«

If you have a USB drive, AND the drive is open in Explorer, then that drive
is in use and can not be removed. You have to close the Explorer session on
the drive before you can safely remove it.

Cameras that are open in Explorer will behave the same way. A camera that is
open in a photo editor is also in use and cannot be removed.





"- Bobb -" <bobb@noemail.123> wrote in message
news:. ..
>I recently bought a few USB devices and they have no power off.on switches.
>SO, in XP I click systray icon and select "Safely remove hardware". About
>25% of the time it comes back with "device in use". Not by me it isn't. I
>haven't used it at all this session
> I checked and device mgr - policies shows
> 'Optimize for quick removal ' - so caching not enabled.
>
> I did just check my P drive (External USB drive) and it does have " Allow
> Indexing Service ..." checked. Might that be it ? For my memory sticks I
> don't have that turned on and get the message with those too. I tried
> Google and spent a lot of time looking at pages that didn't relate to my
> problem. Anyone else have this intermittent " device in use" message.
> Resolution ? Especially for a device that has no problem off switch ?
>
>

"Barry Watzman" <> wrote in message
news:15691$489e2ff2$...
> No argument, but the discussion deals with the situation where there is
> apparently NOTHING open, when EVERY program is closed and the task bar has
> no icons in it at all, nothing other then explorer is running (and while
> explorer is running (it is, after all, normally ALWAYS running), it, too,
> has NO open windows.
>
> Experiment: with everything closed, hit ctrl-alt-delete and "end task" on
> explorer.exe, then [if necessary] restart explorer (also, if necessary,
> using task manager (e.g. ctrl-alt-delete, but to start a task rather than
> end it). Will you still get the "device in use/can't be removed" message?
>
>

I've never seen the problem of a USB device that is being used and I can't
figure out by what. I get the Device In Use error, but the device is always
in use by something that I've forgotten to shut down first.

If the device is bootable, and you booted to it, then by definition it is in
use and can't be removed.

"- Bobb -" <bobb@noemail.123> wrote in message
news:. ..
> Once again, when I have had something open I could understand that, but
> mostly, like right now, I power up ( either cold boot or from standby with
> NO windows open), check my mail, and logoff. Just prior to logoff if I
> notice that I didn't 'dismount/eject' the external drive last time, I
> would try to eject and even though I can see no disk activity ( led on
> front of MyBook drive) often get that "device in use" message. Repeat,
> there were no programs open when I logged on. I maybe read my mail via OE
> or Internet Explorer ( never accessing this drive since it's only "archive
> stuff"), yet get that message.
>
> I get around it by purposely logging off , log on and then eject works.
> I know that XP THINKS there's something open - but not by me. Sometimes if
> I do cold boot and just 'use pc for a few hours' I cannot eject - even
> though I specifically did not access drive. Perhaps I did open My Computer
> to access another drive - but I just thought with " no caching enabled" I
> wouldn't run into this. It seems that behind the scenes XP IS accessing
> it and I was just wondering if folks knew why, or if patch to fix this
> issue. Until then I'll just logoff/shutdown - eject it - and plug it back
> in when needed.
>
> Thanks guys.
>
>
try going into My Computer, right clicking on the drive and click "eject"

- Bobb - wrote:
>
> "olfart" <> wrote in message
> news:...
>>
>> "- Bobb -" <bobb@noemail.123> wrote in message
>> news:. ..
>>> Once again, when I have had something open I could understand that,
>>> but mostly, like right now, I power up ( either cold boot or from
>>> standby with NO windows open), check my mail, and logoff. Just prior
>>> to logoff if I notice that I didn't 'dismount/eject' the external
>>> drive last time, I would try to eject and even though I can see no
>>> disk activity ( led on front of MyBook drive) often get that "device
>>> in use" message. Repeat, there were no programs open when I logged
>>> on. I maybe read my mail via OE or Internet Explorer ( never
>>> accessing this drive since it's only "archive stuff"), yet get that
>>> message.
>>>
>>> I get around it by purposely logging off , log on and then eject works.
>>> I know that XP THINKS there's something open - but not by me.
>>> Sometimes if I do cold boot and just 'use pc for a few hours' I
>>> cannot eject - even though I specifically did not access drive.
>>> Perhaps I did open My Computer to access another drive - but I just
>>> thought with " no caching enabled" I wouldn't run into this. It
>>> seems that behind the scenes XP IS accessing it and I was just
>>> wondering if folks knew why, or if patch to fix this issue. Until
>>> then I'll just logoff/shutdown - eject it - and plug it back in when
>>> needed.
>>>
>>> Thanks guys.
>>>
>>>
>> try going into My Computer, right clicking on the drive and click "eject"
>>
> Same thing.
>

