Which program is causing abnormal disc activity?

[John Latter]

I don't know much about computers but I seem to be having a lot of
disc activity since changing my hard drive and reinstalling windows
xp.

I've been to windows task manager & have enabled I/O Read Bytes & I/O
Write bytes.

When I'm doing nothing the following 3 programs are constantly
changing. I've been online for about 3 hours now & these are the
approximate figures:

ashserve.exe (Avast antivirus):

read: 4,700,000,000 write: 3,700,000

svhost.exe:

read: 705,000,000 write: 718,000,000

lsass.exe:

read: 1,010,000 write: 540,000

Today is the 1st time my firewall reporeted that lsass requested
internet access though this disc activity has been noticable since
doing the reinstall.

Any help or advice would be appreciated!

 

[Kerry Brown]

I don't know much about computers but I seem to be having a lot of
disc activity since changing my hard drive and reinstalling windows
xp.

I've been to windows task manager & have enabled I/O Read Bytes & I/O
Write bytes.

When I'm doing nothing the following 3 programs are constantly
changing. I've been online for about 3 hours now & these are the
approximate figures:

ashserve.exe (Avast antivirus):

read: 4,700,000,000 write: 3,700,000

svhost.exe:

read: 705,000,000 write: 718,000,000

lsass.exe:

read: 1,010,000 write: 540,000

Today is the 1st time my firewall reporeted that lsass requested
internet access though this disc activity has been noticable since
doing the reinstall.

Any help or advice would be appreciated!

Do you have SP2 or a firewall installed?

Kerry

 

[Kerry Brown]

Do you have SP2 or a firewall installed?

Kerry

Sorry that should have been: What firewall are you using? Was it installed
before you connected to the Internet after reinstalling Windows?

Kerry

 

[John Latter]

Process File: lsass or lsass.exe
Process Name: Local Security Authority Service
Description:
lsass.exe is a system process of the Microsoft Windows security
mechanisms. It specifically deals with local security and login
policies. Note: lsass.exe also relates to the Windang.worm,
irc.ratsou.b, Webus.B, MyDoom.L, Randex.AR, Nimos.worm which spread via
floppy disk drives, mass-mailing and peer-to-peer sharing. Please review
file path for clarification of this.
Make sure your anti-virus is up to date & scan or go to 'Trend Micro
HouseCall' (http://www.trendmicro.com/en/home/us/personal.htm) and do
an online scan.
Others may add to this.
Gotta go,
Treeman

Thanks Treeman, I've sorted out Isass.exe by diabling terminal
services. Now its only svchost.exe continuously accessing the disc -
and triggering ashserve.exe in the process (I believe!)

 

[John Latter]

Sorry that should have been: What firewall are you using? Was it installed
before you connected to the Internet after reinstalling Windows?

Kerry

Hi Kerry,

I'm using a McAfee FW & I installed XP Home, SP2 and then MacAfee
before I connected

 

[Kerry Brown]

Hi Kerry,

I'm using a McAfee FW & I installed XP Home, SP2 and then MacAfee
before I connected

Do you have McAfee antivirus and AVAST installed? You don't need two AV
programs running at the same time. AVAST is probably generating the Virus
Recovery Database (VRDB). This could be the cause of the disk activity. If
this is the cause it will go away once the database is generated.

Kerry

 

[John Latter]

Do you have McAfee antivirus and AVAST installed? You don't need two AV
programs running at the same time. AVAST is probably generating the Virus
Recovery Database (VRDB). This could be the cause of the disk activity. If
this is the cause it will go away once the database is generated.

Kerry

Hi Kerry,

My McAfee is a firewall only & Avast is set to generate the VRDB when
the screen saver is showing.