Can anyone shed some light on what the 'svchost.exe -k netsvcs' process is
doing when it opens up and queries private files that an application is
trying to read/write/rename/delete?

A very busy (and single threaded) application that is heavily creating,
writing, renaming and removing files occasionally gets an 'Access denied'
(not even 'file in use' or 'sharing violation') error while dealing with
it's own private files. They are not read-only (although they recently may
have been), the process/user has full control, and they are not in use by
any other application.

Using NTFILEMON from SysInternals it appears that the culprit dorking with
the files while the app is still working with them is the 'svchost.exe -k
netsvcs' process. Index service is disabled and this occurs on a freshly
installed and updated XP Prof machine -- no third party stuff installed
(especially anti-virus which was my first suspicion).

According to a MS KB article this particular invocation of svchost is
running several services (
http://support.microsoft.com/?kbid=314056 )...which one is messing with an
app's private files? Is this expected behavior? Is it possible to shut it
off?

Simply retrying the operation (MoveFileEx, or DeleteFile) in a loop works,
but how *lame* to have to sprinkle that kind of code all over where those
functions are used.

Any information would be greatly appreciated.

Thanks!

DJ

D.J. Heap wrote:

> Can anyone shed some light on what the 'svchost.exe -k netsvcs' process is
> doing when it opens up and queries private files that an application is
> trying to read/write/rename/delete?
>
> A very busy (and single threaded) application that is heavily creating,
> writing, renaming and removing files occasionally gets an 'Access denied'
> (not even 'file in use' or 'sharing violation') error while dealing with
> it's own private files. They are not read-only (although they recently may
> have been), the process/user has full control, and they are not in use by
> any other application.
>
> Using NTFILEMON from SysInternals it appears that the culprit dorking with
> the files while the app is still working with them is the 'svchost.exe -k
> netsvcs' process. Index service is disabled and this occurs on a freshly
> installed and updated XP Prof machine -- no third party stuff installed
> (especially anti-virus which was my first suspicion).
>
> According to a MS KB article this particular invocation of svchost is
> running several services (
> http://support.microsoft.com/?kbid=314056 )...which one is messing with an
> app's private files? Is this expected behavior? Is it possible to shut it
> off?
>
> Simply retrying the operation (MoveFileEx, or DeleteFile) in a loop works,
> but how *lame* to have to sprinkle that kind of code all over where those
> functions are used.
>
> Any information would be greatly appreciated.
>
> Thanks!
>
> DJ
>
>

Isn't 'svchost.exe -k netsvcs' the Task Scheduler in WinXP?

--
Phil Robyn
Univ. of California, Berkeley

u n z i p m y a d d r e s s t o s e n d e - m a i l

> Isn't 'svchost.exe -k netsvcs' the Task Scheduler in WinXP?
>
> --
> Phil Robyn


That is one -- on my machine there is a bunch in there, though, and it would
be nice to know which is so invasive and why:

c:\>tasklist /FI "PID eq 1328" /svc

Image Name PID Services
========================= ======
=============================================
SVCHOST.EXE 1328 AudioSrv, Browser, CryptSvc, Dhcp,
dmserver,
ERSvc, EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Messenger, Netman, Nla,
RasMan, Schedule, seclogon, SENS,
ShellHWDetection, TapiSrv, TermService,
Themes, TrkWks, uploadmgr, w32time,
winmgmt,
WZCSVC

DJ