Lots of disk activity

Hi,

My daughter has a ME machine and a little over a week ago her computer
started having a lot of disk activity. As she uses the computer the disk is
going a lot of the time. If she just watches the computer (no activity on
her part) the drive starts going like crazy. I had her run a virus scan and
that came up blank. I had her do a disk clean up and then tried to do a scan
disk and it continues to restart. Something is reading or writing to the
drive a lot more than it should. We did a cntrl-alt-del and did an end-task
on everything except explore and it still happens. Any ideas would be
appreciated.

Thanks,
--
Phil

May I suggest you download yourself a process viewer that will not only
tell you which processes are running at any instant but also their cpu
usage at any instance together with their accumulated usage over time.
Knowing the process involved should then make solving your problem
somewhat simpler. I suspect you may find the mystery process accessing
your hard disk to be either Win Me's state manager (stmgr.exe) or
winmgmt.exe. Alternatively you might find that your daughter has FastFind
from Microsoft Office enabled and it is indexing her hard disk.

Suitable viewers include the old but still functional WinTop (part of the
equally old Win95 Powertools available from
http://www.microsoft.com/windows95/d...oy/Default.asp)
through TaskInfo 2003, unfortunately no longer free, (www.iarsn.com) to
SysInternals Process Explorer (www.sysinternals.com where you will also
find many other useful tools and utilities).
--
Mike Maltby MS-MVP



Phil wrote:

My daughter has a ME machine and a little over a week ago her computer
started having a lot of disk activity. As she uses the computer the
disk is going a lot of the time. If she just watches the computer
(no activity on her part) the drive starts going like crazy. I had
her run a virus scan and that came up blank. I had her do a disk
clean up and then tried to do a scan disk and it continues to
restart. Something is reading or writing to the drive a lot more
than it should. We did a cntrl-alt-del and did an end-task on
everything except explore and it still happens. Any ideas would be
appreciated.

Thanks Mike,

I had my daughter downloaded the 95 powertool routine and this is her email
about the results:
Daddy, This is the list in approximate order of what was taking up the
most time and percentages. When my computer started making noise (disk
activity) it
was hard to determine which ones were going because there were about 41
programs running in the box. Here is my list (in order of the most
time):
1. MSGRV32.EXE
2. REGPLAY.EXE
3. STMGR.EXE
4. EXPLORER.EXE
5. REALPLAY.EXE
6. ONETOUCHMON.EXE
7. STIMON.EXE
8. WINTOP.EXE
9. IPMON32.EXE
10. KERNEL32.DLL
11. AVSYNMGR.EXE
12. VSHWIN32.EXE
13. AVCONSOL.EXE
14. SYSTRAY.EXE
15. LOADQM.EXE
16. YBRWICON.EXE
17. 2PORTALMON.EXE
18. YCOMMON.EXE
19. IEXPLORE.EXE
20. HBSRV.EXE

I don't know what most of these are or how to stop them from running. Can
you help?

Thanks,
Phil

"Mike M" wrote:

May I suggest you download yourself a process viewer that will not only
tell you which processes are running at any instant but also their cpu
usage at any instance together with their accumulated usage over time.
Knowing the process involved should then make solving your problem
somewhat simpler. I suspect you may find the mystery process accessing
your hard disk to be either Win Me's state manager (stmgr.exe) or
winmgmt.exe. Alternatively you might find that your daughter has FastFind
from Microsoft Office enabled and it is indexing her hard disk.

Suitable viewers include the old but still functional WinTop (part of the
equally old Win95 Powertools available from
http://www.microsoft.com/windows95/d...oy/Default.asp)
through TaskInfo 2003, unfortunately no longer free, (www.iarsn.com) to
SysInternals Process Explorer (www.sysinternals.com where you will also
find many other useful tools and utilities).
--
Mike Maltby MS-MVP



Phil wrote:

My daughter has a ME machine and a little over a week ago her computer
started having a lot of disk activity. As she uses the computer the
disk is going a lot of the time. If she just watches the computer
(no activity on her part) the drive starts going like crazy. I had
her run a virus scan and that came up blank. I had her do a disk
clean up and then tried to do a scan disk and it continues to
restart. Something is reading or writing to the drive a lot more
than it should. We did a cntrl-alt-del and did an end-task on
everything except explore and it still happens. Any ideas would be
appreciated.

