save file in excel and sharing violation

NTFSD
1

Hi,
I’m implementing a minifilter driver that add headers to office files.
I’m having problems with excel.
The problem is that when I do “save” in the excel I get the following error message:
“the document was saved successfully but excel cannot re-open it because of a sharing violation”
I couldn’t see in procmon any error about any file open.
In the past I had timing issues with other office applications so I tried to recreate the issue with scanner sample from the WDK.
And when I “simulate” a real scan by sleep of 100 milli (in the user-application) I see several issues when trying to open an excel file all related to some sharing violation.
While searching this error in google I found that its related to anti-virus activity.
Anyone know what cause excel to complain about the file? How can I override it?
My driver does some activities in post-create, pre set_information, pre-cleanup, pre-close.
Any help is more than welcome.
Regards,
Sagi

2

I got the same problem

3

Hi,
Have you found any solution or way to bypass it?

4

That means there is another instance of the file?open with incompatible share access. First you need to find out the driver returning the sharing violation status and track all the opens (IRP_MJ_CREATE and IRP_MJ_CLEANUP and IRP_MJ_CLOSE) to it preceding to the sharing violation. You can use procmon to monitor this but be aware that?procmon?might not be able to intercept all the create to the targeted driver – so you might need other way to track it. Then you should be able to find the one open conflicting with the failed open. You then need to understand who triggers that open (the app or your driver or third party driver) and why it is not closed.

Lijun

From: “xxxxx@ngsoft.co.il”
To: Windows File Systems Devs Interest List
Sent: Mon, December 28, 2009 9:40:00 AM
Subject: [ntfsd] save file in excel and sharing violation

Hi,
I’m implementing a minifilter driver that add headers to office files.
I’m having problems with excel.
The problem is that when I do “save” in the excel I get the following error message:
“the document was saved successfully but excel cannot re-open it because of a sharing violation”
I couldn’t see in procmon any error about any file open.
In the past I had timing issues with other office applications so I tried to recreate the issue with scanner sample from the WDK.
And when I “simulate” a real scan by sleep of 100 milli (in the user-application) I see several issues when trying to open an excel file all related to some sharing violation.
While searching this error in google I found that its related to anti-virus activity.
Anyone know what cause excel to complain about the file? How can I override it?
My driver does some activities in post-create, pre set_information, pre-cleanup, pre-close.
Any help is more than welcome.
Regards,
Sagi

—
NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

I think I had fixed this problem.
May be you should check your FltCreate parameters,if you had used it .In my case I passed a unsuitable parameter cause this probelm.

good luck

6

If office said “sharing violation”,there must be sharing violation,haha…
May be your driver opened the file with a unsuitable share flag in somewhere,then office reopen it,and then there is an “sharing violation”.

7

Hi,
My driver don’t use FltCreate API. it allways use the original stream.
In addition I reproduce similar sharing violation problems with the WDK scanner sample that also don’t open the file itself but only read the file using the original handle.
To recreate the sharing issues in excel with the scanner sample I only put sleep for 100 milli in the scanner user-mode application to “simulate” real scanning in an open operation.
I don’t see any failures in procmon about IRP_MJ_CREATE.
Lijun Wang said that this might happen so I need to track the open/close in a different way. What other method I should use? the minispy sample?
I used fltmc filters to see if there are other filters that might influance the flow and I saw only my filter and procmon.
Does anyone know if there is a debug version of office applications? Is there a way to receive log files to better understand what went wrong? is the office applications pdb files available?
Thanks,
Sagi