Get a copy of "Process Explorer".

http://technet.microsoft.com/en-us/s.../bb896653.aspx

Start the program, then go to "Find". In "Handle or DLL Substring",
enter "C:" without the quotes. By doing that, you might get to see
the dependencies on your boot drive. (The returned list should be
very large, and not all items will make a lot of sense.)

Now, try another search, only this time, use the drive letter of your
flash drive. Is anything returned in a search ?

Paul

On Sun, 10 Aug 2008 14:15:31 -0400, "- Bobb -" <bobb@noemail.123>
wrote:

:>Once again, when I have had something open I could understand that, but
:>mostly, like right now, I power up ( either cold boot or from standby with
:>NO windows open), check my mail, and logoff. Just prior to logoff if I
:>notice that I didn't 'dismount/eject' the external drive last time, I
:>would try to eject and even though I can see no disk activity ( led on
:>front of MyBook drive) often get that "device in use" message. Repeat,
:>there were no programs open when I logged on. I maybe read my mail via OE
:>or Internet Explorer ( never accessing this drive since it's only "archive
:>stuff"), yet get that message.
:>
:>I get around it by purposely logging off , log on and then eject works.
:>I know that XP THINKS there's something open - but not by me. Sometimes if
:>I do cold boot and just 'use pc for a few hours' I cannot eject - even
:>though I specifically did not access drive. Perhaps I did open My Computer
:>to access another drive - but I just thought with " no caching enabled" I
:>wouldn't run into this. It seems that behind the scenes XP IS accessing
:>it and I was just wondering if folks knew why, or if patch to fix this
:>issue. Until then I'll just logoff/shutdown - eject it - and plug it back
:>in when needed.
:>
:>Thanks guys.

In case my other message didn't come through I'll post this again.
Once you have installed the program I mentioned below all you have to
do is right-click on the drive letter of the problem drive and select
Unlocker from the menu. It will tell you any processes that have a
lock on the drive and allow you to terminate the offending process if
you want. If nothing else it will let you know what is going on in the
background that you may not be aware of. Also if it states that there
are no processes locking the drive you can safely ignore the message
from windows and just disconnect the device.

---------------- Posted a few days ago -------------------------------
Check out the following free utility. I've been using it for years now
and it will help out your situation along with other related ones.

File Unlocker at http://ccollomb.free.fr/unlocker/

One of the things I use it for is the exact situation you described.
Once it shows you exactly what has a file or drive locked you can have
Unlocker terminate the lock. Or you can just use the information
displayed to verify that you have already closed out whatever created
the lock and go ahead and pull the usb connection.
----------------------------------------------------------------------

me/2

On Aug 11, 7:06*pm, me/2 <n...@127.0.0.1> wrote:
> On Sun, 10 Aug 2008 14:15:31 -0400, "- Bobb -" <b...@noemail.123>
> wrote:
>
> :>Once again, when I have had something open I could understand that, but
> :>mostly, like right now, I power up ( either cold boot or from standby with
> :>NO windows open), check my mail, and logoff. Just prior to logoff if I
> :>notice that I didn't 'dismount/eject' the external drive last time, I
> :>would try to eject and even though I can see no disk activity ( led on
> :>front of MyBook drive) often get that "device in use" message. *Repeat,
> :>there were no programs open when I logged on. I maybe read my mail via OE
> :>or Internet Explorer ( never accessing this drive since it's only "archive
> :>stuff"), yet get that message.
> :>
> :>I get around it by purposely logging off , log on and then eject works.
> :>I know that XP THINKS there's something open - but not by me. Sometimes if
> :>I do cold boot and just 'use pc for a few hours' I cannot eject - even
> :>though I specifically did not access drive. Perhaps I did open My Computer
> :>to access another drive - but I just thought with " no caching enabled" I
> :>wouldn't run into this. *It seems that behind the scenes XP IS accessing
> :>it and I was just wondering if folks knew why, or if patch to fix this
> :>issue. Until then I'll just logoff/shutdown - eject it - and plug it back
> :>in when needed.
> :>
> :>Thanks guys.
>
> In case my other message didn't come through I'll post this again.
> Once you have installed the program I mentioned below all you have to
> do is right-click on the drive letter of the problem drive and select
> Unlocker from the menu. It will tell you any processes that have a
> lock on the drive and allow you to terminate the offending process if
> you want. If nothing else it will let you know what is going on in the
> background that you may not be aware of. Also if it states that there
> are no processes locking the drive you can safely ignore the message
> from windows and just disconnect the device.
>
> ---------------- Posted a few days ago -------------------------------
> Check out the following free utility. I've been using it for years now
> and it will help out your situation along with other related ones.
>
> File Unlocker athttp://ccollomb.free.fr/unlocker/
>
> One of the things I use it for is the exact situation you described.
> Once it shows you exactly what has a file or drive locked you can have
> Unlocker terminate the lock. Or you can just use the information
> displayed to verify that you have already closed out whatever created
> the lock and go ahead and pull the usb connection.
> ----------------------------------------------------------------------
>
> me/2

