XPost: alt.comp.os.windows-10
From: nospam@needed.invalid
On Thu, 2/19/2026 4:20 PM, micky wrote:
> Using win11 but you win10 guys are pretty sharp. Did
>
> In alt.comp.os.windows-11, on Thu, 19 Feb 2026 10:59:42 -0500, Paul
> wrote:
>
>>
>> Process Monitor, Filter set to "Operation is Readfile/Writefile/Createfile",
>> then look to see if a particular partition letter is being accessed.
>>
>> https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
>
> Can't get to Agent or Eudora either (like Firefox) to type results when
> procmon running. Is that normal?
>
> Fortunely I've learned the secret method in win11 to take screen shots.
> Af least that worked.
>
> 504 Create file E:\ Success Desired Access R...
> 504 File sysem cont E:\ Invalid Device R. Control 0x9023c(D...
> 504 Close file E:\ Success
>
> And more stuff like this. I'll give more details if anyone wants.
> So why is it doing this, trying to access the drive? And how can I make
> it stop?
>
When you use Process Monitor, in a shell you can use
tasklist /svc
and that will give a listing of PID (process ID) and the name
of the thing.
For example, say that "504" was a PID. Check to see if there is a
process name associated with it. It could be a service host, in which
case we'd need to learn more about it to understand what its sphere
of influence is.
*******
Yes, Shift-PrtScn works, and puts a copy of the screen
into the Clipboard. You can then paste that into a graphics
editing application.
snippingtool.exe takes screenshots, and it can be pinned to the Task Bar
so you don't have to keep typing that into the Start:Run box.
*******
File Explorer can take an interest in a USB stick, but that could happen
if the user attempts to access E: in a windows.
But if 504 has some other name besides "explorer.exe", then you would
want to know what its name is. And tasklist /svc lists both processes
and svchost definitions. Some svchost, have 16 things inside them, but
they may also be someone timid services that hardly ever run.
Whereas wuauserv is a busy-beaver, because it is related to
Windows Update and scanning the side by side tree for work to do. And there
is no good reason for that to be "interested in E: " .
A slack-jawed svchost...
svchost.exe 3532 OneSyncSvc_a49aa,
PimIndexMaintenanceSvc_a49aa,
UnistoreSvc_a49aa, UserDataSvc_a49aa
The OS boots up in a dynamic fashion, and the assignment of process
ID numbers (PID) is in a sense "random". That's why you have to
dump a copy of that info, when doing a Procmon at the time.
Paul
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)
|
