HELPPPP! (Verdammdt handles)

Discussion in 'Computer Information' started by Robert Baer, Dec 1, 2013.

  1. Robert Baer

    Robert Baer Guest

    This is getting worse and worse.
    First, i would rarely get a file that is locked by "another process".
    Then more and more files got that way, and i found that if i drag and
    copy to the desktop, that copy was OK.
    Also, that turning the computer off would fix them all.
    No longer.
    It is so damn bad, that:
    1) burning a CD of the files when unlocked
    2) when some are later locked, copying files FROM THE CD to anywhere
    gives me a GD LOCKED file!!!!!!!!!!!!!!!!!!!!!!!!!!!
    And ProcessExplorer finds NONE of them!

    To say the least,i am F-ing pissed!

    I need (1) to find out what is locking these files so that i can KILL
    it with a sawed-off shotgun loaded with rock salt, and (2) find a way to
    prevent this crap from continuing.

    Robert Baer, Dec 1, 2013
    1. Advertisements

  2. Robert Baer

    Robert Baer Guest

    The bad files were/are all PDF, so i uninstalled my Adobe Acrobat
    4.05 (reader / Writer).
    Then i re-installed it,to no avail.
    The pissy part of this is, the locked (being used by another process)
    file can be accessed by GSview!
    Now,on occasion, a file now comes up in the reader as "viewer cannot
    decrypt this document".
    Again, GSview finds NOTHING wrong with the file!
    Robert Baer, Dec 1, 2013
    1. Advertisements

  3. Robert Baer

    Paul Guest

    Is this still on Win2K ?

    What are you using for antivirus or malware protection ?
    Is real-time scanning enabled on said software ?

    The reason PDFs receive a nominal scan, is because
    the built-in support for Javascript, inside a PDF,
    makes them a "dangerous" thing to download. As far
    as the AV people are concerned.

    I've actually clicked a web page, and someone was
    trying to deliver a PDF file with Javascript
    payload in it. Because the file tried to download
    as soon as the web page appeared, I knew something
    was up. And a check with a hex editor, showed it had
    a Javascript script inside it. Such a script is
    normally not necessary for any reasonable purpose.
    The only time lots of Javascript makes sense, is if
    the PDF you prepare is a "multimedia circus" that
    needs to interact with the user.

    Paul, Dec 1, 2013
  4. Robert Baer

    VanguardLH Guest

    Get Emptyloop's Unlocker utility. Prior to Vista, it's resident helper
    utility would pop up a prompt when you tried to delete a file that was
    inuse. In Win7, that doesn't work and, as I recall, it didn't work in
    Vista, either. You don't really need it. If you try to delete a file
    and cannot, right-click on it in Windows Explorer and select the
    Unlocker context menu entry. It will show you which processes have a
    handle on that file. You can try unloading the app that has a lock on
    the file (could be Windows Explorer, explorer.exe, which is also the
    desktop manager) or use Unlocker to remove the handle and delete the
    file. If it cannot delete it while it is inuse, you can tell it to
    delete on bootup. This uses a PendingRename registry key with the
    action to delete the file. Windows will look at this registry key and
    rename, move, or delete files before it loads any user-mode processes.

    I believe during its install that you should watch for bundleware.
    Their installer is adware and, by default, may try to install other
    unwanted software. A lot of freeware is like this. Do a custom install
    or read the screens carefully so you don't get stuck installing more
    than just the program you intended to install.