do you realise your post is set to not be archived?

oddly this is the first one to even appear once on google.

He isn't using a file so wouldn't just know what file to unlock.

Good advice has been from Paul about process explorer, (he says to
check C drive and usb drive)
and from Barry about doing End Task Explorer.exe and other things.
Maybe explorer.exe is has some communication with some dll or
something, and that is "locking" the drive. So could experiment from
there, googling the dll name, renaming the dll..

On Mon, 11 Aug 2008 19:13:11 -0700 (PDT), ""
<> wrote:

:>On Aug 11, 7:06*pm, me/2 <n...@127.0.0.1> wrote:
:>> On Sun, 10 Aug 2008 14:15:31 -0400, "- Bobb -" <b...@noemail.123>
:>> wrote:
:>>
:>> :>Once again, when I have had something open I could understand that, but
:>> :>mostly, like right now, I power up ( either cold boot or from standby with
:>> :>NO windows open), check my mail, and logoff. Just prior to logoff if I
:>> :>notice that I didn't 'dismount/eject' the external drive last time, I
:>> :>would try to eject and even though I can see no disk activity ( led on
:>> :>front of MyBook drive) often get that "device in use" message. *Repeat,
:>> :>there were no programs open when I logged on. I maybe read my mail via OE
:>> :>or Internet Explorer ( never accessing this drive since it's only "archive
:>> :>stuff"), yet get that message.
:>> :>
:>> :>I get around it by purposely logging off , log on and then eject works.
:>> :>I know that XP THINKS there's something open - but not by me. Sometimes if
:>> :>I do cold boot and just 'use pc for a few hours' I cannot eject - even
:>> :>though I specifically did not access drive. Perhaps I did open My Computer
:>> :>to access another drive - but I just thought with " no caching enabled" I
:>> :>wouldn't run into this. *It seems that behind the scenes XP IS accessing
:>> :>it and I was just wondering if folks knew why, or if patch to fix this
:>> :>issue. Until then I'll just logoff/shutdown - eject it - and plug it back
:>> :>in when needed.
:>> :>
:>> :>Thanks guys.
:>>
:>> In case my other message didn't come through I'll post this again.
:>> Once you have installed the program I mentioned below all you have to
:>> do is right-click on the drive letter of the problem drive and select
:>> Unlocker from the menu. It will tell you any processes that have a
:>> lock on the drive and allow you to terminate the offending process if
:>> you want. If nothing else it will let you know what is going on in the
:>> background that you may not be aware of. Also if it states that there
:>> are no processes locking the drive you can safely ignore the message
:>> from windows and just disconnect the device.
:>>
:>> ---------------- Posted a few days ago -------------------------------
:>> Check out the following free utility. I've been using it for years now
:>> and it will help out your situation along with other related ones.
:>>
:>> File Unlocker at http://ccollomb.free.fr/unlocker/
:>>
:>> One of the things I use it for is the exact situation you described.
:>> Once it shows you exactly what has a file or drive locked you can have
:>> Unlocker terminate the lock. Or you can just use the information
:>> displayed to verify that you have already closed out whatever created
:>> the lock and go ahead and pull the usb connection.
:>> ----------------------------------------------------------------------
:>>
:>> me/2
:>
:>do you realise your post is set to not be archived?
:>
:>oddly this is the first one to even appear once on google.

