Extended disk Activity at Boot.

[Sid Knee]

On one of my Win2K installations, I get a lot of disk activity after the
desktop/icons appears. This goes on for 3 or 4 minutes - way longer than
any of my other Win2K installations.

If I check task manager at this time, there are no applications running,
the cpu is at 30-40% usage and the activity seems to be shared between
"System Idle Process" and "winlogon.exe"

I'm aware that fake winlogon.exe files have been used as trojans but the
machine scans fine with an AV and also with two anti-spyware scanners. I
recently had windows update which included the ms malware scanner which
I presume was run at that time (I'd run it again if I knew how - why do
they bury it). In addition I've compared the location, size and date of
winlogon.exe with the corresponding versions on my other machines and
they all match.

I also did a boot with all startup items turned off but this made no
apparent difference.

Any suggestions?

 

[Dave Patrick]

How much RAM? If you've less than 512k (or so) then that's likely the cause
of excessive thrashing (paging)

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

 

[Sid Knee]

How much RAM? If you've less than 512k (or so) then that's likely the
cause of excessive thrashing (paging)

I imagine 512k would be quite a problem (big grin). Actually it has 768 Meg.

 

[Sid Knee]

On one of my Win2K installations, I get a lot of disk activity after the
desktop/icons appears. This goes on for 3 or 4 minutes - way longer than
any of my other Win2K installations.

If I check task manager at this time, there are no applications running,
the cpu is at 30-40% usage and the activity seems to be shared between
"System Idle Process" and "winlogon.exe"

I'm aware that fake winlogon.exe files have been used as trojans but the
machine scans fine with an AV and also with two anti-spyware scanners. I
recently had windows update which included the ms malware scanner which
I presume was run at that time (I'd run it again if I knew how - why do
they bury it). In addition I've compared the location, size and date of
winlogon.exe with the corresponding versions on my other machines and
they all match.

I also did a boot with all startup items turned off but this made no
apparent difference.

Any suggestions?

I posted this some time ago without any resolution. I have some other
information that may be relevant:

- the machine has 768MB of memory; the partition is 14G with 6G free

- indexing service is turned off for all drives

- bootup is normal and at normal speed other than the disk thrashing and
after the thrashing (about 5 min) stops it runs normally.

- Shutdown is normal

- I did a Ghost backup of that partition and it took an awful long time
first checking the NTFS Volume and then writing the MFT and MFT log.
Once it was through that, the backup proceeded normally.

- A Chkdsk /F /X (run from a Bart's Boot) again took a long time (~ 30
min) ... however it reported no errors. (Disk manager also reports the
drive healthy)

- The system contains multiple Win2K OS's (one on the same drive as the
problem partition, the other on the second drive). Both these other OS's
function normally without disk thrashing. The problem partition is the
boot partition for all three.