    I have used LockHunter in the past and it was mostly good unless I
    needed it to delete a file on Windows bootup. Instead of using the
    registry key, or in addition to it, it wanted to write to some .ini file
    under my %appdata% path but kept failing so I couldn't delete the file
    on a reboot. Unlocker works just as well and better for the delete on
    reboot function.
    VanguardLH, Dec 1, 2013
  5. Robert Baer

    Robert Baer Guest

    * Yes.
    * Avast!
    * Yes.
    * Well, many of the files were created locally using Word or locally
    scanned document printed to the Acrobat PDF printer (courtesy of Acrobat
    Some of the PDF files were sent via e-mail from individuals.
    * None of the PDFs received from individuals had any "multimedia"
    indications in the text; no reason for that flim-flam as these were
    court and related documents.
    At present,there is only one PDF file with a problem (cannot decrypt
    In the past, when i had a bunch of PDFs most being used by another
    process, i saw a second sub-process; do not remember what that was.
    But the Baby Bird (GooGull) references indicated that the system file
    can be corrupted and gave a way to fix it.
    Right now,the only suspicious process is LSASS,and the Baby Bird
    refers to:
    I am leery of generic fixes like this; no way of knowing what kind of
    damage lurks behind downloads.

    Isn't there a program that will ALWAYS show files that pretend to be
    busy (no prompting)?
    I say "pretend" because those PDFs that could not be opened by the
    Acrobat Reader, could be easily opened by GsView, Kedit, and Notepad.

    And what about a program that will do a little debugging of this
    "cannot decrypt" business?
    Robert Baer, Dec 1, 2013
  6. Robert Baer

    Robert Baer Guest

    Well, i am not trying to delete a file, and when i do, there is NO
    Maybe the Unlocker or LockHunter will show the locked files and allow
    me to JUST remove the lock; better yet tell me which F-ing program is
    grabbing on to it (could be of great help).
    Thanks; will try on a HD copy.
    Robert Baer, Dec 1, 2013
  7. Robert Baer

    Paul Guest

    You can try Wikipedia for LSASS. I think it's one of those
    processes, that if it were to die, the OS would shut down.

    This article gives an example of something that "messes with LSASS".


    For "cannot decrypt" you would need to see the security properties
    of the document. Acrobat has a properties page. In a search, I
    haven't found anything better yet.

    Documents can be protected at least three ways. With a
    password. With a security certificate. And with Adobe Livecycle
    (some kinda server for documents).

    What's weird, is that a PDF (logically), you should
    alway be able to check the properties. It isn't very useful
    to pop up a dialog like that, unless the viewer tool
    can state what kind of security is in place. It's possible
    the reader is too older to state what the new security
    method is. I have yet to find a tool that can just
    list the document properties, without actually opening
    the document.

    Paul, Dec 1, 2013
  8. Robert Baer

    VanguardLH Guest

    As mentioned:
    "right-click on it in Windows Explorer and select the Unlocker context
    menu entry. It will show you which processes have a handle on that

    Unlocker will tell you what processes have a file locked. You might not
    want to delete the file but you might want to find out what has a file
    handle on it. There are lots of utilities to tell you which process has
    a handle on a file. For example, SysInternals' 'handle' tool
    ( will
    tell you which process has a handle on the specified file. Nirsoft has
    their tool ( There
    are lots of these type of open-handle utilities.

    Those are static tools. They show you which process currently has a
    lock on a file. To see a log of locks on a file, especially if the file
    isn't always locked but often enough to interfere with your management
    of the file, then look at SysInternals' Process Monitor. You can define
    a filter so it only shows log entries with the specified criteria, like
    the filename. That's how, for example, I found 2 active anti-virus
    programs were competing on a file that an application was updating.
    Each time the app changed the file, the two active real-time scanner
    would battle over the file and end up issuing over 3000 'open' commands
    on the file to interrogate it. That's why, for example, it is
    recommended to have more than one anti-malware program on your host for
    overlapped coverage BUT only one of them should be active at a time
    (only one should have its on-access or real-time scanner enabled).

    So you can get the single-purpose utilities that show you which process
    has a lock on a file or you can get Unlocker which will show you the
    same info but with the added functionlity of letting your force a move,
    rename, or delete of the file or just unlock it (Unlocker is, um, an
    unlocker and not just a file deleter).

