or spyware? Does this happen in Safe Mode?

John

legg
Tue Mar 18 04:51:43 PDT 2008

On Mon, 17 Mar 2008 23:16:30 -0300, John John <audetweld@nbnet.nb.ca>
wrote:

>legg wrote:
>
>> On Mon, 17 Mar 2008 22:16:41 -0300, John John <audetweld@nbnet.nb.ca>
>> wrote:
>>
>>
>>
>>>**********************************************
>>>
>>>>regsvc.exe Remote Registry Service
>>>
>>>Why do you have this running? Is your machine part of a domain or is it
>>>administered remotely by another machine on a LAN? It most probably has
>>>nothing to do with your folder deletion problem but this service should
>>>not be running unless you have very good reasons to want it running, for
>>>most parts it just presents an additional unwanted security risk.
>>>
>>>
>>>*************************************************
>>
>>
>> The nearest it gets to a network is in sharing a NAT router.
>>
>> There are a lot of processes I'd like to unload from start-up, but this
>> isn't one I can currently access through familiar methods.
>
>It can be disabled or set to Manual Start in the Services Management
>Console, to open the console enter services.msc in the Start Menu Run box.
>

Perhaps I should have mentioned that this machine is involved in a
distributed computing initiative, running cancer and aids number crunching
as background activity, controlled by a World Community Grid BOINC Client.
This might have the need for the remote registry service, but regsvc.exe is
not open in a WXP machine running the same activity.

Regsvc.exe was terminated manually yesterday evening, without rebooting,
via TaskInfo. This A.M. it is running again.

Also this A.M. the BOINC client is erratic, squegging to 100% processor
use, then nothing at ~ 3second rep rate, and the machine's monitor is awake
and prevented from going into normal power saving routine (no screen saver
is used). Normally the display monitor self extinguished after 15minutes
without keyboard or mouse activity. Normally the BOINC activity
self-throttles at 80% when not at minimal use (during communication
events). I will be looking to the WCGrid for advice on this particular
issue, if it continues.

RL

legg
Tue Mar 18 05:16:47 PDT 2008

On Tue, 18 Mar 2008 00:25:28 -0300, John John <audetweld@nbnet.nb.ca>
wrote:


>
>Those are just handle ID's, normal but it seems that Explorer has a lot
>of open handles on one empty folder. You can run the Handle command
>against the process or PID to find out more about the handles:
>
>handle -p 1292
>
>The Explorer PID was obtained from the first output of the command or it
>can be obtained from the Task Manager or TLIST command.
>
>You can use the Handle command or Process Explorer to kill the handle
>but beware the warning that killing handles may make the system unstable.

There are around 240 explorer handles listed.

Apart from the 13 APS080317 folder handles, there are around 200 handles
applied to another empty folder that recently refused deletion:

L:\Component\passive 1\magnetic\articles mag\mag model\

and one or two handles referring to folders beside or below this one.
I note that this doesn't refer to the folder itself, but it's contents.
It has no contents. These were transferred to a pre-existing folder labeled
'magnetic model' in the same 'articles mag' directory.

There are ten or fifteen other handles that are not repeated.

I personally like this one:

1D8: Section \BaseNamedObjects\RotHintTable.

RL

John
Tue Mar 18 05:31:32 PDT 2008

legg wrote:

> On Mon, 17 Mar 2008 23:16:30 -0300, John John <audetweld@nbnet.nb.ca>
> wrote:
>
>
>>legg wrote:
>>
>>
>>>On Mon, 17 Mar 2008 22:16:41 -0300, John John <audetweld@nbnet.nb.ca>
>>>wrote:
>>>
>>>
>>>
>>>
>>>>**********************************************
>>>>
>>>>
>>>>>regsvc.exe Remote Registry Service
>>>>
>>>>Why do you have this running? Is your machine part of a domain or is it
>>>>administered remotely by another machine on a LAN? It most probably has
>>>>nothing to do with your folder deletion problem but this service should
>>>>not be running unless you have very good reasons to want it running, for
>>>>most parts it just presents an additional unwanted security risk.
>>>>
>>>>
>>>>*************************************************
>>>
>>>
>>>The nearest it gets to a network is in sharing a NAT router.
>>>
>>>There are a lot of processes I'd like to unload from start-up, but this
>>>isn't one I can currently access through familiar methods.
>>
>>It can be disabled or set to Manual Start in the Services Management
>>Console, to open the console enter services.msc in the Start Menu Run box.
>>
>
>
> Perhaps I should have mentioned that this machine is involved in a
> distributed computing initiative, running cancer and aids number crunching
> as background activity, controlled by a World Community Grid BOINC Client.
> This might have the need for the remote registry service, but regsvc.exe is
> not open in a WXP machine running the same activity.
>
> Regsvc.exe was terminated manually yesterday evening, without rebooting,
> via TaskInfo. This A.M. it is running again.
>
> Also this A.M. the BOINC client is erratic, squegging to 100% processor
> use, then nothing at ~ 3second rep rate, and the machine's monitor is awake
> and prevented from going into normal power saving routine (no screen saver
> is used). Normally the display monitor self extinguished after 15minutes
> without keyboard or mouse activity. Normally the BOINC activity
> self-throttles at 80% when not at minimal use (during communication
> events). I will be looking to the WCGrid for advice on this particular
> issue, if it continues.

