Jump to content

Hard Drive


amoeba

Recommended Posts

Hi All.Seems my hard drive is constantly doing I/O read and write.Always sounds like my drive is running.Used Task Manager to investigate,and it shows two files that are constantly doing a I/O Read + I/O Write.It's like watching the number for seconds on a digital clock changing,and read + write change virtually at the same time.Both columns are sychronized,meaning they change together.Both are system files,and they are:LSASS.EXE and SVCHOST.EXESVCHOST appears three times in the process list,but only one is always changing.Anybody know what these are for?Why are they constantly doing I/O?Is this normal?Things I've done:1. Full system scan with up to date Symantec.2. Full system scan with Adaware 6,PestPatrol-both up to date.Only a few minor pests.All else was clear.If anyone can shed some light on this constant drive chattering,and what to do about it,I would appreciate it.Thanks,RichSYSTEM INFO:Dell Dimension 4500,XP Home(DELL Branded)SP1-Not Installed,IE6,512MB RAM,56k modem,using Earthlink.net --------------------~]8^))...The true measure of a man is how he treats someone who can do him absolutely no good. ~ Samuel Johnson ~

Link to comment
Share on other sites

Guest ThunderRiver

Turn off the indexnig service that shall do it. Both Lsass.exe and svchost.exe are very important services.Lsass.exe is "Windows Local Security Authority Server Process Handles Windows Security Mechanisms". Long story short, it is the service that maintains local security and group policy as well as interactive user authentication services.As for svchost.exe, it is "The Service Host Process is generic host process for services that are run from dynamic-link libraries (DLLs)" For more info, you can find it hereYou may notice that there are more than just one svchost.exe running, and that's because there is one svchost.exe running just for "System" privilage, and another one just for "Administrator" and another one for "power user" and so on. Indexing service is no use in Windows Xp at this point.

Link to comment
Share on other sites

Guest ThunderRiver

Also, if you have Diskeeper constantly running in the background, it will cause hard drive running the whole time as well.There aren't that many things that causes the system to run sluggish, but just a few notes you should pay attention to.

Link to comment
Share on other sites

Thanks for the reply.Diskeeper is not on my system.Indexing service is,and has been disabled for quite some time.Can you offer any other info?I guess what I really want to know is--should I be getting aI/O read,and a I/O write at the rate of one per second from these two files?Rich

Link to comment
Share on other sites

Guest ThunderRiver

Here is the screenshot of my TaskManager. Typically, both schost.exe and lsass.exe constantly write and read from system, but if you see hard drive light is on all the time or the CPU power is up to like 100% because of the above two services, maybe you should check with the programs that you run as service.Tskmgr.jpg

Link to comment
Share on other sites

Thanks for the additional info,and the screenshot!CPU and hard drive light are ok.Guess all that constant activity was just making me paranoid.See Ya!

Link to comment
Share on other sites

Guest LilBambi

As Thunder and others have indicated, these processes are quite normal to be in constant use, and you said that you had already run scan with your AV software, but...I thought I would mention this one remote possibility, just in case: Backdoor.Queen disguises itself as the normal windows process called LSASS.EXE.The Trojan has two components:QoSServer.dll: the backdoor TrojanQoSServer.exe: the loader of Backdoor.QueenAnd opens port: 8491See the Symantec link above for further details.It is probably not a likely scenario, but it is always best to eliminate all possibilities.Might want to search the computer for the above files and/or a service called: QoSserver....just to be sure B)

Link to comment
Share on other sites

Impressive!Thanks for the additional info.As suggested,I read the Symantec link,then searched for the files.Searched all files,including the hidden ones.Came up clean.You're right though,best to be sure.Until that time...

Link to comment
Share on other sites

Guest LilBambi

Thanks!Excellent ... So glad to hear it came up clean ... Always makes my day to know that a problem is not caused by something like that <_>

Link to comment
Share on other sites

Yeah I know I’m a few days late posting…ThunderRiver,You know, every so often after my computer would remain idle for, lets say 30 mins, the hard drive would start accessing like crazy!I never thought to turn off the indexing service!

Link to comment
Share on other sites

Just to add to this thread, I have had a long list of XP users write me with these symptoms in recent months. I've provided the same answer Thunder provided. In fact, somewhere I have written up directions about how to turn it off. (Did I run this in the newsletter? It may be slated to run.)In any case, an interesting thing is that a good number of people do NOT have indexing services turned on. Their hard drive lights are flickering fairly constantly, their drivers are churning, they have extensive CPU usage. This is not normal. I've even seen this behavior first-hand on one PC. There are no more than the average number of service host processes (four). There seems to be another problem. I doubt it's Backdoor.Queen (although you never know). I'm not sure what this is about, but it's something to work on because I have a feeling it's affecting a lot of people.On the machine I saw the problem on, it acted like it was disk bound. But I couldn't find any running service that was causing the problem. B) -- Scot

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...