Mike's gone to bed - so hang on for a more authoritative answer, but the
only applications that worry me are

1) RegPlay - which from what I can find on the web appears to be something
to do with playing Bingo on the web (and which is possibly spyware - see
below)

2) STMGR - this is a legitimate program (part of System Restore), but should
not be consistently using large quantities of processor time.

The fact that STMGR is using the CPU so much may be a pointer to a corrupt
System Restore cotrol file set - you can test this by

a) Going to SYstem Restore, and looking to see whather Restore points are
available - and how often they have been created
b) Trying to create a manual Restore ppoint, rebooting, and leaving the
machine alone for 30 minutes - see if that forces a change in habit
c) Change the FOlder Options so that you can see System and Hidden Files and
Folders - then in Widows Explorer, find the C:\_Restore folder, r-click on
its icon, and select Properties - how many files and folders are there, and
how much space is taken up? -How big is the C: drive?
d) look for the file C:\Windows\System\SMGR.DLL - r-click on it, select
Properties, and look at theVersion tab - what is the Version number?


post back with details, and Mike (or I) can advise on any action required


--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Phil" wrote in message
...
Thanks Mike,

I had my daughter downloaded the 95 powertool routine and this is her
email
about the results:
Daddy, This is the list in approximate order of what was taking up the
most time and percentages. When my computer started making noise (disk
activity) it
was hard to determine which ones were going because there were about 41
programs running in the box. Here is my list (in order of the most
time):
1. MSGRV32.EXE
2. REGPLAY.EXE
3. STMGR.EXE
4. EXPLORER.EXE
5. REALPLAY.EXE
6. ONETOUCHMON.EXE
7. STIMON.EXE
8. WINTOP.EXE
9. IPMON32.EXE
10. KERNEL32.DLL
11. AVSYNMGR.EXE
12. VSHWIN32.EXE
13. AVCONSOL.EXE
14. SYSTRAY.EXE
15. LOADQM.EXE
16. YBRWICON.EXE
17. 2PORTALMON.EXE
18. YCOMMON.EXE
19. IEXPLORE.EXE
20. HBSRV.EXE

I don't know what most of these are or how to stop them from running. Can
you help?

Thanks,
Phil

"Mike M" wrote:

May I suggest you download yourself a process viewer that will not only
tell you which processes are running at any instant but also their cpu
usage at any instance together with their accumulated usage over time.
Knowing the process involved should then make solving your problem
somewhat simpler. I suspect you may find the mystery process accessing
your hard disk to be either Win Me's state manager (stmgr.exe) or
winmgmt.exe. Alternatively you might find that your daughter has
FastFind
from Microsoft Office enabled and it is indexing her hard disk.

Suitable viewers include the old but still functional WinTop (part of the
equally old Win95 Powertools available from
http://www.microsoft.com/windows95/d...oy/Default.asp)
through TaskInfo 2003, unfortunately no longer free, (www.iarsn.com) to
SysInternals Process Explorer (www.sysinternals.com where you will also
find many other useful tools and utilities).
--
Mike Maltby MS-MVP



Phil wrote:

My daughter has a ME machine and a little over a week ago her computer
started having a lot of disk activity. As she uses the computer the
disk is going a lot of the time. If she just watches the computer
(no activity on her part) the drive starts going like crazy. I had
her run a virus scan and that came up blank. I had her do a disk
clean up and then tried to do a scan disk and it continues to
restart. Something is reading or writing to the drive a lot more
than it should. We did a cntrl-alt-del and did an end-task on
everything except explore and it still happens. Any ideas would be
appreciated.