I've been using NNTP servers for news along with newsreader software
as my only source of news since around 1993. So I wasn't aware of
that. Probably a default setting in Agent somewhere that I never
noticed since I started using it back with version 1.x.

:>He isn't using a file so wouldn't just know what file to unlock.

If you go back and read my post you'll see I stated it works on
individual files or on a full drive. Right clicking on either one and
selecting Unlocker tells you what has an individual file or an entire
drive locked. Obviously not much use on permanently mounted drives but
coems in real handy with any kind of removable drive that windows
doesn't want to let loose of.

It's only 243K and free so why not download it and try it?

me/2

On Aug 12, 12:30 pm, BillW50 <Bill...@aol.kom> wrote:
<snip>
>
> Do you realize that I saw his original post on three different news servers?
>


Actually, you wrote that irrelevant fact earlier..

But yes. I do have spys looking through your windows at your computer
screen...

> Do you realize that Unlocker tells you exactly why your removable device
> can't be removed?


> Unlike Process Explorer which doesn't tell you why?
> Besides Process Explorer is no match to the likes of AnVir Task Manager
> which I like much better. It even tells you how much bandwidth each
> process is using, the temp, which is accessing the drives and how much, etc.
>

I see AnVir task manager, nothing to do with the company AntiVir..
It's a trial. Not fiddled with date/ tested what happens after x
days..
I had seen super task manager - another payware. But not this one.

I haven't used any of these kinds of tools that much.. I haven't
needed to. I've got by with task manager and win xp's system restore.

I really like those unique features you mention it doing... the disk
load column, really picks up for example if internet explorer is doing
alot when watching with google video. And, the bandwidth per
process - though it says "turned off" it didn't display the amount
used.. Be good to control bandwidth that can e used, I have seen some
payware to do that.. And it's good that it shows the main users of
ram/"main memory"

If I think disk space is getting chewed up, like if I have left it too
long and got a "low disk space" bubble.. Or if there is just alot of
hard drive activity.. or if i'm doing something that I know chews disk
space(like watching/loading a video in google video), or that I
suspect chews disk space. I do DIR and see how much disk space is
getting chewed up. Or freed by my wiping a TMP or TEMP directory. I
generally -know- what process is doing it, it tends to be obvious.
And regarding bandwidth.. I have used netstat analogx in the past. It
doesn't show on a per process basis, but I can normally figure that
out too.. 'cos it's either obvious e.g. downloading or uploading some
file in something, or in a rare event that I am hunting a bit, I can
end task some suspicious process and see if that helps.

I have used unlocker to unlock files, so haven't tended to use process
explorer for that.

I have had very little use for these advanced task managers..

Regarding you saying that anvir task manager beats process explorer..
I think it's a question of function..
Process Explorer , one of its uses, is removal of malware. So is
AnVir, according to its website.

But for removing malware, Process Explorer is one tool amongst others
by sysinternals.
There is a forum for it, even with a process explorer section.
http://forum.sysinternals.com/
There's a video here going into detail how tools like Autoruns and
Process Explorer can be used and mentioning some other things..
Advanced Malware Cleaning. by Mark Russinovich
http://www.microsoft.com/emea/spotlight/
http://www.microsoft.com/emea/spotli...px?videoid=359

He mentions some of its features, and some GREAT ones he mentions I
don't see in AnVir
He has a button in process explorer that looks like a disc, and the
tooltip says "find window's process"
- You can drag it onto a window and it highlights the process it is
from.
So if somebody gets some malware and a window comes up from it, then
you can locate the EXE from that.
Another cool function is if you double click a process you can go to
the STRINGS tab and see strings of data from the EXE, and often they
contain blatantly bad things, so you can find a culprit.

And process explorer is not trying to do everything.. For example in
removing malware it can be used with Autoruns (autoruns being like a
better msconfig, as process explorer is a better task manager than the
standard one)

The key is in how it's used.. I haven't used either that much.. But
it's good that at least process explorer is freeware. The person that
best knows what its purposes are is the author, but i've only seen the
malware video on it. I don't know what happens to AnVir at the end
of the trial, maybe locks out completely. If it was freeware I might
use it. It would have been good if it had shown me the bandwidth per
process as it looked like it would. But it's not a necessity. I don't
even use process explorer much either..

