By scanning I mean that it read (write?) on the disk for about 5 to 10
minutes. I can hear the disk.
I also have run File Monitor by SysInternals (
www.sysinternals.com) and it
shows that for every directory on my C: drive it does:
283477 07:15:49 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
Settings\ame\ SUCCESS
283478 07:15:49 mshta.exe:1548 IRP_MJ_CREATE C:\Program Files\ SUCCESS
Options: Open Directory Access: All
283479 07:15:49 mshta.exe:1548 IRP_MJ_DIRECTORY_CONTROL C:\Program Files\
SUCCESS FileBothDirectoryInformation: Common Files
283480 07:15:49 mshta.exe:1548 IRP_MJ_CLEANUP C:\Program Files\ SUCCESS
283481 07:15:49 mshta.exe:1548 IRP_MJ_CLOSE C:\Program Files\ SUCCESS
(the above will probably wrap. Each line should start with a 6 digit
number)
I also does this for a number (more than 100) exe and dll:
51 07:12:09 mshta.exe:1548 FSCTL_IS_VOLUME_MOUNTED C:\Documents and
Settings\ame\ SUCCESS
52 07:12:09 mshta.exe:1548 FASTIO_QUERY_OPEN C:\Norman\Nvc\BIN\Niphk.dll
FAILURE
53 07:12:09 mshta.exe:1548 IRP_MJ_CREATE C:\Norman\Nvc\BIN\Niphk.dll
SUCCESS Options: Open Access: All
54 07:12:09 mshta.exe:1548 FASTIO_QUERY_STANDARD_INFO
C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Length: 233472
55 07:12:09 mshta.exe:1548 FASTIO_QUERY_BASIC_INFO
C:\Norman\Nvc\BIN\Niphk.dll SUCCESS Attributes: A
56 07:12:09 mshta.exe:1548 IRP_MJ_CLEANUP C:\Norman\Nvc\BIN\Niphk.dll
SUCCESS
57 07:12:09 mshta.exe:1548 IRP_MJ_CLOSE C:\Norman\Nvc\BIN\Niphk.dll
SUCCESS
(the above will probably wrap. Each line should start with a 2 digit
number)
It's really strange!
I have tested on a Windows XP computer and there MSHTA.EXE will start and
the disk will be 'scanned' just for a while (less than 30 seconds) and the
scanning will stop as soon as all program are shown in the Add/Remove
Programs window.