cannot delete empty folders - until 'later'

[John John]

In other words you couldn't delete it until you logged off and back or
or until you rebooted the machine? Something must have had an open
handle on the folder.

John

 

[Andrew Rossmann]

I recall having the same problem with re-naming
recently moved folders, hence the 'empty' ones
with the wrong names, needing deletion.

Same question.....what's going on?

How did you delete/rename? If you used a command prompt, did you close
the prompt or at least CD to another directory? As John John mentioned,
something was probably holding something in the directory, or the
directory itself, open. I've found Outlook can do that when you save or
read attatchments, especially if Word is your editor, and not just the
built-in editor.

There are several process explorer style programs you can use to check
open handles, and find out what program is blocking the directory or
file(s) from being deleted.

If you have a network share to your computer, you can look in Computer
Management to see what files are open on your shared directories.

 

[legg]

Recent migration to W2K SP4 had me moving/sorting
files and folders. After a folder was emptied, I
could not delete it, as administrator, until the
next day.

What's going on?

RL

 

[legg]

I recall having the same problem with re-naming
recently moved folders, hence the 'empty' ones
with the wrong names, needing deletion.

Same question.....what's going on?

RL

 

[John John]

Adjust your clock, you're posting in the future.

As mentioned by Andrew, the application that you use to rename or delete
files may be keeping an open handle on the files or folders. Tools like
OH.exe, Handle or Process Explorer can reveal the handles.

Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Handle v3.20
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx

Open Handles (oh.exe): This command-line tool shows the handles of all
open windows. The tool can also be used to show only information that
relates to a specific process, object type, or object name. To download
this tool, click the following link:
http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe

Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

John

 

[legg]

Adjust your clock, you're posting in the future.

Eastern Daylight Savings Time...seems to check out
from this end, and on all message time stamps.

As mentioned by Andrew, the application that you use to rename or delete
files may be keeping an open handle on the files or folders. Tools like
OH.exe, Handle or Process Explorer can reveal the handles.

Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Handle v3.20
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx

Open Handles (oh.exe): This command-line tool shows the handles of all
open windows. The tool can also be used to show only information that
relates to a specific process, object type, or object name. To download
this tool, click the following link:
http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe

Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

No special processes being used. Just explorer.

Will give the recommended tools a try.

Checking permissions was the first thing I tried.
This thing is not yet on a network; there are no
users set up, save the administrator and no
sharing has been assigned.

No such trouble on the machine the files
originated from (via hard disk temporary
relocation), and in many specific cases these
were/are new folders and files created for
updating hardware drivers.

Thanks.

 

[John John]

Eastern Daylight Savings Time...seems to check out
from this end, and on all message time stamps.

Hmmm. Looking at it from this ends it appears that Andrew and I have
replied to your posts before you even asked a question or reported a
problem! I replied to your 10:32AM post at 9:40AM and Andrew replied to
your 10:37AM post at 10:02AM, I may have to check my crystal ball to see
if it's cracked...

No special processes being used. Just explorer.

Will give the recommended tools a try.

Checking permissions was the first thing I tried.
This thing is not yet on a network; there are no
users set up, save the administrator and no
sharing has been assigned.

No such trouble on the machine the files
originated from (via hard disk temporary
relocation), and in many specific cases these
were/are new folders and files created for
updating hardware drivers.

Checking the permissions was a good troubleshooting measure but being
that you can delete the folders after a reboot I don't think that this
is a permissions issue, your investigation seems to have confirmed this.

John

 

[legg]

Adjust your clock, you're posting in the future.

As mentioned by Andrew, the application that you use to rename or delete
files may be keeping an open handle on the files or folders. Tools like
OH.exe, Handle or Process Explorer can reveal the handles.

Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Handle v3.20
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Handle.mspx

Open Handles (oh.exe): This command-line tool shows the handles of all
open windows. The tool can also be used to show only information that
relates to a specific process, object type, or object name. To download
this tool, click the following link:
http://download.microsoft.com/download/win2000platform/oh/1.00.0.1/nt5/en-us/oh_setup.exe

Windows Server 2003 Resource Kit Tools
http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

I'd updated the time displayed, manually. Have
just run the DST patch. Perhaps this helps time
stamps. My news agent may have a mind of its own.

Running SysInternal's Process Explorer reveals no
handles.

Folders whose contents are emptied/transferred can
still not be deleted, until reboot.

I disabled some Seagate acronis disk imaging tools
that were hovering in the background, without
effect. Open processes are listed below.