Phil,

Further to Noel's comments,

What are the instantaneous cpu usage figures when the problem of disk
access occurs? If that list is in order of cumulative cpu usage rather
than instantaneous usage then something might be wrong if msgsrv32.exe
(assuming that msgrv32.exe was a mis-type) is the process that has used
the most cpu cycles since the PC booted and could indicate that you have a
problem with a driver or a pending hardware failure.

IPMON32.EXE This can consume large amounts of resources and unless you
use this monitor could be safely disabled by unchecking the entry that is
launching it (Start | Run, enter MSConfig in the box and click Run), open
the Startup tab and uncheck the entry that is launching ipmon32. OK and
Apply. No need to immediately reboot but when you do you'll see a dialog
box saying you've used the
System Configuration Utility and are in selective startup mode. Just check
the box that says in effect, "don't tell me with this again". (See
http://www.liutilities.com/products/...brary/ipmon32/)

REGPLAY.EXE - Noel has already commented on this.

As for the rest of those items you list they are either part of the
operating system, McAfee, or other applications you have running or
installed.
--
Mike Maltby MS-MVP [2001-2005]



Phil wrote:

Thanks Mike,

I had my daughter downloaded the 95 powertool routine and this is her
email about the results:
Daddy, This is the list in approximate order of what was taking up the
most time and percentages. When my computer started making noise
(disk activity) it
was hard to determine which ones were going because there were about
41 programs running in the box. Here is my list (in order of the most
time):
1. MSGRV32.EXE
2. REGPLAY.EXE
3. STMGR.EXE
4. EXPLORER.EXE
5. REALPLAY.EXE
6. ONETOUCHMON.EXE
7. STIMON.EXE
8. WINTOP.EXE
9. IPMON32.EXE
10. KERNEL32.DLL
11. AVSYNMGR.EXE
12. VSHWIN32.EXE
13. AVCONSOL.EXE
14. SYSTRAY.EXE
15. LOADQM.EXE
16. YBRWICON.EXE
17. 2PORTALMON.EXE
18. YCOMMON.EXE
19. IEXPLORE.EXE
20. HBSRV.EXE

I don't know what most of these are or how to stop them from running.
Can you help?

In article ,
says...
Hi,

My daughter has a ME machine and a little over a week ago her computer
started having a lot of disk activity. As she uses the computer the disk is
going a lot of the time. If she just watches the computer (no activity on
her part) the drive starts going like crazy. I had her run a virus scan and
that came up blank. I had her do a disk clean up and then tried to do a scan
disk and it continues to restart. Something is reading or writing to the
drive a lot more than it should. We did a cntrl-alt-del and did an end-task
on everything except explore and it still happens. Any ideas would be
appreciated.

Thanks,



ScanDefrag will efficiently run either the MS or Norton
disk utilities. The log will list all of the running programs
and you can close the unprotected ones by using
Restrictive Mode. See the ReadMe for a more
detailed explanation.
http://home.earthlink.net/~bblanton2...efrag/main.htm
or http://www.blueorbsoft.com/scandefrag/index.html

Thanks guys,

My daughter is in class now and works today, so I won't be able to check
these things until tonight. She did inform me that she gets the following
errors when she shuts down, which fits in with Mike's response to msgsrv32.
If I had the computer this might go faster....

From my daughter:
Here they are (4 that I received and actually wrote down):
1. Wuauboot has caused an error in unknown. Wuauboot will now
close. If you continue to experience problems, try restarting our
computer.

2. Msgsrv32 has caused an error in KRNL386.EXE. Msgsrv32 will now
close. If you continue to experience problems, try restarting your
computer.

3. Hbsrv has caused an error in KERNEL32.DLL. Hbsrv will now close.
If you continue to experience problems, try restarting your computer.

4. Mmtask has cuased an error in KRNL386.EXE. Mmtask will now close.
If you continue to experience problems, try restarting your computer.

Thanks again,
Phil

"Mike M" wrote:

Phil,

Further to Noel's comments,

What are the instantaneous cpu usage figures when the problem of disk
access occurs? If that list is in order of cumulative cpu usage rather
than instantaneous usage then something might be wrong if msgsrv32.exe
(assuming that msgrv32.exe was a mis-type) is the process that has used
the most cpu cycles since the PC booted and could indicate that you have a
problem with a driver or a pending hardware failure.