I have found Process Monitor useful at times.. That really shows disk
activity.. He mentioned it as useful for catching malware writing
registry keys back in after they are deleted - apparently it shows -
who- it is putting them back in!. I have used it to see where a
program is writing to. 'cos disk space was getting chewed up by one
file being built up somewhere. It's also useful for seeing how a
process is working writing to hard drive.

The idea of throwing it all into one program doesn't hack it.. and it
doesn't throw it all into one.

But process explorer would benefit from showing disk usage and
bandwidth.. per process. . Bandwidth throttling would be good too. I
don't have much use for it though.. settling for freeware and computer
sense/suspicions.

<snip>

On Aug 13, 1:10 am, me/2 <n...@127.0.0.1> wrote:
> On Mon, 11 Aug 2008 19:13:11 -0700 (PDT), "jameshanle...@yahoo.co.uk"
>
> <jameshanle...@yahoo.co.uk> wrote:
>
> :>On Aug 11, 7:06 pm, me/2 <n...@127.0.0.1> wrote:
> :>> On Sun, 10 Aug 2008 14:15:31 -0400, "- Bobb -" <b...@noemail.123>:>> wrote:
>
> :>>
> :>> :>Once again, when I have had something open I could understand that, but
> :>> :>mostly, like right now, I power up ( either cold boot or from standby with
> :>> :>NO windows open), check my mail, and logoff. Just prior to logoff if I
> :>> :>notice that I didn't 'dismount/eject' the external drive last time, I
> :>> :>would try to eject and even though I can see no disk activity ( led on
> :>> :>front of MyBook drive) often get that "device in use" message. Repeat,
> :>> :>there were no programs open when I logged on. I maybe read my mail via OE
> :>> :>or Internet Explorer ( never accessing this drive since it's only "archive
> :>> :>stuff"), yet get that message.
> :>> :>
> :>> :>I get around it by purposely logging off , log on and then eject works.
> :>> :>I know that XP THINKS there's something open - but not by me. Sometimes if
> :>> :>I do cold boot and just 'use pc for a few hours' I cannot eject - even
> :>> :>though I specifically did not access drive. Perhaps I did open My Computer
> :>> :>to access another drive - but I just thought with " no caching enabled" I
> :>> :>wouldn't run into this. It seems that behind the scenes XP IS accessing
> :>> :>it and I was just wondering if folks knew why, or if patch to fix this
> :>> :>issue. Until then I'll just logoff/shutdown - eject it - and plug it back
> :>> :>in when needed.
> :>> :>
> :>> :>Thanks guys.
> :>>
> :>> In case my other message didn't come through I'll post this again.
> :>> Once you have installed the program I mentioned below all you have to
> :>> do is right-click on the drive letter of the problem drive and select
> :>> Unlocker from the menu. It will tell you any processes that have a
> :>> lock on the drive and allow you to terminate the offending process if
> :>> you want. If nothing else it will let you know what is going on in the
> :>> background that you may not be aware of. Also if it states that there
> :>> are no processes locking the drive you can safely ignore the message
> :>> from windows and just disconnect the device.
> :>>
> :>> ---------------- Posted a few days ago -------------------------------
> :>> Check out the following free utility. I've been using it for years now
> :>> and it will help out your situation along with other related ones.
> :>>
> :>> File Unlocker athttp://ccollomb.free.fr/unlocker/
> :>>
> :>> One of the things I use it for is the exact situation you described.
> :>> Once it shows you exactly what has a file or drive locked you can have
> :>> Unlocker terminate the lock. Or you can just use the information
> :>> displayed to verify that you have already closed out whatever created
> :>> the lock and go ahead and pull the usb connection.
> :>> ----------------------------------------------------------------------
> :>>
> :>> me/2
> :>
> :>do you realise your post is set to not be archived?
> :>
> :>oddly this is the first one to even appear once on google.
>
> I've been using NNTP servers for news along with newsreader software
> as my only source of news since around 1993. So I wasn't aware of
> that. Probably a default setting in Agent somewhere that I never
> noticed since I started using it back with version 1.x.
>
> :>He isn't using a file so wouldn't just know what file to unlock.
>
> If you go back and read my post you'll see I stated it works on
> individual files or on a full drive. Right clicking on either one and
> selecting Unlocker tells you what has an individual file or an entire
> drive locked. Obviously not much use on permanently mounted drives but
> coems in real handy with any kind of removable drive that windows
> doesn't want to let loose of.
>
> It's only 243K and free so why not download it and try it?
>
> me/2

I have used unlocker a number of times.. as a way to delete a file
that might have required a longer or less clean method to delete it
(some described in the eldergeek article on deleting an "undeletable"
file).