    By the way, a load of rock salt won't penetrate the PC's case. Won't
    damage the PC (well, might dent the case) but could assuage your anger.
    VanguardLH, Dec 1, 2013
  9. Robert Baer

    Robert Baer Guest

    Well, since the document does not load, it is impossible to see
    "security" or any other properties.
    I took another OS HD and used Adobe 9 on the offending documents.
    Adobe 9 opened them,but on the op line (above anything else) there
    was added text "(SECURED)" no quotes.
    Since Adobe 9 on my original HD was severely interfering with Acrobat
    4.0 read and PDF creation, i did not install it on my latest one-OS HD.
    At least i can use GsView on this new drive to look at them; used
    GsView to create a differently-named PDF which is perfect.

    So, yes, your comment about "security" was spot on, and i now have a
    useful work-around.


    So, all i now need to do is keep a watch for locked PDFs.
    Robert Baer, Dec 2, 2013
  10. Robert Baer

    Robert Baer Guest

    As i mentioned before, PROCEXP.EXE does not work; it finds NO locked
    files,even imediately after i determine that there are 1-5 locked PDFs.
    Ditto with Handle
    Unlock should be perfect, provided it FINDS them!
    OpenedFilesView looks even better; it even shows what i have been
    mumbling about - the internal HEX values assigned/used for the handles!

    Thanks! Will try OFview first,when i next see this problem.
    Robert Baer, Dec 2, 2013
  11. Robert Baer

    VanguardLH Guest

    I didn't say Process Explorer. I said Process MONITOR.

    Process Explorer shows you info on, well, processes. When a file is
    locked and you're trying to do something with the file, it's a good bet
    you have no clue which process has an open handle on that file. So
    you're going backwards with Process Explorer where you would have to
    know the process to then find out what files on which it had a handle.
    While Process EXPLORER has functions that I may still not know about (it
    can do lots of functions), I don't recall it ever showing you on which
    files a selected process had handles. That's not its purpose.

    So use Process MONITOR as mentioned. SysInternals used to have a
    separate file monitor (FileMon) and registry monitor (RegMon) but
    they've rolled those together into Process Monitor (ProcMon). Use its
    filtering to focus in on a particular file is you want to see what it
    touching it over time.
    If those don't report a open handle on the file then there isn't one.

    Are you claiming if you run 'handle' with no parameters that you do not
    get a ton of output that lists all files with existing handles? I do.

    If I run 'handle outlook.pst', it shows the outlook.exe process has a
    handle on that file. If I load a .pdf file into a PDF viewer (Adobe
    Reader, for example) and run 'handle <filename>.pdf', it shows
    AcroRd32.exe as having a handle on that PDF file.

    I suspect you didn't use the correct command-line syntax for 'handle'.
    Just how are you manipulating these locked files if not accessing them
    through the Windows file system whether by using Windows Explorer or DOS
    shell commands? If you are accessing the locked files using some other
    app, doesn't that app issue an error while also specifying the filename;
    else, how do you know there is a problem with a locked file? Once
    you're told a file is locked (because the app cannot exercise some
    action on it) then use the reported filename in Windows Explorer to
    right-click on it and select Unlocker to see what processes have a
    handle on that same file.
    Whatever. Lots of free utilities have the same functionality. What
    OFview shows is also what Process Monitor will log (provided you loaded
    it BEFORE a handle was opened on the file so you see a *log* of file
    commands on that file) and what SysInternals' show. OFview is perhaps a
    little easier to use.

    Personally I don't know what you're going to do with the actual handle
    number shown in OFview. You want to know what *process* has a handle
    still open on the target file.
    VanguardLH, Dec 2, 2013
  12. Robert Baer

    Robert Baer Guest

    OFview gives both the process name and path.
    It is extremely informative, but so far,shows nothing useful.
    Files are getting corrupted during editing now, sometimes.
    I only know after the fact - which is when all is settled.
    Real crap!
    Robert Baer, Dec 3, 2013
  13. Robert Baer

    VanguardLH Guest

    So you're editing PDF files? With what? Sounds like you have a bad app
    for editing PDF files, or maybe the demo period expired and now you
    either have to uninstall it or pay for it.