RL

Process PID CPU Description Company
Name
System Idle Process 0 98.44
Interrupts n/a 1.56 Hardware
Interrupts
DPCs n/a Deferred Procedure Calls
System 8
SMSS.EXE 384 Windows NT Session
Manager Microsoft Corporation
CSRSS.EXE 412 Client Server
Runtime Process Microsoft Corporation
WINLOGON.EXE 432 Windows NT Logon
Application Microsoft Corporation
SERVICES.EXE 460 Services
and Controller app Microsoft Corporation
svchost.exe 648 Generic
Host Process for Win32 Services Microsoft
Corporation
spoolsv.exe 688 Spooler
SubSystem App Microsoft Corporation
schedul2.exe 716 Acronis
Scheduler 2 Acronis
svchost.exe 756 Generic
Host Process for Win32 Services Microsoft
Corporation
FormatM.exe 788 MacOpener
Mac Formatter DataViz Inc.
nod32krn.exe 812 NOD32
Kernel Service Eset
nvsvc32.exe 872 NVIDIA
Driver Helper Service, Version 91.48 NVIDIA
Corporation
PERSFW.exe 884 Kerio Personal
Firewall Engine Kerio Technologies
regsvc.exe 564 Remote Registry
Service Microsoft Corporation
mstask.exe 932 Task Scheduler
Engine Microsoft Corporation
WinMgmt.exe 996 Windows
Management Instrumentation Microsoft
Corporation
svchost.exe 1072 Generic
Host Process for Win32 Services Microsoft
Corporation
LSASS.EXE 472 LSA Executable and
Server DLL (Export Version) Microsoft
Corporation
procexp.exe 1324 Sysinternals
Process Explorer Sysinternals -
www.sysinternals.com
agent.exe 1680 Forte Agent Forte
Internet Software Inc.
explorer.exe 1292 Windows Explorer
Microsoft Corporation

 

[John John]

I'd updated the time displayed, manually. Have
just run the DST patch. Perhaps this helps time
stamps. My news agent may have a mind of its own.

Running SysInternal's Process Explorer reveals no
handles.

Folders whose contents are emptied/transferred can
still not be deleted, until reboot.

I disabled some Seagate acronis disk imaging tools
that were hovering in the background, without
effect. Open processes are listed below.

RL

Process PID CPU Description Company
Name
System Idle Process 0 98.44
Interrupts n/a 1.56 Hardware
Interrupts
DPCs n/a Deferred Procedure Calls
System 8
SMSS.EXE 384 Windows NT Session
Manager Microsoft Corporation
CSRSS.EXE 412 Client Server
Runtime Process Microsoft Corporation
WINLOGON.EXE 432 Windows NT Logon
Application Microsoft Corporation
SERVICES.EXE 460 Services
and Controller app Microsoft Corporation
svchost.exe 648 Generic
Host Process for Win32 Services Microsoft
Corporation
spoolsv.exe 688 Spooler
SubSystem App Microsoft Corporation
schedul2.exe 716 Acronis
Scheduler 2 Acronis
svchost.exe 756 Generic
Host Process for Win32 Services Microsoft
Corporation
FormatM.exe 788 MacOpener
Mac Formatter DataViz Inc.
nod32krn.exe 812 NOD32
Kernel Service Eset
nvsvc32.exe 872 NVIDIA
Driver Helper Service, Version 91.48 NVIDIA
Corporation
PERSFW.exe 884 Kerio Personal
Firewall Engine Kerio Technologies
regsvc.exe 564 Remote Registry
Service Microsoft Corporation
mstask.exe 932 Task Scheduler
Engine Microsoft Corporation
WinMgmt.exe 996 Windows
Management Instrumentation Microsoft
Corporation
svchost.exe 1072 Generic
Host Process for Win32 Services Microsoft
Corporation
LSASS.EXE 472 LSA Executable and
Server DLL (Export Version) Microsoft
Corporation
procexp.exe 1324 Sysinternals
Process Explorer Sysinternals -
www.sysinternals.com
agent.exe 1680 Forte Agent Forte
Internet Software Inc.
explorer.exe 1292 Windows Explorer
Microsoft Corporation

What are these undeletable folders? What error messages are you getting
when you try to delete them? How about the Event Viewer, are any errors
showing in the logs?

How are you deleting the files and folders, with Explorer.exe or with
another application? Can you use the RD command at the command prompt
to delete the folders? If no what does the RD command return?

Try using the Task Manager and Kill Explorer.exe and its process tree,
then, using the File | New Task menu, restart Explorer.exe again and see
if you can delete the folders.

Try the other Handle tools on the actual folders to make sure that there
are no handles on the folders, try using OH.exe on the actual folder
instead of querying processes.

John

 

[legg]

What are these undeletable folders? What error messages are you getting
when you try to delete them? How about the Event Viewer, are any errors
showing in the logs?

