Hard drive constantly read/writing

Okay Richard, been a long day for me too.

Park your machine like you like, get back to it when you can and see how it likes being clean.

I remember a time when my Dad (bless his soul), couldn't understand where I was coming from, but he left me room to grow. Parents have a way of knowing....

Your welcome, take your time. It sounds like you might be able to D/L Process Monitor now and let it run to see if it can find anything.

Oh, by the way I'm including a file tellin' about how to do that Multiple Quotes thing, hope it makes sense. I have Libre Office, but you should still be able to open it...

I scanned it for malware before I shipped, and zipped it with 7's zipper so all you should have to do is right click on it and "Extract All", but I wouldn't blame you if you checked it for malware first, there's an old sayin'....
"I know your my brother, but I'm still goin' to check".

It depends if you need to be online or not. When do you notice the increased HDD activity?

A snip would be counter-productive, instead:
If online run Process Monitor (PM) while online and save the report/file as .csv
If idling run PM while offline and nothing else open, save file as .csv
In either case .zip the .csv file before uploading.


Have all activity buttons pressed as in area 1
Then save at area 2

   Information

When Save dialog opens:
Leave Events to Save: as is.
Under Format: click on the Comma separated values (csv) radio button.
Select destination (Desktop?)
Click OK.

To zip a File or Folder:
Right click on file.
Go to "Send To" then select Compressed (zipped) folder.
.zip folder is usually created near original file/folder.

Be advised, the .csv file will be approximately 20 to 30MB, zipped 1.5MB
Mine was 24.3, and 1.4 respectively

To compare your 2M; I'm running online creating this post with FireFox (FF) open to three tabs and I'm at 1.4M.

It only completes when you stop it.

55MB is too large, if you go to the area where you upload attachments it shows you the size limitations, and for .zip it is 8.3MB.

Just let it run at idle for a half hour, stop, see what the file size is, and if its under the limit .zip an ship.

EDIT:
I'm not sure if we discussed this before, but I would like to see a snip of your Startup Programs.

Follow this tutorial: Startup Programs - Change
Use Method Three or Method Five if you have CCleaner then take your snip.

It will allow us to see if there are any programs that do not need to run at startup.
Reference: Black Viper’s Windows 7 Service Pack 1 Service Configurations | Black Viper | www.blackviper.com

The startup snip was okay Richard, but I kept finding references to potentially masked rootkit files in process monitor.

In order to cut your losses trying to figure this out, and even if we did, that Asus wouldn't be right for all that had to be removed from it, I would suggest doing the System Recovery.

The only thing I would save from it would be any personal data you have created on it.
If you have programs that need product keys, use Belarc and or Speecy to retrieve them.


Quote from my earlier post:

Your situation is similar to what I had to go through with my niece's laptop only hers was worse. If we can't get yours to calm down we may have to do a System Recovery for your Asus.

This is The Support Page for the CM1630

This is The Download Page for the CM1630

How to do a System Recovery for Asus CM1630:

• Use the Download link to retrieve the manual.
• You will have to select the OS you have (32bit or 64bit) to proceed.
• Go to the bottom and click on Manual.
• Scroll down to the next to last entry for CM1630 user's manual(English) click on the Global link, and save .zip file to convenient location (Desktop?), I scanned my copy for malware, MBAM didn't find any. I did not use the Global (DLM) because Asus wanted me to also D/L a manager that I did not want, and you take a risk with D/L'ing malware with P2P.
• Extract File.
• Open PDF and go to Chapter 6: Recovering Your System.

rcan1015 said:

Anak,
I downloaded the CM1630 manual and read Chapter 6. Could you explain a little bit about what happens with System Recovery? Will I have to re-install all my software again? Microsoft Office, games, A/V, etc? I'm trying to determine how much effort it's going to require after the Recovery so I can decide the best time to schedule it.

Yes.


I don't know who purchased or used the machine first, but it sounds like your son did in post #19:

rcan1015 said:

I just got this ASUS system a couple months ago from my son (when he decided to go for a Mac)

So you wouldn't be able to recall what it was like when your son first fired it up.
The Recovery Partition contains all the original software that Asus installed including the Operating System (OS).

If you go to: https://www.asus.com/Desktops/Essent...specifications and scroll to the bottom you will see Software, and Utilities that are included in the recovery.
Some of this software is bloatware and you really don't need it if you already use something different.
Some of the utilities may not be needed.

What you will need to do is save any personal data you have created on it, and any programs you installed that need product keys, use Belarc and or Speecy to retrieve them.
If you have disks for the programs that's good.
If you downloaded (D/L) any, I hope you saved them in a special D/L folder, copy them also, but scan them for malware before you reinstall especially if you got anything from your son, you wouldn't want to reload anything bad. You would have to reload Malwarebytes again to do that.

What a System Recovery will do is first clean the HDD by formatting the HDD which means erasing everything on the HDD.

Then it will rebuild your HDD to its original condition, including the recovery drive.

It should look like the sample picture on page 6-16 in the manual.

Time varies, but should take less than 45minutes from start to finish.

EDIT:
That 45minutes is just for the recovery, figure maybe 15 to 30minutes extra for any additional programs.

rcan1015 said:

Anak,
Is there any security or privacy issues in having that Process Monitor logfile posted? Should access to it be disabled since you have reviewed it?
Thanks,
Richard

There are some SIDs, and registry IDs, but these are usually unique to each machine, the only way to disable the log is to remove it.

To give you peace of mind go back to post #36 and click on edit, then the Go Advanced button, you will be taken to the reply editor.

Scroll down to where you attach files, you will see a Manage Attachments button, click on that.
When the next box opens you will see your file Logfile.zip with a remove button to the right, click on that give it a few seconds and it should be gone.

If you go back to your post you will see [ATTACH]******[/ATTACH], if you want to clean up your post cut everything from the far left to far right bracket otherwise it will show in the saved post.


Please post back any further questions you may have before starting, and any after you've done the recovery i.e. removing bloatware, adding antivirus/malware products, anything.


Steve