    Since you're editing and then trying to do something with the file, you
    already know where is that file. OFview shows the path but the other
    utilities only require you to enter the filename, like goofy.pdf, and
    don't need a path.

    When you exit the unidentified PDF editor, is it really unloaded? With
    it loaded, look in the Processes tab of Task Manager to see the
    executable filename for the PDF editor. Then exit the PDF editor.
    Check again in Task Manager that the program's process actually did

    Have you tried booting Windows into its safe mode? That will eliminate
    interference by any software you installed that loads on startup. Don't
    go editing the file in the safe session. Just see what happens when you
    try to copy, move, rename, or whatever you're trying to do with the file
    by itself. Then with Adobe Reader, PDFxchange Viewer, or another PDF
    viewer app (and not an editor, like Adobe Acrobat), see if you can open
    and view the .pdf file. Maybe its corrupt.
    VanguardLH, Dec 4, 2013
  14. Robert Baer

    Robert Baer Guest

    Not editing; create in Word by printing to the PDF printer.
    Resulting file (a few daze ago) was then locked - could not be read
    by Acrobat - but GSview could see it all, and Kedit could open it, etc..
    Now i am getting trashed .BRD files from Eagle; nothing visible in
    Eagle. But make Gerbers, and see the shapes.
    Robert Baer, Dec 4, 2013
  15. Robert Baer

    VanguardLH Guest

    Whose PDF emulation printer? I've used PDFcreator and am now using
    Bullzip PDF Printer.

    Or instead of printing (to PDF) did you mean Save As (to .pdf)?

    Word is an editor so any document you create or open with it is editing
    that document. Word will need write access to the file when you open it
    and write access when you save it. An editor may only need read access
    when it opens an existing file but it will definitely need write access
    when you try to save changes into a file.
    Acrobat is also an editor which means when you save a document that it
    must have write access to the file. I don't know if Acrobat will open
    an existing file without also setting write access mode on that file but
    since it is an editor then it is likely. Notepad, for example and from
    what I've read, will open a file in read mode and not attempt to add
    write mode until you save changes.

    If the file is not opened in exclusive mode (the file is opened for
    reading and not locked) then other apps can concurrently read from the
    file. That is, when opening a file (for reading only), the app can
    decide if it wants to share or not share the file. Editors (e.g.,
    Acrobat) could open a file in read mode but decided whether or not to
    share it with other read-only apps.

    When creating or opening a file, an app calls the file API in Windows
    and can specify. See:
    "You cannot request a sharing mode that conflicts with the access mode
    that is specified in an existing request that has an open handle."

    Few programs allow concurrent or shared write mode. Shared write mode
    is used when multiple processes need to coordinate data between them or
    provide a common output source, like for logging. Standard user-mode
    apps would end up corrupting a shared-write file with them trying to
    concurrently write to it, especially since they don't coordinate with
    each other. When you're editing a file in Word, you don't want Notepad
    screwing it up.
    VanguardLH, Dec 4, 2013
  16. Robert Baer

    Robert Baer Guest

    When I said printing i meant that; it is stupid and non-productive to
    take a Word document and Save As .TIF, .PDF, .SCR, or anything else that
    Word does not support; i am not sure it is even possible.

    I have and use a full (R/W) version of Adobe 4.05.
    The printer created from that after install is called "Acrobat
    PDFWriter on FILE:" in Excel, and for (manually) making PDFs from inside
    programs (Word, CorelDraw, ExpressPCB, Eagle, Excel, etc) is done by the
    File/Print pulldown, and choosing the Acrobat PDFWriter printer.

    Following all in same folder:
    There are two cases, (1) i create from scratch a Word document and
    Print to File using the Acrobat PDFWriter, giving an appropriate
    filename and (naturally) the filetype of PDF; (2) receiving a Word
    document from an external source and modifying that to my needs and then
    Print to File etc.

