We have HP xw4100's in our trading firm. The SNMP.exe service is installed
by default on our image with the computers. Over the past week, we've
seen SNMP take up to or more than 50% of the CPU. Whenever we close
this app, everything speeds up immediately. There is absolutely no
network service polling SNMP, nor is the SNMP service inside windows
supposed to check anything.

Has anyone had similar problems?

SNMP may be checking the status of printers or multi-functional
devices. Use network protocol analyzer (for example, free Ethereal) to
check whether your PC has SNMP traffic to/from it.

I am running a process analyzer and it shows SNMP querying pretty much
all files that are opened or written to on the PC. That only.

It is unlikely that SNMP "queries files". SNMP is a protocol used to
check status of some devices and control them - that's why I suggest
protocol analyzer.  It can capture and analyze network traffic, so you
can see which device(s) your PC talks to via SNMP.

Process analyzer (is it Task Manager?) shows only that SNMP process is
taking CPU cycles, but doesn't show you whom it talks to.

Without protocol analysis, there are several possible explanations for
sudden surge in SNMP activity:

- printer or multifunctional device installation;

- some software was installed on your PC that uses SNMP to check
status of PC resources;

- someone runs network or host monitoring process somewhere on your
network and contantly collects information from your PCs.

If your IT support doesn't mind, try disabling SNMP service at your PC
completely (right-click My Computer | Manage | Services and
Applications | Services, find SNMP service, Stop it and change Startup
to Disabled).  If something else will stop working after that, you'll
know which application depends on SNMP.

It doesn't even have to be on the network for this to happen. The proc
goes nuts very randomly, so I have not had a chance to run this
program to see if what its doing on the computer. This may not be the
problem, at all, but this is just what the logs are showing for the
process. I haven't had a chance to run the program on a machine locked
up to see if its going beserk or something else is bugging it out.
I've also tried a packet analyzer, with no success with anything going
to and from the machine.

04          9:05:40 AM              snmp.exe:376         OPEN      
C:\tt\         SUCCESS                Options: Open Directory  Access:
All
605          9:05:40 AM              snmp.exe:376         DIRECTORY   
         C:\tt\         SUCCESS               
FileBothDirectoryInformation: *
606          9:05:40 AM              snmp.exe:376         DIRECTORY   
         C:\tt\         SUCCESS               
FileBothDirectoryInformation
575          9:05:40 AM              snmp.exe:376         OPEN      
C:\tt\bin\dhpg           SUCCESS                Options: Open  Access:
All
576          9:05:40 AM              snmp.exe:376         READ      
C:\tt\bin\dhpg           SUCCESS                Offset: 0 Length: 4096
577          9:05:40 AM              snmp.exe:376         READ      
C:\tt\bin\dhpg           END OF FILE            Offset: 146 Length:
4096
578          9:05:40 AM              snmp.exe:376         CLOSE    
C:\tt\bin\dhpg           SUCCESS
634          9:05:40 AM              snmp.exe:376         CLOSE    
C:\tt\bin\aconfigutil.exe            SUCCESS
635          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\aconfigutil.exe            SUCCESS   
            Attributes: A
636          9:05:40 AM              snmp.exe:376         OPEN      
C:\tt\bin\aconfigutil.exe            SUCCESS                Options:
Open  Access: All
637          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\aconfigutil.exe            SUCCESS   
            Length: 382976
638          9:05:40 AM              snmp.exe:376         CLOSE    
C:\tt\bin\aconfigutil.exe            SUCCESS
699          9:05:40 AM              snmp.exe:376         OPEN      
C:\tt\bin\autospreader.dll         SUCCESS                Options:
Open  Access: All
700          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\autospreader.dll         SUCCESS     
          Attributes: A
701          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\autospreader.dll         SUCCESS     
          Length: 404992
702          9:05:40 AM              snmp.exe:376         CLOSE    
C:\tt\bin\autospreader.dll         SUCCESS
703          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\boost_signal_1.30.dll SUCCESS        
       Attributes: A
704          9:05:40 AM              snmp.exe:376         OPEN      
C:\tt\bin\boost_signal_1.30.dll SUCCESS                Options: Open 
Access: Execute
705          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\boost_signal_1.30.dll SUCCESS        
       Length: 28160
706          9:05:40 AM              snmp.exe:376         CLOSE    
C:\tt\bin\boost_signal_1.30.dll SUCCESS
707          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\boost_signal_1.30.dll SUCCESS        
       Attributes: A
708          9:05:40 AM              snmp.exe:376         OPEN      
C:\tt\bin\boost_signal_1.30.dll SUCCESS                Options: Open 
Access: All
709          9:05:40 AM              snmp.exe:376         QUERY
INFORMATION            C:\tt\bin\boost_signal_1.30.dll SUCCESS        
       Length: 28160

Excuse my repetition and poor grammar, it's too early ;)

If you don't see any SNMP traffic, then it looks like your PC monitors
itself and  (due to some misconfiguration) tracks every single event
that occurs in the file system.  I don't think standard Performance
Monitor can track events on the directory/file level - could it be
misconfigured SMS or some third-party monitoring/management software?
If you cannot point your finger at anything like that, my next step
would be disabling SNMP service and looking for consequences. That's
about all I can advise on this matter...