IPMON32.EXE This can consume large amounts of resources and unless you
use this monitor could be safely disabled by unchecking the entry that is
launching it (Start | Run, enter MSConfig in the box and click Run), open
the Startup tab and uncheck the entry that is launching ipmon32. OK and
Apply. No need to immediately reboot but when you do you'll see a dialog
box saying you've used the
System Configuration Utility and are in selective startup mode. Just check
the box that says in effect, "don't tell me with this again". (See
http://www.liutilities.com/products/...brary/ipmon32/)

REGPLAY.EXE - Noel has already commented on this.

As for the rest of those items you list they are either part of the
operating system, McAfee, or other applications you have running or
installed.
--
Mike Maltby MS-MVP [2001-2005]



Phil wrote:

Thanks Mike,

I had my daughter downloaded the 95 powertool routine and this is her
email about the results:
Daddy, This is the list in approximate order of what was taking up the
most time and percentages. When my computer started making noise
(disk activity) it
was hard to determine which ones were going because there were about
41 programs running in the box. Here is my list (in order of the most
time):
1. MSGRV32.EXE
2. REGPLAY.EXE
3. STMGR.EXE
4. EXPLORER.EXE
5. REALPLAY.EXE
6. ONETOUCHMON.EXE
7. STIMON.EXE
8. WINTOP.EXE
9. IPMON32.EXE
10. KERNEL32.DLL
11. AVSYNMGR.EXE
12. VSHWIN32.EXE
13. AVCONSOL.EXE
14. SYSTRAY.EXE
15. LOADQM.EXE
16. YBRWICON.EXE
17. 2PORTALMON.EXE
18. YCOMMON.EXE
19. IEXPLORE.EXE
20. HBSRV.EXE

I don't know what most of these are or how to stop them from running.
Can you help?

Phil,

For some reason I overlooked HBSRV.EXE in your earlier post and this
together with your most recent message suggests to me that you have one or
more unwanted parasites running, parasites that are not picked up by
McAfee. What follows is a specific comment about hbsrv.exe followed by
some more general advice. At the end of my post I also make some comments
about the wuauboot.exe message.

HBSRV.EXE
Hbsrv is the Hotbar parasite which is happily sending you unwanted
adverts. I would recommend you uninstall it if possible using 'Add/Remove
Programs' on the Control Panel where it will probably be found as 'HotBar'
or 'Web Tools by Hotbar'.

For more details see http://www.doxdesk.com/parasite/HotBar.html and
http://www.kephyr.com/spywarescanner...ar/index.phtml

Once you cleaned up the mess that Hotbar has created this might be a good
time to download yourself a copy of the free Ad-Aware SE Personal edition
from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also
SpyBot Search & Destroy 1.3 (http://www.safer-networking.org/) and use
them to check your system for other commercial parasites remembering that
they are only as good as when you last updated their reference files. I
also use a program called BHODemon
(http://www.definitivesolutions.com/bhodemon.htm) that checks for unwanted
Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help
prevent some parasites getting a grip on your PC.

Then there is CWShredder
(http://www.spywareinfo.com/~merijn/files/cwshredder.zip) which is the
best way of getting rid of the many forms of the CoolWebSearch hijacker
details of which can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp..

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html).
Create a folder called HJT on C: (not on your desktop nor in your temp
folder) and copy the file you downloaded to that folder. Close as many
applications as you can including all instances of Internet Explorer.
Enable Explorer to see all files and folders (Tools | Folder Options |
View and check "Show hidden files and folders" and uncheck "Hide protected
operating system files") and then run hijackthis.exe and post back the log
to either the HijackThis Forum at http://forums.spywareinfo.com/ or
alternatively http://forum.aumha.org/viewforum.php?f=30 and hopefully this
will enable someone to identify the cause of your problem.