It doesn't seem to matter what the folder is, or
where. (C:\, other drives, floppy) If I move its
non-executable (pdf txt doc etc) contents to a
renamed folder, the emptied folder cannot be
deleted or renamed, using the standard windows
explorer GUI. I am not opening the 'windows
explorer' process, just using the standard desktop
GUI, which is the explorer process listed in the
SysInt report.

How are you deleting the files and folders, with Explorer.exe or with
another application? Can you use the RD command at the command prompt
to delete the folders? If no what does the RD command return?

The error message is "Cannot delete <folder name>:
There has been a sharing violation. The source or
destination file may be in use."

If I then move the original contents back into the
original folder, I am prevented from deleting the
now-empty new folder. If I attempt to move the
now-empty new folder to a new directory, I get the
same error message, but, strangely, the move is
completed. The empty folder can then be deleted
without errors.

I have used no command instructions and am
basically ignorant of all but the simplest
functions used in performing tasks off a boot
floppy.

Try using the Task Manager and Kill Explorer.exe and its process tree,
then, using the File | New Task menu, restart Explorer.exe again and see
if you can delete the folders.

Try the other Handle tools on the actual folders to make sure that there
are no handles on the folders, try using OH.exe on the actual folder
instead of querying processes.

Attempts to use the OH.exe resulted in rapid
display and termination of the dos window that
were unreadable and left no identifiable log
results.

TaskInfo.exe, normally resident on this machine,
sees innumerable handles associated with each
process, previously listed. How would one handle
be identified as having relevance to file
deletion, relocation or renaming processes?

RL

 

[legg]

What are these undeletable folders? What error messages are you getting
when you try to delete them? How about the Event Viewer, are any errors
showing in the logs?

I made a couple of failed folder manipulation
operations while composing the last message, but
there are no events listed by event viewer within
two hours of that time.

RL

 

[John John]

legg wrote:

Attempts to use the OH.exe resulted in rapid
display and termination of the dos window that
were unreadable and left no identifiable log
results.

Issue OH against the name of the file or folder, for example:

OH filename

or

OH Foldername

If there are spaces in the object name surround it with quotation marks:

OH "Folder Name"

You may find that SysInternals Handle works better than OH.exe, both are
used at the Command Prompt, Handle.exe handles fully qualified paths and
returns an easier to read output:

Handle C:\Foldername\filename

John

 

[John John]

I disabled some Seagate acronis disk imaging tools
that were hovering in the background, without
effect. Open processes are listed below.

System Idle Process
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
svchost.exe
spoolsv.exe
schedul2.exe Acronis
Scheduler 2 Acronis
svchost.exe
FormatM.exe MacOpener Mac Formatter DataViz Inc.
nod32krn.exe NOD32 Kernel Service Eset
nvsvc32.exe NVIDIA Driver Helper Service,
PERSFW.exe Kerio Personal Firewall Engine

**********************************************
regsvc.exe Remote Registry Service

Why do you have this running? Is your machine part of a domain or is it
administered remotely by another machine on a LAN? It most probably has
nothing to do with your folder deletion problem but this service should
not be running unless you have very good reasons to want it running, for
most parts it just presents an additional unwanted security risk.


*************************************************

 

[legg]

I ran handle.exe v3.3 from the command prompt on an undeletable folder,
created earlier, solely to illustrate the problem:

Handle C:\DOCS\BUSINESS\APPS080317

This returned 13 nearly identical entrys:

explorer.exe PID: 1292 XXX: C:\DOCS\BUSINESS\APPS080317

where XXX is

9C0
9F0
A40
A54
A5C
AC0
ACC
AD0
B04
B0C
B24
B48
B50

This empty folder;
IS currently in it's the original location as listed above;
WAS apparently relocated earlier into C:\DOCS\ (with warnings);
WAS deleted from that new location;
and
DOES currently appear in the recycle bin.

What the hell is going on?

RL

 

[legg]

**********************************************

Why do you have this running? Is your machine part of a domain or is it
administered remotely by another machine on a LAN? It most probably has
nothing to do with your folder deletion problem but this service should
not be running unless you have very good reasons to want it running, for
most parts it just presents an additional unwanted security risk.


*************************************************

The nearest it gets to a network is in sharing a NAT router.

There are a lot of processes I'd like to unload from start-up, but this
isn't one I can currently access through familiar methods.

RL

 

[John John]

The nearest it gets to a network is in sharing a NAT router.

There are a lot of processes I'd like to unload from start-up, but this
isn't one I can currently access through familiar methods.

It can be disabled or set to Manual Start in the Services Management
Console, to open the console enter services.msc in the Start Menu Run box.

