[Solved] Constant Hard Drive Activity Issues

system · 2017-03-05T13:35:39.000Z

First off, I can’t log onto this forum in Firefox - Chrome works fine, but in Firefox, I hit either login link and nothing happens.

My main problem is similar to this: https://forum.avast.com/index.php?topic=88299.0 - but that was from 2011. This might not be Avast Related, but …

I am running WinXP SP3.

I’ve been a long-time Avast (Free) user, but typically have it set to update the virus definitions automatically, but only update the program file manually. I also rarely connect to the internet and usually the PC is offline.

I updated the program on February 10, 2017 and had no issues.

Friday, I connected to the Internet and Avast had a pop-up in the systray saying the virus definitions needed to be updated. Usually it does that automatically in the background. Anyway, I let it update and it said it needed to reboot (also unusual), and I didn’t quit immediately, but I did reboot since then.

Since this happened, SOMETHING has been accessing the hard-drive almost constantly when the PC is on (access light flashing and drive activity noise).

Also - if I wake the computer from hibernation and at various random times, I will see a notification balloon over the Avast Systray icon saying “??? - Runnning 8%, click here for details” - or 13%, …

If I click on the “Details” button, the Avast interface opens with a black screen and a spinning circle that says loading, but nothing ever happens. However, if I close the interface and then right-click on the systray, and click Open Avast User Interface, everything seems fine.

I did a scan with Malware Bytes and a Smart Scan with Avast and everything was fine. I also tried silent mode and shields off (offline) and the drive access continued, so I’m not sure it is an Avast issue. I also updated the virus definitions for Avast, which worked fine, but didn’t solve the problem.

I haven’t tried process explorer, but I used Task Manager and saw a few interesting things - wuauclt.exe was running, which is the Windows Update Service, but since XP is EOL, that should have been disabled. I haven’t tried disabling it yet. And WPFFontCache_v0400.exe was running, I haven’t tried disabling that yet.

I’m confused what the issue is, since it happened right after a virus definitions update but not after the program update.

I also have a question on the updates settings. I previously had “Streaming Updates” enabled and “I only connect using a dial-up modem” disabled, and everything worked fine, but I was wondering if Avast was checking for updates when the computer was offline and that could be causing the issues, but changing the settings (turning off streaming updates and setting to I only connect using dial-up and 30 minutes) didn’t seem to matter. We use DSL. What is the best settings for these for how I use the computer?

Thanks in advance!!!

Eddy · 2017-03-05T13:43:18.000Z

For the webboard login, check the cookie settings in FireFox.
Cookies from the webboard/avast ID need to be accepted.

The 10 february update is not the latest > https://forum.avast.com/index.php?topic=197955.0

WPFFontCache_v0400.exe
That is part of the .net 4 framework.
You can try this to see if it makes a difference :

Stop the WPF Font Cache 4.0 service.
Delete all of the WPFFontCache_v0400* files. Likely they are in: C:\Documents and Settings\LocalService\Local Settings\Application Data\ folder.
Start the service again.

wuauclt.exe
Disable the service and see if it makes a difference.

As you are on DSL, chosing for one of the dial-up settings is wrong.
There is a permanent connection with DSL (consider it as being on a network)

TheOwner · 2017-03-05T13:49:31.000Z

Hello,
open performance monitor and look what process accessing HDD and which file reads. If is Avast related you can add exception.
If you are offiline and don’t using removable media, there is no need runing antivirus.

bob3160 · 2017-03-05T13:54:28.000Z

TheOwner post:3:

Hello,
open performance monitor and look what process accessing HDD and which file reads. If is Avast related you can add exception.
If you are offiline and don’t using removable media, there is no need runing antivirus.

Sorry but that’s bad advice.
Telling people to turnoff their protection is never good advice.

system · 2017-03-05T14:26:15.000Z

Grrrr - Forum lost a long reply, and since I can’t use Firefox and there is no Lazarus add-on for Chrome, I’m retyping …

Eddy post:2:

For the webboard login, check the cookie settings in FireFox.
Cookies from the webboard/avast ID need to be accepted.

I’m not blocking any specific cookies, if I click Login, it takes me to the top of the forum. In Chrome, a pop-over comes up and I can log-in. I already had an exception to allow pop-ups from https://forum.avast.com, so that wasn’t it.

The 10 february update is not the latest > https://forum.avast.com/index.php?topic=197955.0

I’ll update to the Feb 28th version - might fix the interface issues, but oddly the 10 Feb update worked mostly okay - it was the 3 Mar definitions update that caused the problems.

I figured out what WPFFont and wuauclt do. Haven’t tried the fixes yet - but seems odd that they were started after a definitions update - if that’s what happened.

As you are on DSL, chosing for one of the dial-up settings is wrong. There is a permanent connection with DSL (consider it as being on a network)

You misunderstood me. There is a permanent connection from the router to the internet. The client PC (with Avast) is not always connected to the router. (Think of unplugging the Ethernet cable at the PC). How should I set the update settings in this situation.

open performance monitor and look what process accessing HDD and which file reads.

I was using Task Manager which shows CPU and memory usage and forgot about performance monitor, but I don’t see that it shows HDD activity. Are you sure you don’t mean Process Explorer by SysInternals as recommended in the thread I originally linked?

Eddy · 2017-03-05T14:51:10.000Z

Set it to “always connected”.

