ekrn.exe is constantly writing to my HDD

Question

I installed Windows 7 about five days ago, and I realized that the system is constantly using my HDD.

I turned off file indexing, and every other services, without any effect.

Now I downloaded SysInternals Process Monitor, and it displayed this section repeadted more than ten times in a second:

15:24:06,5987317    ekrn.exe    1492    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
15:24:06,5987627    ekrn.exe    1492    RegOpenKey  HKLM\Software\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles   SUCCESS Desired Access: Read
15:24:06,5987969    ekrn.exe    1492    RegSetInfoKey   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles   SUCCESS KeySetInformationClass: KeySetHandleTagsInformation, Length: 0
15:24:06,5988231    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\Enable    NAME NOT FOUND  Length: 144
15:24:06,5988549    ekrn.exe    1492    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
15:24:06,5988778    ekrn.exe    1492    RegOpenKey  HKLM\Software\ESET\ESET Security\CurrentVersion\Plugins\01000101\Default    NAME NOT FOUND  Desired Access: Read
15:24:06,5989098    ekrn.exe    1492    RegQueryKey HKLM    SUCCESS Query: HandleTags, HandleTags: 0x0
15:24:06,5989317    ekrn.exe    1492    RegOpenKey  HKLM\Software\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile   SUCCESS Desired Access: Read
15:24:06,5989573    ekrn.exe    1492    RegSetInfoKey   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile   SUCCESS KeySetInformationClass: KeySetHandleTagsInformation, Length: 0
15:24:06,5989768    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskFloppy    NAME NOT FOUND  Length: 144
15:24:06,5989979    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskLocal NAME NOT FOUND  Length: 144
15:24:06,5990170    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskNetwork   NAME NOT FOUND  Length: 144
15:24:06,5990362    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanOpen  NAME NOT FOUND  Length: 144
15:24:06,5990549    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanExecute   NAME NOT FOUND  Length: 144
15:24:06,5990737    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanCreate    NAME NOT FOUND  Length: 144
15:24:06,5990932    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanNetworkOnClose    NAME NOT FOUND  Length: 144
15:24:06,5991119    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanOnAccess  NAME NOT FOUND  Length: 144
15:24:06,5991311    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanShutdown  NAME NOT FOUND  Length: 144
15:24:06,5991498    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OptimizeScan  NAME NOT FOUND  Length: 144
15:24:06,5991686    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\Autostart SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5991874    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\Autostart SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5992075    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OnOpen_RuntimeArchives    NAME NOT FOUND  Length: 144
15:24:06,5992270    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OnOpen_AutoExecArchives   NAME NOT FOUND  Length: 144
15:24:06,5992461    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\OnOpen_AdvanceHeuristic   NAME NOT FOUND  Length: 144
15:24:06,5992649    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanExecuteAH SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5992836    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ScanExecuteAH SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5993034    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DiskFloppyOnExecuteAH NAME NOT FOUND  Length: 144
15:24:06,5993222    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\BlockRemovableDevices NAME NOT FOUND  Length: 144
15:24:06,5993413    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\DefaultArchSettings   NAME NOT FOUND  Length: 144
15:24:06,5993605    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ArchiveDepth  NAME NOT FOUND  Length: 144
15:24:06,5993796    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\ArchiveMaxFilesize    NAME NOT FOUND  Length: 144
15:24:06,5993994    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AllowedDevices    NAME NOT FOUND  Length: 144
15:24:06,5994202    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\USBDevicesLikeDisk    NAME NOT FOUND  Length: 144
15:24:06,5994403    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AdvancedBlockRemovableDevices NAME NOT FOUND  Length: 144
15:24:06,5994598    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AskForScanOfRemovableDevice   NAME NOT FOUND  Length: 144
15:24:06,5994793    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AskForScanOfRemovableDeviceDefaultAction  SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5994984    ekrn.exe    1492    RegQueryValue   HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile\AskForScanOfRemovableDeviceDefaultAction  SUCCESS Type: REG_DWORD, Length: 4, Data: 1
15:24:06,5995212    ekrn.exe    1492    RegCloseKey HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles\@My profile   SUCCESS 
15:24:06,5995421    ekrn.exe    1492    RegCloseKey HKLM\SOFTWARE\ESET\ESET Security\CurrentVersion\Plugins\01000101\Profiles   SUCCESS 
15:24:06,6789163    GSvr.exe    1576    CreateFile  C:\service.log  SUCCESS Desired Access: Generic Read/Write, Disposition: OpenIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Opened
15:24:06,6790420    GSvr.exe    1576    CreateFile  C:\service.log  SUCCESS Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
15:24:06,6790997    GSvr.exe    1576    QueryFileInternalInformationFile    C:\service.log  SUCCESS IndexNumber: 0x2000000000095
15:24:06,6791369    GSvr.exe    1576    QueryBasicInformationFile   C:\service.log  SUCCESS CreationTime: 2011.11.09. 0:04:45, LastAccessTime: 2011.11.18. 14:45:17, LastWriteTime: 2011.11.18. 15:24:06, ChangeTime: 2011.11.18. 15:24:06, FileAttributes: A
15:24:06,6795206    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6795424    GSvr.exe    1576    CloseFile   C:\service.log  SUCCESS 
15:24:06,6796588    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6796824    GSvr.exe    1576    ReadFile    C:\service.log  SUCCESS Offset: 19 546, Length: 1, Priority: Normal
15:24:06,6797162    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6797353    GSvr.exe    1576    QueryStandardInformationFile    C:\service.log  SUCCESS AllocationSize: 20 480, EndOfFile: 19 547, NumberOfLinks: 1, DeletePending: False, Directory: False
15:24:06,6797732    GSvr.exe    1576    WriteFile   C:\service.log  SUCCESS Offset: 19 547, Length: 1, Priority: Normal
15:24:06,6798292    GSvr.exe    1576    CloseFile   C:\service.log  SUCCESS

So the ekrn.exe (ESET Smart Security) is not so smart, it's trying to do something in the registry, but it can't, and logs the problem in the service.log, and tries again constantly...

Any idea how to fix it?

score 0 · Accepted Answer · answered Nov 18 '11 at 14:46

Sounds like ESet is having compatibility issues with Windows 7. Perhaps either you are using an older version that is not compatible with Windows 7 or else something is not right with the installation. I would first make sure you are using the latest version of ESet. If you are, try to uninstall and reinstall ESet.

ekrn.exe is constantly writing to my HDD

1 Answers1