The undeletable Outlook folder

The undeletable Outlook folder, episode 2

The Old New Thing — Wed, 24 Jan 2007 18:00:10 GMT

Stop trying to synchronize it.

re: The undeletable Outlook folder

KyleF — Fri, 21 Oct 2005 20:52:38 GMT

>Does it inject code into the troublesome process
>to force it to close the troublesome handle? I
>wonder what happens when the process continues
>its normal operation without knowing that the
>handle's been closed.

No code injection is necessary. Process Explorer installs at runtime a (kernel-mode) driver that performs all of its necessary privileged instructions, such as closing a handle owned by any process in the OS. Installing this driver is the primary reason why Process Explorer requires administrative privileges to run.

Just FYI, closing a handle out from underneath an application is usually a very bad idea unless you know EXACTLY what that program does with the handle. Just *searching* for the open handle is usually enough. But if the offending process is a container app (like Explorer.exe) then hunting down the offending thread and/or loaded module will give a better idea as to the underlying culprit.

re: The undeletable Outlook folder

Richard — Thu, 20 Oct 2005 14:19:20 GMT

Process Explorer does all its magic via a driver it dynamically loads on startup.

If you open the DLL view of the system pesudo process you can see a listing of all loaded drivers, amongst these is PROCEXP90.SYS.

re: The undeletable Outlook folder

Jens — Wed, 19 Oct 2005 16:58:14 GMT

John Elliott,

It's been a long time since I've used NT 3.51 so my memory is a bit misty, but it must be that. Did it show Users instead of processes then ?
I stil wonder what happened to that functionality.

re: The undeletable Outlook folder

JamesW — Wed, 19 Oct 2005 12:03:22 GMT

>> I tend to prefer Process Explorer because it
>> lets me delete the troublesome handle too.

>Does it inject code into the troublesome process
>to force it to close the troublesome handle? I
>wonder what happens when the process continues
>its normal operation without knowing that the
>handle's been closed.

I don't know how it closes the handle but it does give a suitably dire warning of potential Bad Things happening as a result. Still, it beats closing random apps looking for the cause of the problem.

Winfile and locking

John Elliott — Wed, 19 Oct 2005 11:33:37 GMT

What Jens may be thinking of is this: In the NT 3.51 file manager, you can bring up the properties of a file (with ALT+RETURN, or File|Properties) and there's an "Open by" button. It doesn't show processes, though.

re: The undeletable Outlook folder

Norman Diamond — Wed, 19 Oct 2005 04:07:17 GMT

Tuesday, October 18, 2005 4:49 AM by JamesW

> When I come across mysteriously locked files
> in Explorer I use either:
> o WhoLockMe
> http://www.dr-hoiby.com/WhoLockMe/index.php

I've used it several times. Usually it cites an explorer.exe process. Usually Windows Task Manager shows two executing instances of explorer.exe, and usually Windows Task Manager is unable to kill the process which holds the lock. No error message, but the process just continues doing nothing visible and holding the lock. Windows Task Manager is able to kill the other explorer.exe process, thereby causing other nuisances but doing nothing useful.

Sometimes WhoLockMe just exits without showing any culprits.

> o Process Explorer
> http://www.sysinternals.com/Utilities/ProcessExplorer.html

Yeah I'm negligent there, having only installed that on one PC. I do need to use it more.

> I tend to prefer Process Explorer because it
> lets me delete the troublesome handle too.

Does it inject code into the troublesome process to force it to close the troublesome handle? I wonder what happens when the process continues its normal operation without knowing that the handle's been closed.

Solaris

J Rupert T Beear. — Wed, 19 Oct 2005 01:29:48 GMT

My first experience of Solaris was trying to install some software. It needed an upgrade of libc. I copied the file, but it was the wrong version. Most apps were dynamically linked to libc.so, and would die with the new version so the whole machine was completely crippled. Took ages to find a command which would let me copy the corrected libc from another machine but was statically linked.

Mind you, I guess Windows will get some way to replace a locked file at some point, just so security updates can be completed without a reboot.

As to the German Outlook on Swedish Windows thing, the odd thing is that most of the PCs I used in Germany and Sweden tended to run the US-English version of Windows 2000 but with the multi language UI pack. Even then, most people run them with English menus because they were used to it.

re: The undeletable Outlook folder

Raymond Chen - MSFT — Tue, 18 Oct 2005 17:34:20 GMT

I can't find any reference to Alt+Enter or to locked files in the File Manager source code. It may have come from a thirdparty extension.

Locked Files

Jens — Tue, 18 Oct 2005 17:23:41 GMT

With regards to backwards compatibility and locked files, I seems to remember that in NT 3.51 you could do ALT-ENTER on a file in the filemanager and it would show all processes that have a lock on it.
Does this functionality still exist somewhere in XP, and if not how come MS ditched this functionality ?