In ProcMon, view the Properties of the process and flip to the Process tab. There is a command line field that shows the full command used to start SVCHOST. You may be able to discern which service SVCHOST was acting on behalf of to do that work just by looking
A quick PowerShell line can help you find the service(s) that use(s) that command to launch if you need it: gwmi win32_service | fl Name,PathName Good luck, Joe From: Jonathan [mailto:[email protected]] Sent: Tuesday, May 10, 2011 12:24 PM To: NT System Admin Issues Subject: Re: Win 7 IE Temp Environment variable woes "Outlook cannot create the work file" Clearing out all temp files and folders didn't do it. I even deleted everything in %USERPROFILE%\AppData\Local\Temp (which included a folder called Temporary Internet Files, which is where the setting in IE said it was pointing). I moved the folder to the correct location under IE, (%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files) and it had me log off... So I launched ProcMon set it to log on reboot, filtered for anything containing %USERPROFILE%\AppData\Local\Temp\Temporary Internet Files.... WHY the HECK does ipoint.exe feel the need to monkey with my Temporary Internet Files?!?!?!?!?!?!?!? grrrrrr..... I launched AppWiz.cpl, and it was there, plain as day - Microsoft Intelipoint 8.0 so I uninstalled Intellipoint, rebooted, (setting ProcMon to log) and the setting reverted AGAIN. This time Sidebar.exe is listed, then further down the line, Pandora is listed.... grrrrrrrrrrrrr......... So, I stopped sidebar from running....changed the IE setting....set ProcMon to log on boot.... booted.....Pandora still writes to that location, however the setting remained as I set it in IE....but I still got the error in Word stating that it could not create the work file. "Changed" it in IE, logged off, logged on... Word launched with no issue. Removed Pandora, set Proc Mon to log, rebooted.... the setting changed, and I have 42 entries in ProcMon on bootup, all point to the undesired path, and are under svchost.exe, with the operation of createfile, and result of path not found. Trying to create files in the content.ie5 folder of the undesired path. Any more thoughts on what would be causing this? Jonathan On Tue, May 10, 2011 at 9:26 AM, Jonathan <[email protected]<mailto:[email protected]>> wrote: There are only two user profiles on the machine, one of which was originally setup as an alternate Admin account and theoretically had not been used since it was setup.....until yesterday. It does happen for both of the existing accounts. I suspect the possibility of a migration related issue, but the issue did not present itself until several weeks ago, and the user started using this machine in October/November of last year. I had the user change the IE setting manually and it seemed to be fine for a while (days, a week?)....then reared its ugly head again, this time resetting itself on every reboot. I've scanned with VIPRE, and found nothing, except for Cain, which they use in their normal job function (Wireless and security). I've started playing with process monitor, but can't reboot the users machine at the moment because they are backing up their system.....in preparation for a wipe. :-( I did clean out at least one of the Temp folders, but I'll attempt to clean them all out. Curious - how would this impact the IE Temp file location? Thanks, Jonathan On Tue, May 10, 2011 at 9:08 AM, Andrew S. Baker <[email protected]<mailto:[email protected]>> wrote: Also, does this problem happen for every user profile on the machine? If you suspect a migration issue, what did the user have before the migration? ASB (Professional Bio<http://about.me/Andrew.S.Baker/bio>) Harnessing the Advantages of Technology for the SMB market... On Tue, May 10, 2011 at 9:06 AM, Andrew S. Baker <[email protected]<mailto:[email protected]>> wrote: In addition to what Richard suggested, try cleaning out the temp folders... ASB (Professional Bio<http://about.me/Andrew.S.Baker/bio>) Harnessing the Advantages of Technology for the SMB market... On Mon, May 9, 2011 at 7:11 PM, Jonathan <[email protected]<mailto:[email protected]>> wrote: Any help here would be appreciated. I'm trying to avoid another engineer having to format and reinstall. I've googled and kb's until I've no other ideas... When launching Word or Outlook (both 2010 - fresh install, albeit likely done via Easy Transfer), the user gets, "Word (or Outlook) could not create the work file. Check the temp environment." In IE (Presently IE8, but had the same issue before removing IE9), the "current location" is listed as %USERPROFILE%\AppData\Local\Temp\Temporary Internet Files\, yet when you click on "View Files" it opens the folder defined by this registry key: HKCU\Software\Microsoft\windows\CurrentVersion\Explorer\User Shell Folders : Cache I can change the setting in IE, reboot, and all is well. I've also tried this: http://support.microsoft.com/kb/2027053 If I reboot again, the problem recurs. I've also tried this on another user profile on the machine, and gotten the same results. It works the first time, but then changes after a reboot. I'm at my wits end. Thoughts? -- Jonathan, A+, MCSA, MCSE ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin -- Jonathan, A+, MCSA, MCSE ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin -- Jonathan, A+, MCSA, MCSE ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
