View Single Post
  #3  
Old March 19th 19, 08:29 PM posted to microsoft.public.windowsxp.general
Paul[_32_]
external usenet poster
 
Posts: 11,873
Default Another XP Search question

James Davis wrote:
Sounds like Shady-Activity ;-D

Check your Indexing Options (in Control Panel).

Remove everything it wants to search; then stop/disable it (stops forever).

Then use a better finder like Search "Everything" or something else.

[Advice applies to Windows 7; it may not apply to Windows XP.]


There is no particular reason that Everything.exe would
not do the same thing.

The WinXP search code is re-triggered by file system
activity. For example, for sure, if you empty the Recycle Bin,
that causes the built-in search to regenerate a result.

Everything.exe is triggered by the USN journal, so at least
the index updating code is going to trigger, if the file
system state changes. Any process which changes a file date
once a second, could cause a tiny piece of Everything.exe
code to run.

Only Agent Ransack would be quiet after a search runs.
But the actual searches with that, are expensive.

*******

If you "dump" the USN Journal as a text file (fsutil?), you can
go through the results and see what events have
happened recently.

You can also use Process Monitor from Sysinternals,
to study all the ReadFile, WriteFile, CreateFile events.
CreateFile, for example, includes stat() and isn't necessarily
the creation of a file. Just checking the size of a
file might cause a CreateFile event while opening the
path. If there is repetitive activity on the computer,
you can likely catch it.

Process Monitor logs to RAM... unless you configure it
to write to the file system, in which case there could
be some "pollution" in the results. But by default it
uses RAM for this, and should not aggravate things
while you are collecting a trace. In the File menu,
removing the tick mark, stops the tracing and you can
then study the results in peace.

Paul
Ads