Access denied caused by 'svchost.exe -k netsvcs' process?

  • Thread starter Thread starter D.J. Heap
  • Start date Start date
D

D.J. Heap

Can anyone shed some light on what the 'svchost.exe -k netsvcs' process is
doing when it opens up and queries private files that an application is
trying to read/write/rename/delete?

A very busy (and single threaded) application that is heavily creating,
writing, renaming and removing files occasionally gets an 'Access denied'
(not even 'file in use' or 'sharing violation') error while dealing with
it's own private files. They are not read-only (although they recently may
have been), the process/user has full control, and they are not in use by
any other application.

Using NTFILEMON from SysInternals it appears that the culprit dorking with
the files while the app is still working with them is the 'svchost.exe -k
netsvcs' process. Index service is disabled and this occurs on a freshly
installed and updated XP Prof machine -- no third party stuff installed
(especially anti-virus which was my first suspicion).

According to a MS KB article this particular invocation of svchost is
running several services (
http://support.microsoft.com/?kbid=314056 )...which one is messing with an
app's private files? Is this expected behavior? Is it possible to shut it
off?

Simply retrying the operation (MoveFileEx, or DeleteFile) in a loop works,
but how *lame* to have to sprinkle that kind of code all over where those
functions are used.

Any information would be greatly appreciated.

Thanks!

DJ
 
D.J. Heap said:
Can anyone shed some light on what the 'svchost.exe -k netsvcs' process is
doing when it opens up and queries private files that an application is
trying to read/write/rename/delete?

A very busy (and single threaded) application that is heavily creating,
writing, renaming and removing files occasionally gets an 'Access denied'
(not even 'file in use' or 'sharing violation') error while dealing with
it's own private files. They are not read-only (although they recently may
have been), the process/user has full control, and they are not in use by
any other application.

Using NTFILEMON from SysInternals it appears that the culprit dorking with
the files while the app is still working with them is the 'svchost.exe -k
netsvcs' process. Index service is disabled and this occurs on a freshly
installed and updated XP Prof machine -- no third party stuff installed
(especially anti-virus which was my first suspicion).

According to a MS KB article this particular invocation of svchost is
running several services (
http://support.microsoft.com/?kbid=314056 )...which one is messing with an
app's private files? Is this expected behavior? Is it possible to shut it
off?

Simply retrying the operation (MoveFileEx, or DeleteFile) in a loop works,
but how *lame* to have to sprinkle that kind of code all over where those
functions are used.

Any information would be greatly appreciated.

Thanks!

DJ
Click to expand...

Isn't 'svchost.exe -k netsvcs' the Task Scheduler in WinXP?
 
Isn't 'svchost.exe -k netsvcs' the Task Scheduler in WinXP?

That is one -- on my machine there is a bunch in there, though, and it would
be nice to know which is so invasive and why:

c:\>tasklist /FI "PID eq 1328" /svc

Image Name PID Services
========================= ======
=============================================
SVCHOST.EXE 1328 AudioSrv, Browser, CryptSvc, Dhcp,
dmserver,
ERSvc, EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Messenger, Netman, Nla,
RasMan, Schedule, seclogon, SENS,
ShellHWDetection, TapiSrv, TermService,
Themes, TrkWks, uploadmgr, w32time,
winmgmt,
WZCSVC

DJ
 
Back
Top