DLL being marked as DELETEPENDING

Question

I have a problem running an application on one of my Windows boxes. I cannot replicate it on other similar Windows boxes, and it has only just started occurring. Here's the situation:

1. Using Visual Studio, I can build an application that I have written. It builds one executable: Application.exe, and I can see in its bin/Debug directory, this executable and all of the DLLs that I know the application depends on, including Microsoft.Windows.Azure.Configuration.dll.

2. When I run the application, the application stops running, and when I come to investigate the problem, I can see that the Microsoft.Windows.Azure.Configuration.dll has been renamed to Microsoft.WindowsAzure.Configuration.dll.5502888.DeletePending.5502888.DeletePending.5502904.DeletePending.5502919.DeletePending.5502935.DeletePending.5502950.DeletePending

I have never seen this behavior before, though I have been running the same application for a year or so on this machine. Does anyone know what might happening?

Thanks for any help.

Answer 1

While I haven't seen this myself, I know that Windows supports pending deletes (as tracked in the FILE_OBJECT structure) if you open the file with the right permissions.

Loking around the Internet, I see that others have hit this issues with Windows Defender and others have commented on many other AV software doing similar things. Given that it appears to be a feature of the Windows API, though, any application could cause it.

It looks like debugging with ProcMon from Sysinternals might be the best way to track down what is actually holding the file open.