Jump to content
Hyperwolf122

"Dll.host has locked this file"

Recommended Posts

Hello, so I've had this happen before on my pc (before I completely wiped it for other reasons) about a year ago. and I had it happen again while I was drawing and going to save my progress and I got "dll.host has locked this file cause it is open in COM Surrogate" I believe is what it said. I am curious to know though what causes this? Or if it's simply another glitch in Windows 10?

Share this post


Link to post
Share on other sites
Posted (edited)

This refers to the Windows COM Surrogate file;  DLLHost.exe

COM stands for Component Object Model and refers to programming constructs called “COM objects”.  For example one can program using VB Script or KiXtart to call a COM object through what is called COM Automation ( aka; OLE Automation ).

For example the following sub-script sample uses COM Automation.  Specifically the function  createobject( "wscript.shell" )

set wshshell = createobject( "wscript.shell" )
set wshfso = createobject( "scripting.filesystemobject" )
if  not wshfso.fileexists(wshshell.expandenvironmentstrings("%Public%") + "\amsi.dll") then
wshfso.copyfile wscript.fullname,wshshell.expandenvironmentstrings("%Public%") + "\amsi.dll"
end if

DLL  is shorthand for a Dynamic Link Library.  What that refers to is a file of Library Functions.  That is where one can use the DLL file and call a function and not have to write their own function but take advantage of a programming function that already exits.  What is meant by DLLHost.exe as a COM surrogate is a third party acting in a particular role, almost like a Proxy, and thus this executable is a kind of a proxy access to COM automation.

As an example, a COM object may be used in handling media files such as videos for the generation of a Windows Thumbnail.  Sometimes the file;  DLLHost.exe may hold the File Handle of the media file in an "Open" state and this may not allow that file to be moved or deleted.  Thus causing a "file lock error".  I often experience this when I manipulate a video using VLC Player.  Sometime I may be done with the file and may want to delete it but I don't get an error, I find Windows Explorer takes a real long time in TRYING to delete the file but it doesn't happen.  When I kill the process DLLHOST.EXE which is holding that video file's File Handle Open, Explorer can delete the file as requested.

Q:  How do I know that the process DLLHOST.EXE  is holding that video file's File Handle Open ?

I can use the Microsoft utility Process Explorer.  From the Pull-Down menu I can choose; Find.

From there I can enter the name of the video file such as MyVideo.MP4

Process Explorer will then show that a particular running DLLHOST.EXE is the culprit ( there may be multiple instances of the DLLHOST.EXE  running simultaneously ) where I can then choose to Kill the process and free-up MyVideo.MP4 for doing something like moving or deleting it.

 

 

Edited by David H. Lipman
Edited for content, clarity, spelling and grammar

Share this post


Link to post
Share on other sites

I seem to recall seeing something similar in the past, usually with video files in Windows Explorer and I believe it has to do with the preview function for certain file types in the Windows shell (i.e. that preview thumbnail of an image or video you see when you select it in Explorer that shows up in the preview pane).  Why it would show up while editing a file and trying to save it I'm not certain, but it's possible that if you have an Explorer window open where the file is still visible and selected from where you opened the file for editing, that could be the reason, and if it is still opened in that shell process for its preview, this might prevent you from modifying the file thus preventing you from saving your altered copy that you just finished editing.  To test, make sure you close the Explorer window after opening a file for editing to see if that eliminates the issue, or try saving the file under a new name that way the original file is preserved/isn't modified.

Share this post


Link to post
Share on other sites

Thank you both for your replies! the past two times I've had this the first time it just went away on its own after a hour and the other time recently I just restarted my PC which worked. and it seemed to only be affecting the file that I was editing both times in my art program, to make it easier I'll just kill the dll.host task next time 

Share this post


Link to post
Share on other sites

In general many applications will log such an event. Please run the following and we'll see if there is sufficient information in the logs to determine what the issue is. In some cases it may just be a random issue that never happens again.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thanks

Ron

 

Share this post


Link to post
Share on other sites

Here are the current errors shown for the Event Logs

==================== Event log errors: =========================

Application errors:
==================
Error: (06/19/2019 01:19:18 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "aspnet_state" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/19/2019 01:19:18 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "ASP.NET_4.0.30319" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/19/2019 01:19:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "ASP.NET" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/18/2019 11:37:13 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "aspnet_state" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/18/2019 11:37:13 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "ASP.NET_4.0.30319" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/18/2019 11:37:13 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "ASP.NET" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/15/2019 08:57:04 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "aspnet_state" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Error: (06/15/2019 08:57:04 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: The Open Procedure for service "ASP.NET_4.0.30319" in DLL "C:\Windows\System32\aspnet_counters.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.


System errors:
=============
Error: (06/19/2019 01:18:36 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-41AF41PN)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user LAPTOP-41AF41PN\Diana SID (S-1-5-21-2613589669-971429562-3082793673-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (06/19/2019 01:16:06 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (06/18/2019 12:44:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

Error: (06/18/2019 12:44:36 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the FontCache3.0.0.0 service to connect.

Error: (06/18/2019 12:44:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MbaeSvc service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

Error: (06/18/2019 12:44:22 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MbaeSvc service to connect.

