Jump to content


Hard Drive


  • Please log in to reply
15 replies to this topic

#1 OFFLINE   amoeba

amoeba

    New Kid

  • Members
  • Pip
  • 4 posts

Posted 21 March 2003 - 12:00 AM

Hi All.Seems my hard drive is constantly doing I/O read and write.Always sounds like my drive is running.Used Task Manager to investigate,and it shows two files that are constantly doing a I/O Read + I/O Write.It's like watching the number for seconds on a digital clock changing,and read + write change virtually at the same time.Both columns are sychronized,meaning they change together.Both are system files,and they are:LSASS.EXE and SVCHOST.EXESVCHOST appears three times in the process list,but only one is always changing.Anybody know what these are for?Why are they constantly doing I/O?Is this normal?Things I've done:1. Full system scan with up to date Symantec.2. Full system scan with Adaware 6,PestPatrol-both up to date.Only a few minor pests.All else was clear.If anyone can shed some light on this constant drive chattering,and what to do about it,I would appreciate it.Thanks,RichSYSTEM INFO:Dell Dimension 4500,XP Home(DELL Branded)SP1-Not Installed,IE6,512MB RAM,56k modem,using Earthlink.net --------------------~]8^))...The true measure of a man is how he treats someone who can do him absolutely no good. ~ Samuel Johnson ~

#2 Guest_ThunderRiver_*

Guest_ThunderRiver_*
  • Guests

Posted 21 March 2003 - 12:19 AM

Turn off the indexnig service that shall do it. Both Lsass.exe and svchost.exe are very important services.Lsass.exe is "Windows Local Security Authority Server Process Handles Windows Security Mechanisms". Long story short, it is the service that maintains local security and group policy as well as interactive user authentication services.As for svchost.exe, it is "The Service Host Process is generic host process for services that are run from dynamic-link libraries (DLLs)" For more info, you can find it hereYou may notice that there are more than just one svchost.exe running, and that's because there is one svchost.exe running just for "System" privilage, and another one just for "Administrator" and another one for "power user" and so on. Indexing service is no use in Windows Xp at this point.

#3 Guest_ThunderRiver_*

Guest_ThunderRiver_*
  • Guests

Posted 21 March 2003 - 12:20 AM

Also, if you have Diskeeper constantly running in the background, it will cause hard drive running the whole time as well.There aren't that many things that causes the system to run sluggish, but just a few notes you should pay attention to.

#4 OFFLINE   amoeba

amoeba

    New Kid

  • Members
  • Pip
  • 4 posts

Posted 22 March 2003 - 06:53 AM

Thanks for the reply.Diskeeper is not on my system.Indexing service is,and has been disabled for quite some time.Can you offer any other info?I guess what I really want to know is--should I be getting aI/O read,and a I/O write at the rate of one per second from these two files?Rich

#5 Guest_ThunderRiver_*

Guest_ThunderRiver_*
  • Guests

Posted 22 March 2003 - 04:38 PM

Here is the screenshot of my TaskManager. Typically, both schost.exe and lsass.exe constantly write and read from system, but if you see hard drive light is on all the time or the CPU power is up to like 100% because of the above two services, maybe you should check with the programs that you run as service.Posted Image

#6 OFFLINE   amoeba

amoeba

    New Kid

  • Members
  • Pip
  • 4 posts

Posted 23 March 2003 - 02:44 AM

Thanks for the additional info,and the screenshot!CPU and hard drive light are ok.Guess all that constant activity was just making me paranoid.See Ya!

#7 OFFLINE   ibe98765

ibe98765

    Posting Prodigy

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 2,467 posts

Posted 23 March 2003 - 07:26 PM

ThunderRiver - How did you get that screen shot into the post here?

#8 Guest_ThunderRiver_*

Guest_ThunderRiver_*
  • Guests

Posted 24 March 2003 - 12:58 AM

ibe98765, I host the file from another web server.and then click IMG...wallah

#9 OFFLINE   Mike

Mike

    Message Adept

  • Honorary Moderators
  • 81 posts

Posted 24 March 2003 - 02:03 AM

Thunder... I don't see the screen shot...

