Archived from groups: microsoft.public.windowsxp.general (
More info?)
Hello,
I have performed some research based on the event ID 560, it seems to be a
security related issue. If you click the event, you may found the
explanation: An object was successfully granted a handle and the listed
accesses were granted. This message corresponds to a Security 567 message,
which indicates that an object was accessed, and to a Security 562 message,
which indicates that the handle of the object was successfully closed.
Associated messages have the same Handle ID number.
And I found some articles I think may be helpful:
822786 Event ID 560 Message Is Recorded in the Security Log
http://support.microsoft.com/?id=822786
841001 Event IDs 560 and 562 appear many times in the security event log
http://support.microsoft.com/?id=841001
Hope it helps.
Best regards,
Vincent Xu
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
--------------------
>>Thread-Topic: Explorer.exe disk/cpu drain
>>thread-index: AcWs4mVj/RHR5dBbSImMq7GoW7IF3w==
>>X-WBNR-Posting-Host: 129.123.188.222
>>From: "=?Utf-8?B?dXN1cmZAbmV3cy5wb3N0YWxpYXM=?=" <usurf@news.postalias>
>>Subject: Explorer.exe disk/cpu drain
>>Date: Mon, 29 Aug 2005 14:41:21 -0700
>>Lines: 5
>>Message-ID: <9FAFECEB-DFC6-4543-B323-9F9ADCD8EB3E@microsoft.com>
>>MIME-Version: 1.0
>>Content-Type: text/plain;
>> charset="Utf-8"
>>Content-Transfer-Encoding: 7bit
>>X-Newsreader: Microsoft CDO for Windows 2000
>>Content-Class: urn:content-classes:message
>>Importance: normal
>>Priority: normal
>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>>Newsgroups: microsoft.public.windowsxp.general
>>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
>>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windowsxp.general:452891
>>X-Tomcat-NG: microsoft.public.windowsxp.general
>>
>>I have at least 5 computers where explorer.exe runs almost all the time.
>>Usually it takes up between 20-50% CPU and a lot of disk activity. For
>>example, just for today (8 hrs worth), the security event log is more
than
>>25MB. All of these events say that explorer.exe is failing to access
>>something (event 560). Any ideas what is causing explorer.exe to do this?
>>