amoeba Posted March 21, 2003 Share Posted March 21, 2003 Hi All.Seems my hard drive is constantly doing I/O read and write.Always sounds like my drive is running.Used Task Manager to investigate,and it shows two files that are constantly doing a I/O Read + I/O Write.It's like watching the number for seconds on a digital clock changing,and read + write change virtually at the same time.Both columns are sychronized,meaning they change together.Both are system files,and they are:LSASS.EXE and SVCHOST.EXESVCHOST appears three times in the process list,but only one is always changing.Anybody know what these are for?Why are they constantly doing I/O?Is this normal?Things I've done:1. Full system scan with up to date Symantec.2. Full system scan with Adaware 6,PestPatrol-both up to date.Only a few minor pests.All else was clear.If anyone can shed some light on this constant drive chattering,and what to do about it,I would appreciate it.Thanks,RichSYSTEM INFO:Dell Dimension 4500,XP Home(DELL Branded)SP1-Not Installed,IE6,512MB RAM,56k modem,using Earthlink.net --------------------~]8^))...The true measure of a man is how he treats someone who can do him absolutely no good. ~ Samuel Johnson ~ Quote Link to comment Share on other sites More sharing options...
Guest ThunderRiver Posted March 21, 2003 Share Posted March 21, 2003 Turn off the indexnig service that shall do it. Both Lsass.exe and svchost.exe are very important services.Lsass.exe is "Windows Local Security Authority Server Process Handles Windows Security Mechanisms". Long story short, it is the service that maintains local security and group policy as well as interactive user authentication services.As for svchost.exe, it is "The Service Host Process is generic host process for services that are run from dynamic-link libraries (DLLs)" For more info, you can find it hereYou may notice that there are more than just one svchost.exe running, and that's because there is one svchost.exe running just for "System" privilage, and another one just for "Administrator" and another one for "power user" and so on. Indexing service is no use in Windows Xp at this point. Quote Link to comment Share on other sites More sharing options...
Guest ThunderRiver Posted March 21, 2003 Share Posted March 21, 2003 Also, if you have Diskeeper constantly running in the background, it will cause hard drive running the whole time as well.There aren't that many things that causes the system to run sluggish, but just a few notes you should pay attention to. Quote Link to comment Share on other sites More sharing options...
amoeba Posted March 22, 2003 Author Share Posted March 22, 2003 Thanks for the reply.Diskeeper is not on my system.Indexing service is,and has been disabled for quite some time.Can you offer any other info?I guess what I really want to know is--should I be getting aI/O read,and a I/O write at the rate of one per second from these two files?Rich Quote Link to comment Share on other sites More sharing options...
Guest ThunderRiver Posted March 22, 2003 Share Posted March 22, 2003 Here is the screenshot of my TaskManager. Typically, both schost.exe and lsass.exe constantly write and read from system, but if you see hard drive light is on all the time or the CPU power is up to like 100% because of the above two services, maybe you should check with the programs that you run as service. Quote Link to comment Share on other sites More sharing options...
amoeba Posted March 23, 2003 Author Share Posted March 23, 2003 Thanks for the additional info,and the screenshot!CPU and hard drive light are ok.Guess all that constant activity was just making me paranoid.See Ya! Quote Link to comment Share on other sites More sharing options...
ibe98765 Posted March 23, 2003 Share Posted March 23, 2003 ThunderRiver - How did you get that screen shot into the post here? Quote Link to comment Share on other sites More sharing options...
Guest ThunderRiver Posted March 24, 2003 Share Posted March 24, 2003 ibe98765, I host the file from another web server.and then click IMG...wallah Quote Link to comment Share on other sites More sharing options...
Mike Posted March 24, 2003 Share Posted March 24, 2003 Thunder... I don't see the screen shot... Quote Link to comment Share on other sites More sharing options...
Guest ThunderRiver Posted March 24, 2003 Share Posted March 24, 2003 Sorry about that.. web server is down, so perhaps, tomorrow, it will be backup again. Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted March 24, 2003 Share Posted March 24, 2003 As Thunder and others have indicated, these processes are quite normal to be in constant use, and you said that you had already run scan with your AV software, but...I thought I would mention this one remote possibility, just in case: Backdoor.Queen disguises itself as the normal windows process called LSASS.EXE.The Trojan has two components:QoSServer.dll: the backdoor TrojanQoSServer.exe: the loader of Backdoor.QueenAnd opens port: 8491See the Symantec link above for further details.It is probably not a likely scenario, but it is always best to eliminate all possibilities.Might want to search the computer for the above files and/or a service called: QoSserver....just to be sure Quote Link to comment Share on other sites More sharing options...
amoeba Posted March 25, 2003 Author Share Posted March 25, 2003 Impressive!Thanks for the additional info.As suggested,I read the Symantec link,then searched for the files.Searched all files,including the hidden ones.Came up clean.You're right though,best to be sure.Until that time... Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted March 25, 2003 Share Posted March 25, 2003 Thanks!Excellent ... So glad to hear it came up clean ... Always makes my day to know that a problem is not caused by something like that <_> Quote Link to comment Share on other sites More sharing options...
Arena2045 Posted March 25, 2003 Share Posted March 25, 2003 Yeah I know I’m a few days late posting…ThunderRiver,You know, every so often after my computer would remain idle for, lets say 30 mins, the hard drive would start accessing like crazy!I never thought to turn off the indexing service! Quote Link to comment Share on other sites More sharing options...
Guest ThunderRiver Posted March 25, 2003 Share Posted March 25, 2003 Hehe now you do Quote Link to comment Share on other sites More sharing options...
Scot Posted March 26, 2003 Share Posted March 26, 2003 Just to add to this thread, I have had a long list of XP users write me with these symptoms in recent months. I've provided the same answer Thunder provided. In fact, somewhere I have written up directions about how to turn it off. (Did I run this in the newsletter? It may be slated to run.)In any case, an interesting thing is that a good number of people do NOT have indexing services turned on. Their hard drive lights are flickering fairly constantly, their drivers are churning, they have extensive CPU usage. This is not normal. I've even seen this behavior first-hand on one PC. There are no more than the average number of service host processes (four). There seems to be another problem. I doubt it's Backdoor.Queen (although you never know). I'm not sure what this is about, but it's something to work on because I have a feeling it's affecting a lot of people.On the machine I saw the problem on, it acted like it was disk bound. But I couldn't find any running service that was causing the problem. -- Scot Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.