I had never tried it from "my computer" on a drive.. I notice doing it
on C , it lists a load of DLLs, and clicking unlock all as a silly
experiment, caused my computer to BSOD - requiring a reboot.

I'm sure as you suggest, that is useful for drives that are not
running the OS currently being run.. not active in that sense

I have actually never had a usb drive that is locked..
after closing some "my computer" that was browsing it, or perhaps
closing a command prompt that was in a directory on it, i've never had
anything else locking it , and never needed unlocker for that..(if I
had had that, and had it routinely, then I would certainly have looked
alot). I had until now only considered it a file unlocker where one
right clicks a file and "unlocks".. It's good to know it has that
other use..

I have heard that with storage devices, you don't want to unplug them
until unmounted. But for other usb devies , not storing data - it's
ok.
I unmount quite quick with a single click and "safely removed
hardware". quicker than the double click that brings up a window where
you choose the items and click "stop" and so on..

Regarding your newsreader, forte agent.
What version is it?

BTW
To change this, (I haven't tested it but it must work)

remove the header. Or perhaps set it to ": no" instead of ": yes"

googled forte agent x no archive
http://www.faqs.org/faqs/off-line-re...t/forte-agent/
"
[3-3-3] How can I add an "X-No-Archive: yes" header?

In Free Agent this is not built in. (see [3-3-5])

For Agent users, this header may be toggled on using...

Group | Default Properties | Post (see [3-10-5])

and checking the appropriate checkboxes.
"

