Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I installed Windows 7 about five days ago, and I realized that the system is constantly using my HDD.

I turned off file indexing, and every other services, without any effect.

Now I downloaded SysInternals Process Monitor, and it displayed this section repeadted more than ten times in a second:

15:24:06,5987317    ekrn.exe    1492    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
15:24:06,5987627    ekrn.exe    1492    RegOpenKey  HKLM\Software\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles   SUCCESS Desired Access: Read
15:24:06,5987969    ekrn.exe    1492    RegSetInfoKey   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles   SUCCESS KeySetInformationClass: KeySetHandleTagsInformation, Length: 0
15:24:06,5988231    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\Enable    NAME NOT FOUND  Length: 144
15:24:06,5988549    ekrn.exe    1492    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
15:24:06,5988778    ekrn.exe    1492    RegOpenKey  HKLM\Software\ESET\ESET Security\CurrentVersion\Plugins\01000101\Default    NAME NOT FOUND  Desired Access: Read
15:24:06,5989098    ekrn.exe    1492    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
15:24:06,5989317    ekrn.exe    1492    RegOpenKey  HKLM\Software\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile   SUCCESS Desired Access: Read
15:24:06,5989573    ekrn.exe    1492    RegSetInfoKey   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile   SUCCESS KeySetInformationClass: KeySetHandleTagsInformation, Length: 0
15:24:06,5989768    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskFloppy    NAME NOT FOUND  Length: 144
15:24:06,5989979    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskLocal NAME NOT FOUND  Length: 144
15:24:06,5990170    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskNetwork   NAME NOT FOUND  Length: 144
15:24:06,5990362    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanOpen  NAME NOT FOUND  Length: 144
15:24:06,5990549    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanExecute   NAME NOT FOUND  Length: 144
15:24:06,5990737    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanCreate    NAME NOT FOUND  Length: 144
15:24:06,5990932    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanNetworkOnClose    NAME NOT FOUND  Length: 144
15:24:06,5991119    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanOnAccess  NAME NOT FOUND  Length: 144
15:24:06,5991311    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanShutdown  NAME NOT FOUND  Length: 144
15:24:06,5991498    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OptimizeScan  NAME NOT FOUND  Length: 144
15:24:06,5991686    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\Autostart SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5991874    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\Autostart SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5992075    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OnOpen_RuntimeArchives    NAME NOT FOUND  Length: 144
15:24:06,5992270    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OnOpen_AutoExecArchives   NAME NOT FOUND  Length: 144
15:24:06,5992461    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OnOpen_AdvanceHeuristic   NAME NOT FOUND  Length: 144
15:24:06,5992649    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanExecuteAH SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5992836    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanExecuteAH SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5993034    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskFloppyOnExecuteAH NAME NOT FOUND  Length: 144
15:24:06,5993222    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\BlockRemovableDevices NAME NOT FOUND  Length: 144
15:24:06,5993413    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DefaultArchSettings   NAME NOT FOUND  Length: 144
15:24:06,5993605    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ArchiveDepth  NAME NOT FOUND  Length: 144
15:24:06,5993796    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ArchiveMaxFilesize    NAME NOT FOUND  Length: 144
15:24:06,5993994    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AllowedDevices    NAME NOT FOUND  Length: 144
15:24:06,5994202    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\USBDevicesLikeDisk    NAME NOT FOUND  Length: 144
15:24:06,5994403    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AdvancedBlockRemovableDevices NAME NOT FOUND  Length: 144
15:24:06,5994598    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AskForScanOfRemovableDevice   NAME NOT FOUND  Length: 144
15:24:06,5994793    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AskForScanOfRemovableDeviceDefaultAction  SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5994984    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AskForScanOfRemovableDeviceDefaultAction  SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5995212    ekrn.exe    1492    RegCloseKey HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile   SUCCESS 
15:24:06,5995421    ekrn.exe    1492    RegCloseKey HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles   SUCCESS 
15:24:06,6789163    GSvr.exe    1576    CreateFile  C:\service.log  SUCCESS Desired Access: Generic Read/Write, Disposition: OpenIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Opened
15:24:06,6790420    GSvr.exe    1576    CreateFile  C:\service.log  SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
15:24:06,6790997    GSvr.exe    1576    QueryFileInternalInformationFile    C:\service.log  SUCCESS IndexNumber: 0x2000000000095
15:24:06,6791369    GSvr.exe    1576    QueryBasicInformationFile   C:\service.log  SUCCESS CreationTime: 2011.11.09. 0:04:45, LastAccessTime: 2011.11.18. 14:45:17, LastWriteTime: 2011.11.18. 15:24:06, ChangeTime: 2011.11.18. 15:24:06, FileAttributes: A
15:24:06,6795206    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6795424    GSvr.exe    1576    CloseFile   C:\service.log  SUCCESS 
15:24:06,6796588    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6796824    GSvr.exe    1576    ReadFile    C:\service.log  SUCCESS Offset: 19 546, Length: 1, Priority: Normal
15:24:06,6797162    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6797353    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6797732    GSvr.exe    1576    WriteFile   C:\service.log  SUCCESS Offset: 19 547, Length: 1, Priority: Normal
15:24:06,6798292    GSvr.exe    1576    CloseFile   C:\service.log  SUCCESS 

So the ekrn.exe (ESET Smart Security) is not so smart, it's trying to do something in the registry, but it can't, and logs the problem in the service.log, and tries again constantly...

Any idea how to fix it?

share|improve this question
    
What edition/version of ESS? –  techie007 Nov 18 '11 at 22:05
    
ESET Smart Security 5.0.94.0 Windows 7 Ultimate 64bit 6.1.7601 SP1 –  inf3rno Nov 19 '11 at 17:09
add comment

1 Answer

up vote 0 down vote accepted

Sounds like ESet is having compatibility issues with Windows 7. Perhaps either you are using an older version that is not compatible with Windows 7 or else something is not right with the installation. I would first make sure you are using the latest version of ESet. If you are, try to uninstall and reinstall ESet.

share|improve this answer
    
Hmm that's the latest version of the smart security, installed it a few days ago... Okey, I will reinstall... I sent a message to ESET, maybe they can answer what's the problem :S –  inf3rno Nov 18 '11 at 15:02
    
The GSvr.exe was the problem by the constantly writing. I uninstalled gigabyte energy saver, and now it's a little bit better. I think the antivirus really has compatibility problems, I talked with sycontact support, they will check it next week... –  inf3rno Nov 18 '11 at 20:21
    
I was going to say, GSrv is NOT part of ESET's software. I use NOD32 with MANY Windows 7 machines (we have ~325 NOD32 licenses), it's fully compatible, you may just want to spend the time to tweak the settings. :) –  techie007 Nov 18 '11 at 22:04
    
Yepp, gsrv is not the part of nod32. The hdd writing problem was solved by uninstalling gsrv... It seems like the antivir has compatibility problems (as BBlake said), otherwise it wouldn't send requests to the registry ~1000 times / min. –  inf3rno Nov 19 '11 at 17:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.