John

 

[John John]

I ran handle.exe v3.3 from the command prompt on an undeletable folder,
created earlier, solely to illustrate the problem:

Handle C:\DOCS\BUSINESS\APPS080317

This returned 13 nearly identical entrys:

explorer.exe PID: 1292 XXX: C:\DOCS\BUSINESS\APPS080317

where XXX is

9C0
9F0
A40
A54
A5C
AC0
ACC
AD0
B04
B0C
B24
B48
B50

Those are just handle ID's, normal but it seems that Explorer has a lot
of open handles on one empty folder. You can run the Handle command
against the process or PID to find out more about the handles:

handle -p 1292

The Explorer PID was obtained from the first output of the command or it
can be obtained from the Task Manager or TLIST command.

You can use the Handle command or Process Explorer to kill the handle
but beware the warning that killing handles may make the system unstable.

This empty folder;
IS currently in it's the original location as listed above;
WAS apparently relocated earlier into C:\DOCS\ (with warnings);
WAS deleted from that new location;
and
DOES currently appear in the recycle bin.

I'm not sure that I follow, "was apparently relocated" by whom or what?

What the hell is going on?

I don't know, this is unusual behaviour. You say that this happens with
different folders in different locations? Is the machine free of virus
and other pests or spyware? Does this happen in Safe Mode?

John

 

[legg]

It can be disabled or set to Manual Start in the Services Management
Console, to open the console enter services.msc in the Start Menu Run box.

Perhaps I should have mentioned that this machine is involved in a
distributed computing initiative, running cancer and aids number crunching
as background activity, controlled by a World Community Grid BOINC Client.
This might have the need for the remote registry service, but regsvc.exe is
not open in a WXP machine running the same activity.

Regsvc.exe was terminated manually yesterday evening, without rebooting,
via TaskInfo. This A.M. it is running again.

Also this A.M. the BOINC client is erratic, squegging to 100% processor
use, then nothing at ~ 3second rep rate, and the machine's monitor is awake
and prevented from going into normal power saving routine (no screen saver
is used). Normally the display monitor self extinguished after 15minutes
without keyboard or mouse activity. Normally the BOINC activity
self-throttles at 80% when not at minimal use (during communication
events). I will be looking to the WCGrid for advice on this particular
issue, if it continues.

RL

 

[legg]

Those are just handle ID's, normal but it seems that Explorer has a lot
of open handles on one empty folder. You can run the Handle command
against the process or PID to find out more about the handles:

handle -p 1292

The Explorer PID was obtained from the first output of the command or it
can be obtained from the Task Manager or TLIST command.

You can use the Handle command or Process Explorer to kill the handle
but beware the warning that killing handles may make the system unstable.

There are around 240 explorer handles listed.

Apart from the 13 APS080317 folder handles, there are around 200 handles
applied to another empty folder that recently refused deletion:

L:\Component\passive 1\magnetic\articles mag\mag model\

and one or two handles referring to folders beside or below this one.
I note that this doesn't refer to the folder itself, but it's contents.
It has no contents. These were transferred to a pre-existing folder labeled
'magnetic model' in the same 'articles mag' directory.

There are ten or fifteen other handles that are not repeated.

I personally like this one:

1D8: Section \BaseNamedObjects\RotHintTable.

RL

 

[John John]

Perhaps I should have mentioned that this machine is involved in a
distributed computing initiative, running cancer and aids number crunching
as background activity, controlled by a World Community Grid BOINC Client.
This might have the need for the remote registry service, but regsvc.exe is
not open in a WXP machine running the same activity.

Regsvc.exe was terminated manually yesterday evening, without rebooting,
via TaskInfo. This A.M. it is running again.

Also this A.M. the BOINC client is erratic, squegging to 100% processor
use, then nothing at ~ 3second rep rate, and the machine's monitor is awake
and prevented from going into normal power saving routine (no screen saver
is used). Normally the display monitor self extinguished after 15minutes
without keyboard or mouse activity. Normally the BOINC activity
self-throttles at 80% when not at minimal use (during communication
events). I will be looking to the WCGrid for advice on this particular
issue, if it continues.

I'm pretty leery about this whole thing. Not the Cancer/AIDS number
crunching initiative, I think that is a very good use for idle computing
time, but that the effort or that BOINC would require the ability to
Remotely Edit your Registry for the number crunching to happen is a bit
specious to me! I understand that collaborating with these
collective/distributed computing initiatives requires that you give
someone or something a bit of control over your machine but I still
don't see why they would need to remotely edit your registry, and I
don't know why they would need to re-enable this service after you turn
it off! It may all be above board, but to me there is something fishy
going on.

With regards to your folder deletion problem I am now thinking that one
of these third party services or applications that you have running has
a hook into Explorer.exe or into the file system and that may be
preventing you from deleting the folders. I would disable some of these
services, or clean boot and add/re-enable them one at a time and do some
tests to see what is going on with these third party services. And from
this distance I haven't ruled out the possibility that virus/spyware
activity on your machine could be the cause of the problem.

John