#10 Guest_ThunderRiver_*

Guest_ThunderRiver_*
  • Guests

Posted 24 March 2003 - 02:08 AM

Sorry about that.. web server is down, so perhaps, tomorrow, it will be backup again.

#11 OFFLINE   LilBambi

LilBambi

    Australisches Googler

  • Forum Admins
  • 22,537 posts

Posted 24 March 2003 - 06:15 PM

As Thunder and others have indicated, these processes are quite normal to be in constant use, and you said that you had already run scan with your AV software, but...I thought I would mention this one remote possibility, just in case: Backdoor.Queen disguises itself as the normal windows process called LSASS.EXE.The Trojan has two components:QoSServer.dll: the backdoor TrojanQoSServer.exe: the loader of Backdoor.QueenAnd opens port: 8491See the Symantec link above for further details.It is probably not a likely scenario, but it is always best to eliminate all possibilities.Might want to search the computer for the above files and/or a service called: QoSserver....just to be sure  B)
Bambi
AKA Fran

Posted Image
My Public Key for Email :: BambisMusings Blog :: Fran's Computer Services Blog :: MyPassionIsBooks Blog :: 5BuckReview :: CNIRadio
"The Net interprets censorship as damage and routes around it." ~John Gilmore (Time Magazine, Dec 6, 1993)

#12 OFFLINE   amoeba

amoeba

    New Kid

  • Members
  • Pip
  • 4 posts

Posted 24 March 2003 - 10:58 PM

Impressive!Thanks for the additional info.As suggested,I read the Symantec link,then searched for the files.Searched all files,including the hidden ones.Came up clean.You're right though,best to be sure.Until that time...

#13 OFFLINE   LilBambi

LilBambi

    Australisches Googler

  • Forum Admins
  • 22,537 posts

Posted 24 March 2003 - 11:39 PM

Thanks!Excellent ... So glad to hear it came up clean ... Always makes my day to know that a problem is not caused by something like that  <_<
Bambi
AKA Fran

Posted Image
My Public Key for Email :: BambisMusings Blog :: Fran's Computer Services Blog :: MyPassionIsBooks Blog :: 5BuckReview :: CNIRadio
"The Net interprets censorship as damage and routes around it." ~John Gilmore (Time Magazine, Dec 6, 1993)

#14 OFFLINE   Arena2045

Arena2045

    Forum Fiend

  • Members
  • PipPipPipPipPipPipPipPipPip
  • 1,748 posts

Posted 25 March 2003 - 02:28 AM

Yeah I know I’m a few days late posting…ThunderRiver,You know, every so often after my computer would remain idle for, lets say 30 mins, the hard drive would start accessing like crazy!I never thought to turn off the indexing service!
The Lavender ribbon symbolizes/supports Cancer Awareness - As a cancer survivor, I wear a lavender ribbon. I'm an All-Things-Apple/Mac Enthusiast... You can visit my site, and get links to all of my online profiles at: http://7nk.us/me

#15 Guest_ThunderRiver_*

Guest_ThunderRiver_*
  • Guests

Posted 25 March 2003 - 02:56 AM

Hehe now you do <_<

#16 OFFLINE   Scot

Scot

    Administrator

  • Forum Admins
  • 2,018 posts

Posted 26 March 2003 - 06:47 PM

Just to add to this thread, I have had a long list of XP users write me with these symptoms in recent months. I've provided the same answer Thunder provided. In fact, somewhere I have written up directions about how to turn it off. (Did I run this in the newsletter? It may be slated to run.)In any case, an interesting thing is that a good number of people do NOT have indexing services turned on. Their hard drive lights are flickering fairly constantly, their drivers are churning, they have extensive CPU usage. This is not normal. I've even seen this behavior first-hand on one PC. There are no more than the average number of service host processes (four). There seems to be another problem. I doubt it's Backdoor.Queen (although you never know). I'm not sure what this is about, but it's something to work on because I have a feeling it's affecting a lot of people.On the machine I saw the problem on, it acted like it was disk bound. But I couldn't find any running service that was causing the problem.  B) -- Scot
Scot Finnie, Business & Technology Writer, Editor (that's me in the upper left corner)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users