I'm pretty leery about this whole thing. Not the Cancer/AIDS number
crunching initiative, I think that is a very good use for idle computing
time, but that the effort or that BOINC would require the ability to
Remotely Edit your Registry for the number crunching to happen is a bit
specious to me! I understand that collaborating with these
collective/distributed computing initiatives requires that you give
someone or something a bit of control over your machine but I still
don't see why they would need to remotely edit your registry, and I
don't know why they would need to re-enable this service after you turn
it off! It may all be above board, but to me there is something fishy
going on.

With regards to your folder deletion problem I am now thinking that one
of these third party services or applications that you have running has
a hook into Explorer.exe or into the file system and that may be
preventing you from deleting the folders. I would disable some of these
services, or clean boot and add/re-enable them one at a time and do some
tests to see what is going on with these third party services. And from
this distance I haven't ruled out the possibility that virus/spyware
activity on your machine could be the cause of the problem.

John

legg
Tue Mar 18 06:17:59 PDT 2008

On Tue, 18 Mar 2008 09:31:32 -0300, John John <audetweld@nbnet.nb.ca>
wrote:


>> Also this A.M. the BOINC client is erratic, squegging to 100% processor
>> use, then nothing at ~ 3second rep rate, and the machine's monitor is awake
>> and prevented from going into normal power saving routine (no screen saver
>> is used). Normally the display monitor self extinguished after 15minutes
>> without keyboard or mouse activity. Normally the BOINC activity
>> self-throttles at 80% when not at minimal use (during communication
>> events). I will be looking to the WCGrid for advice on this particular
>> issue, if it continues.
>
>I'm pretty leery about this whole thing. Not the Cancer/AIDS number
>crunching initiative, I think that is a very good use for idle computing
>time, but that the effort or that BOINC would require the ability to
>Remotely Edit your Registry for the number crunching to happen is a bit
>specious to me! I understand that collaborating with these
>collective/distributed computing initiatives requires that you give
>someone or something a bit of control over your machine but I still
>don't see why they would need to remotely edit your registry, and I
>don't know why they would need to re-enable this service after you turn
>it off! It may all be above board, but to me there is something fishy
>going on.
>
>With regards to your folder deletion problem I am now thinking that one
>of these third party services or applications that you have running has
>a hook into Explorer.exe or into the file system and that may be
>preventing you from deleting the folders. I would disable some of these
>services, or clean boot and add/re-enable them one at a time and do some
>tests to see what is going on with these third party services. And from
>this distance I haven't ruled out the possibility that virus/spyware
>activity on your machine could be the cause of the problem.

I've been avoiding a reboot, so as not to lose immediate symptoms, but will
do so presently, and wait for a recurrence. It doesn't usually take long,
and Im still proceeding with file transfers into this affected system.

If I hear anything from BOINC, I'll report, but there's no real proof that
they're the culprit.

RL

John
Tue Mar 18 06:29:13 PDT 2008

legg wrote:
> On Tue, 18 Mar 2008 00:25:28 -0300, John John <audetweld@nbnet.nb.ca>
> wrote:
>
>
>
>>Those are just handle ID's, normal but it seems that Explorer has a lot
>>of open handles on one empty folder. You can run the Handle command
>>against the process or PID to find out more about the handles:
>>
>>handle -p 1292
>>
>>The Explorer PID was obtained from the first output of the command or it
>>can be obtained from the Task Manager or TLIST command.
>>
>>You can use the Handle command or Process Explorer to kill the handle
>>but beware the warning that killing handles may make the system unstable.
>
>
> There are around 240 explorer handles listed.
>
> Apart from the 13 APS080317 folder handles, there are around 200 handles
> applied to another empty folder that recently refused deletion:
>
> L:\Component\passive 1\magnetic\articles mag\mag model\

I don't know, but seems like a lot of handles on an empty folder!