See also: Dealing with Unwanted Malware, Parasites, Toolbars and Search
Engines http://mvps.org/winhelp2002/unwanted.htm and also Browser
Hijacking http://www.spywareinfo.com/articles/hijacked/

WUAUBOOT
wuauboot.exe together with wuaupd98.dll, auhook.dll, wuaures.dll and
wuauclt.exe as well as the control panel applet wuaucpl.cpl form Win Me's
Automatic Update feature.

The purpose of wuauboot.exe is to check for possible updates for your
system after it has successfully booted up and only if it is able to find
an opened connection to the Internet. If it does not find a connection to
the Internet, it terminates. wuauclt.exe does a similar job but whilst
the system is running and is triggered by an internal timer.

Not knowing what is causing your precise problem a first suggestion would
be to try resetting Automatic Updating. Do this by opening the Automatic
Updates applet in the Control Panel, select "Turn off automatic updating",
and OK out. Now go to your Program Files\Windows Update folder and delete
the file AUState.cfg. Reboot and then go back to the Control Panel and
reopen the Automatic Updates applet and configure AU to meet your
requirements.
--
Mike Maltby MS-MVP



Phil wrote:

Thanks guys,

My daughter is in class now and works today, so I won't be able to
check these things until tonight. She did inform me that she gets
the following errors when she shuts down, which fits in with Mike's
response to msgsrv32. If I had the computer this might go faster....

From my daughter:
Here they are (4 that I received and actually wrote down):
1. Wuauboot has caused an error in unknown. Wuauboot will now
close. If you continue to experience problems, try restarting our
computer.

2. Msgsrv32 has caused an error in KRNL386.EXE. Msgsrv32 will now
close. If you continue to experience problems, try restarting your
computer.

3. Hbsrv has caused an error in KERNEL32.DLL. Hbsrv will now close.
If you continue to experience problems, try restarting your computer.

4. Mmtask has cuased an error in KRNL386.EXE. Mmtask will now close.
If you continue to experience problems, try restarting your computer.

Hi Mike,

With a lot of phone calls to my daughter and various testing, we pinned most
of the disk activity to a program called "bakjava.exe". Do you know what
this is? I had her find and rename the file to bakjavahold.exe, reboot and
most of the acitivity went away. She then end-tasked everything and using
wintop she would get a little activity from "dosfont.exe" which is within the
system folder. Do you know what this file is?
Most of yesterday and today I was unable to get into the newsgroups. In
fact since the format has changed I've had many problems. I hope it
improves....

Thanks for your help.
Phil


"Mike M" wrote:

Phil,

For some reason I overlooked HBSRV.EXE in your earlier post and this
together with your most recent message suggests to me that you have one or
more unwanted parasites running, parasites that are not picked up by
McAfee. What follows is a specific comment about hbsrv.exe followed by
some more general advice. At the end of my post I also make some comments
about the wuauboot.exe message.

HBSRV.EXE
Hbsrv is the Hotbar parasite which is happily sending you unwanted
adverts. I would recommend you uninstall it if possible using 'Add/Remove
Programs' on the Control Panel where it will probably be found as 'HotBar'
or 'Web Tools by Hotbar'.

For more details see http://www.doxdesk.com/parasite/HotBar.html and
http://www.kephyr.com/spywarescanner...ar/index.phtml

Once you cleaned up the mess that Hotbar has created this might be a good
time to download yourself a copy of the free Ad-Aware SE Personal edition
from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also
SpyBot Search & Destroy 1.3 (http://www.safer-networking.org/) and use
them to check your system for other commercial parasites remembering that
they are only as good as when you last updated their reference files. I
also use a program called BHODemon
(http://www.definitivesolutions.com/bhodemon.htm) that checks for unwanted
Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help
prevent some parasites getting a grip on your PC.

Then there is CWShredder
(http://www.spywareinfo.com/~merijn/files/cwshredder.zip) which is the
best way of getting rid of the many forms of the CoolWebSearch hijacker
details of which can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp..