    Do other Word documents, use Acrobat reader to look at PDF files,
    maybe use Word to edit a .DOC while looking at a PDF file.
    Maybe only use Acrobat reader to look and print a PDF; this is when i
    see problems; more often on the "foreign" documents.
    So far, NEVER (hold breath now) see problem OUTSIDE that particular
    Robert Baer, Dec 5, 2013
  17. Robert Baer

    VanguardLH Guest

    That means you are creating a [new] file by "printing" to a PDF
    emulation printer driver. You tell the app to print but its output
    doesn't go to a real printer but instead to a driver that cooperates
    with PDF software to generate a .pdf file. Word can't do that type of
    printing. A PDF printer emulation driver is not part of Office or Word.
    You had to install a separate "PDF printer" that would show up when you
    elect to print a doc opened inside of Word.

    Word 2010 lets you "print" to a printer which could be a PDF emulation
    printer (driver) that you separately installed. You're just using the
    Print function inside of Word and electing to direct its output to the
    PDF printer driver. Word 2010 also lets you do a Save As and elect to
    save the document into a .pdf file. Whether you print to a PDF printer
    or Save As to a .pdf produces the same result: you get a .pdf file.

    While Word 2010 lets you Save As to a .pdf file, and because Word in
    prior versions didn't have this feature, and because lots of other
    programs cannot output to a .pdf file, lots of PDF printers showed up to
    alleviate that deficiency. Even in Notepad you can use its Print
    function to send output to a "PDF printer" (driver+software that takes
    print output from any app with a Print function and stores it into a
    ..pdf file instead of dumping out a hardcopy on paper in real printer).
    Yep, that's the PDF emulation printer driver (with accompanying software
    to generate the .pdf file). Perhaps Adobe's PDF printer has some extra
    functions to let you alter how the .pdf file is generated; however, the
    Save As function in Word 2010 will also create a .pdf file. Two routes
    to the same destination.

    If the PDF files with which you have problems are those generated by
    "printing" to the PDF emulation printer then may the driver or software
    for that PDF printer are corrupt, missing files, or configured wrong.
    Can you go into Programs to select Adobe to do a custom uninstall of
    just its PDF printer and then follow with another custom install
    (change) that only does the PDF printer install? This would delete and
    then step on the PDF printer setup to see if an update gets this PDF
    printer working correctly again.

    Otherwise, and unless Adobe's "PDF Printer" has some stupendous
    functions not available in other PDF emulation printers, I'd say to try
    to a different PDF printer, like PDFcreator or BullZip PDF Printer (both
    free). Both of those use Ghostscript. You mentioned GSview worked and
    that uses Ghostscript.

    Even if there is a later version of Ghostscript than comes bundled with
    PDFcreator or Bullzip (or the one they offer to download and install
    when installing those apps), I'd stick with the version of Ghostscript
    they want to use to ensure the PDF printer software works with the
    installed Ghostscript version. Some PDF printers will do a generic
    install of Ghostscript; that is, they install Ghostscript as its own
    program in its own Programs folder and reference it from there. Some
    will install Ghostscript under a subfolder in the install folder for the
    PDF printer program. This has them use THAT particular version of
    Ghostscript and not step on some other program's own copy of Ghostscript
    which might require an earlier or later version of Ghostscript. Like
    with the "DLL hell" problem with programs stepping on the same DLL files
    which resulted in methods (functions) inside them changing that screwed
    up programs that relied on old or newer methods, using the same global
    install of Ghostscript might not work well with a particular PDF printer
    program. Use the version of Ghostscript the PDF printer program
    suggests to use (if installed globally for use by any program wanting to
    use Ghostscript) or use a PDF printer program that has its own copy of
    Ghostscript under its own folder. BullZip PDF Printer installs (after
    download) its desired version of Ghostscript and saves it as a "gs"
    subfolder under its program folder. I don't remember what PDFcreator
    did when I used it many years ago.
    VanguardLH, Dec 5, 2013
  18. Robert Baer

    Robert Baer Guest

    Installation of Adobe 4.05 does not in any way suggest printer
    schemes,except some stupid creator scheme that i forget their name; i
    always uncheck that and so do not remember.
    It is the Settings / Printers / Properties / Ports where one can
    direct the output of a given printer (LPT1: in this case).
    GSview and GhostScript had been previously installed and were never
    touched by anything.

