Windows sysinternals

418 Part III Troubleshooting—”The Case of the Unexplained...”
To make matters worse, he saw the same file being re-read over the network multiple times
in the trace. The trace shown in Figure 17-24 is filtered to show the initial file reads, where the
file offset in the Detail column is set to 0.
FIGURE 17-24 Files being re-read over the network; file offset 0 indicates reading from the beginning of
the file.
The stacks for these reads revealed them to be the result of a third-party driver, SRTSP64.SYS.
The first hint that it is a third-party driver is visible in frames 18–21 in the stack trace dialog
box shown in Figure 17-25. With Procmon configured to obtain symbols from Microsoft’s
symbol servers, SRTSP64.SYS has no symbol information and invokes FltReadFile (frame 17).
FIGURE 17-25 Srtsp64.sys in the call stacks of initial file reads.
Further, the stack frames higher up the same stack (shown in Figure 17-26) showed that the
sequence of SRTSP64.SYS reads were being performed within the context of filter manager
callbacks (frame 31) performed when Project opened the file with the CreateFileW call in
frame 50. This behavior is common to on-access virus scanners.
www.it-ebooks.info