Use Task Manager and kill Explorer.exe and its Process Tree then restart
it and rerun the Handle command against it, (note that the Explorer PID
may be different after you restart it, the PID is shown in Task
Manager), when you kill the Process Tree all items spawned/started by
Explorer.exe will also be kiled. After you restart Explorer try to
delete the folders.

John

legg
Tue Mar 18 06:46:47 PDT 2008

On Tue, 18 Mar 2008 10:29:13 -0300, John John <audetweld@nbnet.nb.ca>
wrote:

>legg wrote:
>> On Tue, 18 Mar 2008 00:25:28 -0300, John John <audetweld@nbnet.nb.ca>
>> wrote:
>>
>>
>>
>>>Those are just handle ID's, normal but it seems that Explorer has a lot
>>>of open handles on one empty folder. You can run the Handle command
>>>against the process or PID to find out more about the handles:
>>>
>>>handle -p 1292
>>>
>>>The Explorer PID was obtained from the first output of the command or it
>>>can be obtained from the Task Manager or TLIST command.
>>>
>>>You can use the Handle command or Process Explorer to kill the handle
>>>but beware the warning that killing handles may make the system unstable.
>>
>>
>> There are around 240 explorer handles listed.
>>
>> Apart from the 13 APS080317 folder handles, there are around 200 handles
>> applied to another empty folder that recently refused deletion:
>>
>> L:\Component\passive 1\magnetic\articles mag\mag model\
>
>I don't know, but seems like a lot of handles on an empty folder!
>
>Use Task Manager and kill Explorer.exe and its Process Tree then restart
>it and rerun the Handle command against it, (note that the Explorer PID
>may be different after you restart it, the PID is shown in Task
>Manager), when you kill the Process Tree all items spawned/started by
>Explorer.exe will also be kiled. After you restart Explorer try to
>delete the folders.

I rebooted before reading this post, but will follow the recommendation in
the next instance of an undeletable empty folder, with abnormal handle
counts.

By the way, the Regsvc.exe process self-started immediately after
termination, not after some interval of time, as previously reported. I've
set it to 'manual' as suggested. Previously 'automatic'.

RL

John
Tue Mar 18 07:00:01 PDT 2008

legg wrote:

> On Tue, 18 Mar 2008 10:29:13 -0300, John John <audetweld@nbnet.nb.ca>
> wrote:
>
>
>>legg wrote:
>>
>>>On Tue, 18 Mar 2008 00:25:28 -0300, John John <audetweld@nbnet.nb.ca>
>>>wrote:
>>>
>>>
>>>
>>>
>>>>Those are just handle ID's, normal but it seems that Explorer has a lot
>>>>of open handles on one empty folder. You can run the Handle command
>>>>against the process or PID to find out more about the handles:
>>>>
>>>>handle -p 1292
>>>>
>>>>The Explorer PID was obtained from the first output of the command or it
>>>>can be obtained from the Task Manager or TLIST command.
>>>>
>>>>You can use the Handle command or Process Explorer to kill the handle
>>>>but beware the warning that killing handles may make the system unstable.
>>>
>>>
>>>There are around 240 explorer handles listed.
>>>
>>>Apart from the 13 APS080317 folder handles, there are around 200 handles
>>>applied to another empty folder that recently refused deletion:
>>>
>>>L:\Component\passive 1\magnetic\articles mag\mag model\
>>
>>I don't know, but seems like a lot of handles on an empty folder!
>>
>>Use Task Manager and kill Explorer.exe and its Process Tree then restart
>>it and rerun the Handle command against it, (note that the Explorer PID
>>may be different after you restart it, the PID is shown in Task
>>Manager), when you kill the Process Tree all items spawned/started by
>>Explorer.exe will also be kiled. After you restart Explorer try to
>>delete the folders.
>
>
> I rebooted before reading this post, but will follow the recommendation in
> the next instance of an undeletable empty folder, with abnormal handle
> counts.
>
> By the way, the Regsvc.exe process self-started immediately after
> termination, not after some interval of time, as previously reported. I've
> set it to 'manual' as suggested. Previously 'automatic'.

Something is going on with the service. I can't see why this service
needs to run and I don't know what would cause it to restart when you
turn it off. I am wondering if this is even the real bona fide
Microsoft Remote Registry Service, some virus mascarade as this service.
Do a search on your hard drive for Regsvc.exe and note the various
locations of the file.

John