Files held open by another process 2

[boxster8]

Hi All,

Since doing MS Patches on 2/16/08 on my Windows 2003 file and print servers, I have noticed an issue where some users files(misc. extensions)are being "held open by another process". You can't delete them, even logging in as a local administrator or a reboot. Any suggestions would be greatly appreciated!

Best regards,
Don

 

[ForumKB]

Hi, I have seen this before with McAfee keeping threads open (particularly DB lck files as well as others). May or may not be the same but you can use process explorer from Systernals (search on Technet / google for Systernals). Use the option at the top to search for handels and enter the file name that is locked.

It will tell you what process has the file locked and allow you to kill it if you choose.

If it is an AV program locking certain files you can choose to exclude the file type dependent on your security requirements etc.

Adrian Paris

http://www.ForumKB.com

- Tech forum only Google search, find answers faster by not searching the junk.

 

[PU36]

Try this;

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

It will tell you what file(s) are being used by what process.

 

[groinwood]

Looks like we have the same problem!
We have an upgrade for McAfee planned next week to 8.5, hopefully this will resolve the annoying locked files.

The Process Explorer tool does not list the locked files.
Only a reboot unlocks the files.

But we want to know what is causing the lock. Is there anybody that had the same issue with McAfee?

Also see this thread:

http://www.tek-tips.com/viewthread.cfm?qid=1453943&page=1

 

[PU36]

That is not Process Explorer that I gave a link to. It is Process Monitor which in a single tools utilizes, Process Explorer, RegMon and FileMon.

 

[ForumKB]

If a file is locked you can search to see whats locked it using process explorer (it won't tell you whats locked) e.g. if you try and delete something and can't because its in use you can search to see whats using it.

Process Monitor is a new one on me but i'll check it out tomorrow, cheers magnum


Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[groinwood]

Sorry Magnum1976 i didn't even clicked on the link because i 'assumed' you tried to link me to the Process Explorer.

Thanks for the link I will try the tool when we have the annoying locked files again.

Grtz

 

[ForumKB]

Had a look at proc. monitor and definatley a useful bit of kit, I would have thought proc. explorer would be more useful in this senario though where a process has something locked and you just need to know what is doing it . . .

Just need to go into Find >> Find Handel or DLL . . .
enter the name of what is locked and search. It gives a list of all processes that are using it, click on one of the items in the list and it will take you straight to the correct instance of the process in the explorer window (and if it's mcshield.exe or similar you can right click it and kill it or even double click and kill individual threads)


Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[ForumKB]

Sorry groinwood in answer to your question about McAfee it isn't really clear why it does it as far as I can see, this is the best I've found . . .

"Quote:
Since the real time scanning is unable to gauge the exact nature of the file it goes in to an indefinite loop of scanning and scanning...."

We had exectly the same issue but it only seemed to be certain types of files (the lock files for other files to be precise).
This threw up a bit of a red herring because when we tried to access or delete fileA you would get an error that the file was in use, when you tried to see what had this open nothing did. It's only when we kicked everybody out of everything and looked at the folders where the files were we noticed the hidden lock files were still there (should of course disappear when the person using the file closes it). I think we had this with access databases files, QTP files and a few others, the only way we got around it was to exclude the lock file extentions from McAfee (e.g. .lck files etc.)




Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[groinwood]

Thanks ForumKB for the tip!
We will exclude some extensions and see what happens.

I have not tested the Process Monitor yet because we have no locked files at the moment. We rebooted the server yesterday for maintenance.

 

[DTracy]

Excluding certain file extentions in McAfee will solve the problem, it did for me-same problem.

David.

 

[boxster8]

Hi All,

I downloaded and ran Process Monitor, but can't find "Find >> Find Handel" anywhere. I can't figure out how to search for the files. My IT partner couldn't either. Any help would be greatly appreciated!

Best regards,
Don

 

[ForumKB]

Find >> Find Handel or Dll" is in Process Explorer, not Process Monitor . . . .

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Bit stupid that a company have two bits of similar software with such similar names, can create a bit of confusion !!!


Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[boxster8]

ForumKB,

Hi...very funny! I have found the solution, and it relates to what you said above. McAfee released a hotfix for those of us that have McAfee 8 with patch 16!! This has resolved the issue. Go to:

http://www.mcafee.com/apps/downloads/security_updates/hotfixes.asp?region=us&segment=enterprise

and "VirusScan 8.0I"

After installing this on my servers and rebooting there are no more problems with Excel, Adobe or AutoCad files. Thanks to all, and I hope this works for you.

On a side note, where is the best area to stay in and best time to go to Paris, Adrian? Smile...

 

[boxster8]

SORRY. It's actually "VSE80HF375377" that you need from McAfee.

 

[groinwood]

We did not tried the patch for 8.0i. We are installing ePO 4 now! So we will roll-out 8.5i this week.

I can confirm that adding the extensions to the exclusion list solved our problems with the locked files. We will continue to do this with VS 8.5i.

Thank you all for your help!

 

[twinkil]

boxster8, i can't see any hotfix like VSE80HF375377 on the McAfee website. Do you still have this patch or know where to find it?

I've got exact the same problems...!

 

[Davids38]

So did anyone ever figure out how to resolve this? I contacted Mcafee Gold Support, and they know nothing of this patch!