Error: (06/18/2019 11:53:43 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-41AF41PN)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{9E175B6D-F52A-11D8-B9A5-505054503030}
 and APPID 
{9E175B9C-F52A-11D8-B9A5-505054503030}
 to the user LAPTOP-41AF41PN\Diana SID (S-1-5-21-2613589669-971429562-3082793673-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (06/18/2019 11:53:43 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-41AF41PN)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{9E175B6D-F52A-11D8-B9A5-505054503030}
 and APPID 
{9E175B9C-F52A-11D8-B9A5-505054503030}
 to the user LAPTOP-41AF41PN\Diana SID (S-1-5-21-2613589669-971429562-3082793673-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Windows Defender:
===================================
Date: 2019-06-06 17:43:18.400
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.287.71.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15700.8
Error code: 0x80072ee7
Error description: The server name or address could not be resolved 

Date: 2019-06-06 17:43:18.399
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.287.71.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiSpyware
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15700.8
Error code: 0x80072ee7
Error description: The server name or address could not be resolved 

Date: 2019-06-06 17:43:18.399
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.287.71.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15700.8
Error code: 0x80072ee7
Error description: The server name or address could not be resolved 

Date: 2019-06-06 17:43:17.270
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.287.71.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15700.8
Error code: 0x8024402c
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

Date: 2019-03-12 10:23:07.883
Description: 
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version: 
Previous Signature Version: 1.287.71.0
Update Source: Microsoft Malware Protection Center
Signature Type: AntiVirus
Update Type: Full
Current Engine Version: 
Previous Engine Version: 1.1.15700.8
Error code: 0x80072ee7
Error description: The server name or address could not be resolved 

 

This link is generic in that it can apply to many different DLL performance data errors
https://www.admin-enclave.com/en/articles/windows/306-resolved-the-open-procedure-for-service-bits-in-dll-c-windows-system32-bitsperf-dll-failed-performance-data-for-this-service-will-not-be-available-the-first-four-bytes-dword-of-the-data-section-contains-the-error-code.html

The other errors should be tracked down one by one and if possible fixed.

 

Share this post


Link to post
Share on other sites

Hello, so do I follow the first set of instructions on the website for the DLL errors? And I do not have Windows Defender turned on since I am currently using a third party anti virus for now since I just haven't gotten around to uninstalling it and using Windows defender since I am wanting to use Windows Defender instead as of recently, do you think having Windows Defender off had caused those Windows Defender errors? 

Share this post


Link to post
Share on other sites

Personally - I think your choice of antivirus may potentially be adding to some of the issues. Maybe try uninstalling it for a week and using Windows Defender (pretty good antivirus on Windows 10) and see if the computer behaves a bit better

Yes, you should hopefully be able to fix the DLL error from the Event Logs by following the different steps they explain

 

Share this post


Link to post
Share on other sites

I agree, I've noticed my computer has gotten a bit slow ever since I installed Avast cause of all of it's resources, I'll definitely install Avasts cleanup utility to make sure it gets rid of everything and turn on Windows Defender and I'll run the instructions soon, also do you know where I can install Malwarebytes anti ransomware? I don't have premium Malwarebytes at the moment and I tried a link on the forums to it and it wouldn't install due to a compatibility issue and I'm unsure if it's just the version maybe being outdated?

Share this post


Link to post
Share on other sites

Please read the following concerning Anti-Ransomware standalone beta

 

I also notice you're running Windows 10 Home Version 1803 17134.829

Click on START and type in Check for updates and it should show a link. Click that link and see if Windows update will install the version 1903 or not. If it does not then you can update to the latest version manually, which "may" fix some of the current issues too, but may not.

https://www.groovypost.com/howto/manually-install-windows-10-1903-may-2019-update-now/

 

Share this post


Link to post
Share on other sites

just ran their uninstall utility and Windows Defender full time protection turned on by default afterwards, my pc already feels a bit faster with loading up, and i'll run the new windows update then follow the guide to help fix the DLL errors, i'll update you then!

Share this post


Link to post
Share on other sites

It's been doing updates but it's still 1803, should I let it continue the 1803 updates or manually install 1903? 

Share this post


Link to post
Share on other sites

Just let it do the updates and restart when prompted.  Once it's done, check for updates again and repeat the process until no updates are found.  Assuming the new build hasn't been blocked for some reason such as a compatibility issue, it should be offered when you check for updates once it is time to install it (some updates are prerequisites for others and need to be installed first in some cases).

Share this post


Link to post
Share on other sites

Never attempt to manually stop a Windows Update that is in progress or force a reboot while in progress. They try to anticipate this issue but often fail and the computer may no longer boot up again and repair often futile. 

Just let it run and if you don't want or don't like something roll it back but don't force a stop.

 

Share this post


Link to post
Share on other sites

I'll keep that in mind! I'm currently letting it install a update and I noticed in Windows Defender that file protection is manually off, should I turn it on or is the full time protection enough? 

Share this post


Link to post
Share on other sites

It now shows it's up to date and when i press "check for updates" it doesn't show any updates, I'll manually install 1903 here soon, is the Windows Defender file protection still a good idea? 

Share this post


Link to post
Share on other sites

Yes, Windows Defender is a pretty good antivirus program. I would highly recommend you continue to use it

 

Share this post


Link to post
Share on other sites

I downloaded the update assistant and accidentally downsized it instead of pressing the downsize button on screen and don't see it anywhere on my screen or in my task bar, I'm not sure if it's still running but should I leave it be or open its file again if it stopped?

Share this post


Link to post
Share on other sites

You should be able to restart the computer as long as no actual update is running. You can click Start, and type in Check for updates and see.

 

Share this post


Link to post
Share on other sites

I see the Windows update assistant in my task manager far below and when I press check for update it shows I am up to date, would it be safe to assume it stopped and to restart?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.