    In any case, i have had the Paraben screen capture refuse to open
    one or more previously viewed files (BMP, JPG, etc) and report "not
    found" because they were locked.
    Also i have had .CDR files that HAD known contents open with name of
    Graphic1.CDR; if i close CorelDraw (NO SAVE!!) and copy those files
    elsewhere, they are OK and EXACTLY the same size.
    Moving a copied VERIFIED OK file from outside the original folder
    back in (even with new name) "converts" them into the same crap; on rare
    occasion those i had copied to outside also become messed up.

    Only turning the computer off fixes the problem.
    I have yet to find a way of determining WTF.
    Robert Baer, Dec 11, 2013
  19. Robert Baer

    VanguardLH Guest

    Not sure what you're arguing about. You said the install of Adobe
    Acrobat created the "Acrobat PDFWriter" printer. Well, that's a
    emulated printer whose driver converts print output from any app with a
    Print function into PDF content to save into a file. The "on FILE:" is
    merely telling you the output of the Print function is going to get
    saved into a file of your choosing (instead of hardcopy on paper).

    From what I could find described for it, and links at Adobe's site, it
    is a function of Adobe's PDF Creator product -- which you say you don't
    install. Must've been you installed it at one time. Or maybe you
    uninstalled it, never included it in any later installs or upgrades, but
    you never deleted that printer so the software to back it up in
    functionality isn't there or is incomplete.

    That is Adobe's driver and software to emulate a printer. I have yet to
    find any mention that Adobe used Ghostscript to perform the PS to PDF
    conversion. Whether Ghostscript is installed on your computer or not
    won't stop the Adobe PDF Writer printer from working (and similarly
    repeated reinstalls of Ghostscript to older or newer versions won't
    affect Adobe's PDF Writer printer).
    But you said GSview worked to view the PDF file(s) and it uses
    Ghostscript. So Ghostscript doesn't have a problem rendering the PDF
    file. So let's stop focusing on GSview, Ghostscript, and any other PDF
    tools that use Ghostscript (the globally installed one or a private copy
    in a subfolder under the Ghostscript-enabled app's install folder).
    That Ghostscript works is not going to resolve your problem as to why
    generating PDF files using Adobe's PDF Writer isn't working.
    So are you now saying that it is not just .pdf files that you have
    problems with locks (open file handles) on them?
    Reboot Windows into its safe mode. Check if the problem goes away since
    safe mode will not load non-critical services and not load startup
    items. If that works, run msconfig.exe to disable all startup items
    (use the Diagnostics mode) and reboot into normal mode for Windows. Is
    the problem still gone? If so then you are loading a program on Windows
    startup that is causing the problem. You then reenable one startup
    item, reboot, and recheck if the problem reappears. If the problem
    isn't there, repeat by reenabling another startup item, reboot, and
    retest. Keep repeating until the problem reappears. The last (most
    recent) startup item you reenabled is causing the problem.

    I mentioned Windows safe mode several posts back a week ago but you
    never said you tried it to see if the problem remains or goes away.
    VanguardLH, Dec 11, 2013
  20. Robert Baer

    Robert Baer Guest

    I now remember the name of that stupid aspect - "Distiller" which i
    have never installed (so could not have un-installed it).
    The stupidity is that "Distiller" is supposed to be some kind of
    (hold your hat) _printer_ (!!).

    Safe mode was of no help (yet).

    Seems that even in normal operation that i do not get locked or
    "corrupted" files if i do only casual use of a program where i see a
    problem; it is when i am doing intensive work where the problem is found
    on SOME of the that i work on.
    eXtremely frustrating; pisses me off even thinking about it.
    Robert Baer, Dec 11, 2013
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.