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html).
Create a folder called HJT on C: (not on your desktop nor in your temp
folder) and copy the file you downloaded to that folder. Close as many
applications as you can including all instances of Internet Explorer.
Enable Explorer to see all files and folders (Tools | Folder Options |
View and check "Show hidden files and folders" and uncheck "Hide protected
operating system files") and then run hijackthis.exe and post back the log
to either the HijackThis Forum at http://forums.spywareinfo.com/ or
alternatively http://forum.aumha.org/viewforum.php?f=30 and hopefully this
will enable someone to identify the cause of your problem.

See also: Dealing with Unwanted Malware, Parasites, Toolbars and Search
Engines http://mvps.org/winhelp2002/unwanted.htm and also Browser
Hijacking http://www.spywareinfo.com/articles/hijacked/

WUAUBOOT
wuauboot.exe together with wuaupd98.dll, auhook.dll, wuaures.dll and
wuauclt.exe as well as the control panel applet wuaucpl.cpl form Win Me's
Automatic Update feature.

The purpose of wuauboot.exe is to check for possible updates for your
system after it has successfully booted up and only if it is able to find
an opened connection to the Internet. If it does not find a connection to
the Internet, it terminates. wuauclt.exe does a similar job but whilst
the system is running and is triggered by an internal timer.

Not knowing what is causing your precise problem a first suggestion would
be to try resetting Automatic Updating. Do this by opening the Automatic
Updates applet in the Control Panel, select "Turn off automatic updating",
and OK out. Now go to your Program Files\Windows Update folder and delete
the file AUState.cfg. Reboot and then go back to the Control Panel and
reopen the Automatic Updates applet and configure AU to meet your
requirements.
--
Mike Maltby MS-MVP



Phil wrote:

Thanks guys,

My daughter is in class now and works today, so I won't be able to
check these things until tonight. She did inform me that she gets
the following errors when she shuts down, which fits in with Mike's
response to msgsrv32. If I had the computer this might go faster....

From my daughter:
Here they are (4 that I received and actually wrote down):
1. Wuauboot has caused an error in unknown. Wuauboot will now
close. If you continue to experience problems, try restarting our
computer.

2. Msgsrv32 has caused an error in KRNL386.EXE. Msgsrv32 will now
close. If you continue to experience problems, try restarting your
computer.

3. Hbsrv has caused an error in KERNEL32.DLL. Hbsrv will now close.
If you continue to experience problems, try restarting your computer.

4. Mmtask has cuased an error in KRNL386.EXE. Mmtask will now close.
If you continue to experience problems, try restarting your computer.

Phil,

I'm not familiar with either bakjava.exe or dosfont.exe, or at least not
in recent years since I seem to recall a program called dosfont.exe from
10 or even 15 years ago. Unless your daughter knows she needs these
applications I would, as you have already done with bakjava.exe rename
them and then perhaps get her to carry out a fresh scan for malware
including unwanted parasites. Does locating these two files in Explorer,
selecting, right clicking, choosing Properties and looking at their
Version tab give a clue as to their origins?


You are not alone in having problems accessing these newsgroups. The
number of posts in the last two weeks has dropped by more than 60% with
the majority of those still posting here being posters like me who use a
news client or program rather than the Microsoft web interface. In my
case I use Outlook Express, others use news applications such as Forte
Agent, Xnews, Gravity and Turnpike or Outlook although in this last case
Outlook front ends Outlook Express.

What exact problems are you having with the new interface and which are
you using? Could you please post a URL so that I can have a look at what
you are now seeing?

Cheers,
--
Mike Maltby MS-MVP [2001-2004]



Phil wrote:

Hi Mike,

With a lot of phone calls to my daughter and various testing, we
pinned most of the disk activity to a program called "bakjava.exe".
Do you know what this is? I had her find and rename the file to
bakjavahold.exe, reboot and most of the acitivity went away. She
then end-tasked everything and using wintop she would get a little
activity from "dosfont.exe" which is within the system folder. Do
you know what this file is?
Most of yesterday and today I was unable to get into the newsgroups.
In fact since the format has changed I've had many problems. I hope
it improves....