In news:46810e3c-03ee-4a7b-bab6-,
jameshanley39 typed on Tue, 12 Aug 2008 21:07:50 -0700 (PDT):
> On Aug 12, 12:30 pm, BillW50 <Bill...@aol.kom> wrote:
> <snip>
>>
>> Do you realize that I saw his original post on three different news
>> servers?
>
> Actually, you wrote that irrelevant fact earlier..
>
> But yes. I do have spys looking through your windows at your computer
> screen...
>
>> Do you realize that Unlocker tells you exactly why your removable
>> device can't be removed?
>
>> Unlike Process Explorer which doesn't tell you why?
>> Besides Process Explorer is no match to the likes of AnVir Task
>> Manager which I like much better. It even tells you how much
>> bandwidth each
>> process is using, the temp, which is accessing the drives and how
>> much, etc.
>
> I see AnVir task manager, nothing to do with the company AntiVir..
> It's a trial. Not fiddled with date/ tested what happens after x
> days..
> I had seen super task manager - another payware. But not this one.
>
> I haven't used any of these kinds of tools that much.. I haven't
> needed to. I've got by with task manager and win xp's system restore.
>
> I really like those unique features you mention it doing... the disk
> load column, really picks up for example if internet explorer is doing
> alot when watching with google video. And, the bandwidth per
> process - though it says "turned off" it didn't display the amount
> used.. Be good to control bandwidth that can e used, I have seen some
> payware to do that.. And it's good that it shows the main users of
> ram/"main memory"
>
> If I think disk space is getting chewed up, like if I have left it too
> long and got a "low disk space" bubble.. Or if there is just alot of
> hard drive activity.. or if i'm doing something that I know chews disk
> space(like watching/loading a video in google video), or that I
> suspect chews disk space. I do DIR and see how much disk space is
> getting chewed up. Or freed by my wiping a TMP or TEMP directory. I
> generally -know- what process is doing it, it tends to be obvious.
> And regarding bandwidth.. I have used netstat analogx in the past. It
> doesn't show on a per process basis, but I can normally figure that
> out too.. 'cos it's either obvious e.g. downloading or uploading some
> file in something, or in a rare event that I am hunting a bit, I can
> end task some suspicious process and see if that helps.
>
> I have used unlocker to unlock files, so haven't tended to use process
> explorer for that.
>
> I have had very little use for these advanced task managers..
>
> Regarding you saying that anvir task manager beats process explorer..
> I think it's a question of function..
> Process Explorer , one of its uses, is removal of malware. So is
> AnVir, according to its website.
>
> But for removing malware, Process Explorer is one tool amongst others
> by sysinternals.
> There is a forum for it, even with a process explorer section.
> http://forum.sysinternals.com/
> There's a video here going into detail how tools like Autoruns and
> Process Explorer can be used and mentioning some other things..
> Advanced Malware Cleaning. by Mark Russinovich
> http://www.microsoft.com/emea/spotlight/
> http://www.microsoft.com/emea/spotli...px?videoid=359
>
> He mentions some of its features, and some GREAT ones he mentions I
> don't see in AnVir
> He has a button in process explorer that looks like a disc, and the
> tooltip says "find window's process"
> - You can drag it onto a window and it highlights the process it is
> from.
> So if somebody gets some malware and a window comes up from it, then
> you can locate the EXE from that.
> Another cool function is if you double click a process you can go to
> the STRINGS tab and see strings of data from the EXE, and often they
> contain blatantly bad things, so you can find a culprit.
>
> And process explorer is not trying to do everything.. For example in
> removing malware it can be used with Autoruns (autoruns being like a
> better msconfig, as process explorer is a better task manager than the
> standard one)
>
> The key is in how it's used.. I haven't used either that much.. But
> it's good that at least process explorer is freeware. The person that
> best knows what its purposes are is the author, but i've only seen the
> malware video on it. I don't know what happens to AnVir at the end
> of the trial, maybe locks out completely. If it was freeware I might
> use it. It would have been good if it had shown me the bandwidth per
> process as it looked like it would. But it's not a necessity. I don't
> even use process explorer much either..
>
> I have found Process Monitor useful at times.. That really shows disk
> activity.. He mentioned it as useful for catching malware writing
> registry keys back in after they are deleted - apparently it shows -
> who- it is putting them back in!. I have used it to see where a
> program is writing to. 'cos disk space was getting chewed up by one
> file being built up somewhere. It's also useful for seeing how a
> process is working writing to hard drive.
>
> The idea of throwing it all into one program doesn't hack it.. and it
> doesn't throw it all into one.
>
> But process explorer would benefit from showing disk usage and
> bandwidth.. per process. . Bandwidth throttling would be good too. I
> don't have much use for it though.. settling for freeware and computer
> sense/suspicions.

Okay for starters, I didn't pay for my AnVir Task Manager. I got it free on
the www.giveawayoftheday.com website. They offer a free commercial program
everyday. And AnVir Task Manager was offered on the following dates. I am
sure it will be back again. The last two versions can be easily adapted to
be portable.

2007 12 13 - AnVir Task Manager
2008 03 09 - AnVir Task Manager 5.0.4
2008 07 27 - AnVir Task Manager 5.2.0

I too usually get by with Windows Task Manager and XP's system Restore. I
also enjoy using stock tools because not all computers have everything on
them. So I don't have to hunt around and learn when I am on another
computer. But since you had thrown out Process Monitor, IMHO AnVir Task
Manager is far better if you are going to use something like that.

Yes the bandwidth is turned off on AnVir Task Manager by default. Mentions
something about some third party network drivers may have a problem when it
is enabled. You can enabled it by Tools -> Options -> Program Settings ->
Advanced. Near the bottom... Enable Internet traffic monitoring.

Yes AnVir Task Manager is great for malware as well. One of the things it
does is to monitor startup programs and alerts you if there is a change and
you can allow or deny. And another feature is you can mark a process or a
program that automatically starts up to automatically kill it. Another
feature is you can automatically set to throttle some applications that want
to hog the system. Here is a good list of features:

http://www.anvir.com/products.htm

Wow! It finds locked files too! I didn't know that. I have to check that one
out. Another thing I like about it and that it shows you a log of what is
going on. And it tells you things like when a process was first detected.
What time it started, etc. And you can check something against 30 antivirus
engines too. It does do a lot of things and it doesn't hog the system
either. And I believe it is one of the best of its kind, really.

--
Bill
Gateway Celeron M 370 (1.5GHZ)
MX6124 (laptop) w/2GB
Windows XP Home SP2 (120GB HD)
Intel(r) 910GML (64MB shared)