DavidR · 2017-03-05T15:23:48.000Z

Tiger-Heli post:5:

Grrrr - Forum lost a long reply, and since I can’t use Firefox and there is no Lazarus add-on for Chrome, I’m retyping …

Whilst this won’t resolve your current issue of the forum software eating a post. Try previewing the post before you actually post, that appears to reduce the instance of the post being eaten.

You can also try the back button in your browser, some will still have retained the post data and not just refreshed the page.

As you can see from my signature I use the latest firefox version (my default browser), winXP Pro SP3 and the latest avast free version 17.2.2288 and I have no problem using firefox.

I thought Lazarus was dead (excuse the pun) for firefox (last updated 10 August 2011), I had to give it up at one point as it was blocked by firefox checks. Unless you are using an old firefox ?

I have been using the Form History Control firefox add-on, try using firefox and log-on to your my.avast.com account. If it allows that then you should be able to go directly to the avast forum without having to log-on again.

system · 2017-03-05T15:42:20.000Z

Set it to "always connected".

Will do. Thanks!!!

Whilst this won't resolve your current issue of the forum software eating a post. Try previewing the post before you actually post, that appears to reduce the instance of the post being eaten.
You can also try the back button in your browser, some will still have retained the post data and not just refreshed the page.

Now that I know it is problematic and remember I’m not in Firefox, I can just copy the post to Notepad before I hit reply.

I thought Lazarus was dead (excuse the pun) for firefox (last updated 10 August 2011), I had to give it up at one point as it was blocked by firefox checks. Unless you are using an old firefox ?

Not that old - using FF 45.7.0 with some corporate tweaks. I might have had to change some about:config settings to allow unsigned add-ons - anyway, it still works for me.

I have been using the Form History Control firefox add-on,

I didn’t know about that, may be useful if Lazarus ever officially is killed in Firefox :

try using firefox and log-on to your my.avast.com account. If it allows that then you should be able to go directly to the avast forum without having to log-on again.

Interesting - I didn’t know I had a my.avast.com account, I registered on this forum years ago, but if Firefox, if I go to my.avast.com, I get “The page isn’t redirecting properly. Firefox has detected that the server is redirecting the request for this address in a way that will never complete. This problem can sometimes be caused by disabling or refusing to accept cookies.”

So it might be something that our IT dept did for Firefox and not for Chrome or didn’t do for FF and did do for Chrome …

system · 2017-03-06T12:25:18.000Z

It is fixed now, but it was an unusual fix …

And there is one thing that bothers me a bit still, but anyway …

I started the computer and looked at Process Explorer, and it was AvastSvc.exe that was hitting the hard drive for an average or 6-7 MB on read. AvastSvc.exe was not using much CPU or memory, so it didn’t seem like a likely culprit from Task Manager.

I updated Avast and the virus definitions and there was no change.

I then turned on silent mode and turned off all shields and there was still no change (which if I hadn’t checked with Process Explorer would have made me think it was not Avast-related).

Then I went into services.msc and stopped the Avast Antivirus service and the HDD went silent.

Then I restarted the service and everything was still fine.

Turned off silent mode and no issues since. (I also set the updates mode back to streaming and turned off the dial-up option.)

I then looked in services.msc and turned off automatic updates and set it to disabled - it was set to automatic.

Now, the weird part - I went into task manager and disabled WPFFontCache_v0400.exe - I wish I had checked the location in Process Explorer first. So far it hasn’t returned.

Then I went to delete the files, but …

There are NO WPF* files on the C:\ partition.

There are a handful of files on the G:\ partition that start with WPF, but NO WPFFont files. (I don’t mean that I deleted them, I mean that I didn’t find anything there TO delete.)

So I’m wondering what this “service” really was …

(I’m not a security expert, but it seems possible there was some malware pretending to be WPFFontCache_v0400.exe - but hiding from both Avast and MalwareBytes, which seems unlikely).

Eddy · 2017-03-06T12:56:48.000Z

The WPF Font Cache service shares font data between WPF applications. The first WPF application you run starts this service if the service is not already running.

If you don’t have applications that need it, set it to disabled in the services.
No need to keep a car engine running and burning fuel, if you are not planning to drive it

system · 2017-03-06T13:01:48.000Z

You aren’t understanding what I said again …

I’m not sure if I have ANY WPF applications - although I think I do have .NET framework installed.

I killed the process from the task manager, but there was NO WPF Font Cache Service listed in services.msc to either stop or set as disabled - maybe it has to be running to show up in the task list in order to set a status for it, but I don’t think so.

And there was no WPFFont* files anywhere on the PC (although I’m not sure if I searched hidden files, but I normally have those visible).

Eddy · 2017-03-06T13:06:02.000Z

You aren't understanding what I said again ...

You are wrong. It is the other way around. You don't know what WPF is, what it is for etc.

system · 2017-03-06T13:14:02.000Z

Okay, there’s some truth to that also.

I didn’t recognize WPFFontCache_v0400.exe in Task Manager, so I googled it and found out it has something to do with .NET framework.

You previously said (as did google):

- Stop the WPF Font Cache 4.0 service. - Delete all of the WPFFontCache_v0400* files. Likely they are in: C:\Documents and Settings\LocalService\Local Settings\Application Data\ folder. - Start the service again.

There is no WPF Font Cache 4.0 service listed in services.msc - so no way to “stop the service”. I did find the process in Task Manager and killed the process - which isn’t exactly the same thing.
There were NO WPFFont files or folders on the hard drives. There was no C:\Documents and settings\LocalService folder. There were two C:\Documents and settings<user name> folders.
There was no service listed in services.msc, so no way to either start it again, set it as disabled, or set it as manual.

Announcements