Resolved What's accessing my Hard Drive...

Not sure where to post.. Hardware or Malware forum..

My HD light is blinking constantly.
I have run all types of cleaning programs.. CCleaner, EasyCleaner, SpyBot S&D, RegSeeker, and normal operation has Avira Antivia Personal Ed (free version), ZoneAlarm (free edition) running and all come up as expected and or free from problems. I turned off Windows Automatic Update. I also ran chkdsk & defragged my HD. SeaTools diagnosis found no problems with the HD. Also experimented with removing the page file as I have 4gb of memory. I also disabled the Network Connection and removed all "permissions" from Program Control in ZoneAlarm & disabled Avira Antivirus but the HD light was still running wild.
Task Manager does not shed any light as whats accessing the HD. The computer is a home built running Windows XP Pro SP3 & mostly used for Internet surfing & Email and I'm thinking that most everything should be running in memory..& accessing of the HD would be minimal. When I alternately boot the computer to "Puppy" (Linux) vie a "Live CD" I hardly ever see the HD light flash after the CD loads. I've thought about turning off all Windows Services to see if I can isolate a service as the culprit but than the computer probably will balk at that.. I have returned the computer to normal conditions and there's little if no difference in the HD activy.
Is there a way to see why the HD is being accessed and by what program?
So should my HD light be flashing all the time?

Also must add that this is not something new.. I just moved the computer to a new location and can now view the flashing HD light and relate it to what I considered normal background noise. (but it was the read /write heads accessing the HD)

thanks,
denny


CPU Type DualCore Intel Pentium D 830, 3152 MHz (15 x 210)
Motherboard Name Asus P5LD2 Deluxe
System Memory 3072 MB (DDR2-667 DDR2 SDRAM)
Operating System Microsoft Windows XP Professional, Service Pack 3
Video Adapter NVIDIA GeForce 6600 GT (128 MB)
Disk Drive Seagate ST3250410AS (232 GB, IDE)
C: (NTFS) 131061 MB (84155 MB free)

 

While your computer is running many programs/files are acessing the hard drive continuously. A blink a second likely shouldn't be a concern.

Mitch

 

Thanks Broni & Mitch for your responses.. However I think something more is happening here. The cpu usage can state its actively, and it can work as hard as it wants (independently from the hd) and should not show up on the LED that represents HD usage. (unless of course its getting it instructions from some unknown or installed program up to and including the OS that's accessing the files on the HD). I have 4 gb's of memory and once a program loads, for the most part the HD usage should be greatly reduced. My Task Manger page usage is flat lined most of the time, so most everything I'm doing is in RAM or cache. I assume that there are some "Temp" files open that could be accessing the HD, but unless my computer is "Saving" those files every nano-second, there would not be any HD LED flashing. I have shut down almost everything I could and let the system sit idle and still the HD LED is rapidly flashing. I have observed my second (much older) desktop idle state and the HD LED is nill for the most part. The second computer is running Windows XP home edition & does not have anywhere near the amount of programs the computer in question has. One or more of my installed programs or the OS could be doing some type of background housekeeping.. Maybe the system is ok but it sure raises some questions... and concerns...
thanks again,
denny

 

Try disabling the antivirus. Do you, say, have a large email store that it is checking?

Try turning off Windows Indexing system.

Just have one antivirus and one antispyware running in the background. You can have others, but don't let them run in the background. See what's loading at startup, some programs are Startup Cop and Startup Control Panel.

Do you have any "external" drives connected that the security programs want to constantly keep checking?

Matt

 

Thanks mattman for your response.. Windows indexing I have set to "manual" in "services" and its not started but it is checked on the HD property's setting. I only have 1 of my antivirus program running (to my knowledge). My inbox & sent folders are quite big but HD activity is the same whether Thunderbird is open or closed. I have no external drives attached to this computer.. At times I do plug in MagicJack vie its USB connection and that shows up a its own drive letters & has some storage on its drive. Only things that I know of as being open at startup are Avira, ZoneAlarm & Spybot tea time. But the following Process info might shed some light..

Broni heres the file you request..

Process PID CPU Description Company Name Command Line
System Idle Process 0 99.23
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 712 Windows NT Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
csrss.exe 768 Client Server Runtime Process Microsoft Corporation C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe 792 Windows NT Logon Application Microsoft Corporation winlogon.exe
services.exe 836 Services and Controller app Microsoft Corporation C:\WINDOWS\system32\services.exe
svchost.exe 1016 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe 1096 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost -k rpcss
svchost.exe 1196 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe 1440 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k LocalService
spoolsv.exe 1600 Spooler SubSystem App Microsoft Corporation C:\WINDOWS\system32\spoolsv.exe
sched.exe 1640 Antivirus Scheduler Avira GmbH "C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe "
schedul2.exe 1836 Acronis Scheduler 2 Acronis "C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe "
avguard.exe 1900 Antivirus On-Access Service Avira GmbH "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe "
InCDsrv.exe 1984 incdsrv Nero AG "C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe "
LSSrvc.exe 224 LightScribe Service Hewlett-Packard Company "C:\Program Files\Common Files\LightScribe\LSSrvc.exe "
nvsvc32.exe 512 NVIDIA Driver Helper Service, Version 178.13 NVIDIA Corporation C:\WINDOWS\system32\nvsvc32.exe
RichVideo.exe 532 RichVideo Module "C:\Program Files\CyberLink\Shared Files\RichVideo.exe "
svchost.exe 608 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k imgsvc
ViewpointService.exe 632 ViewMgr Viewpoint Corporation "C:\Program Files\Viewpoint\Common\ViewpointService.exe "
vsmon.exe 640 TrueVector Service Check Point Software Technologies LTD C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service
svchost.exe 1276 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k netsvcs
alg.exe 3876 Application Layer Gateway Service Microsoft Corporation C:\WINDOWS\System32\alg.exe
lsass.exe 848 LSA Shell (Export Version) Microsoft Corporation C:\WINDOWS\system32\lsass.exe
explorer.exe 1848 Windows Explorer Microsoft Corporation C:\WINDOWS\Explorer.EXE
avgnt.exe 440 Antivirus System Tray Tool Avira GmbH "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
ipoint.exe 444 IPoint.exe Microsoft Corporation "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
dpupdchk.exe 3240 dpupdchk.exe Microsoft Corporation "c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe"
zlclient.exe 1204 ZoneAlarm Client Check Point Software Technologies LTD "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
TeaTimer.exe 2628 System settings protector Safer-Networking Ltd. "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
procexp.exe 2860 0.77 Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Documents and Settings\Denny\Desktop\ProcessExplorer\procexp.exe"
firefox.exe 2100 Firefox Mozilla Corporation "C:\Program Files\Mozilla Firefox\firefox.exe"
thunderbird.exe 3788 Mozilla Thunderbird Mozilla Corporation "C:\Program Files\Mozilla Thunderbird\thunderbird.exe"
notepad.exe 2224 Notepad Microsoft Corporation "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Documents and Settings\Denny\Desktop\ProcessExplorer\Procexp.txt
rundll32.exe 3212 Run a DLL as an App Microsoft Corporation rundll32.exe nview.dll,nViewInitialize

Thanks again to both of you..

 

I agree the cpu is idle... but than why is the Hard Drive light flashing like crazy.. something is accessing the read /write heads of the Hard Drive. Whatever it is it's not taking any processing power to run it. Odd that two different computers one much older and way less powerful than the one in question running the same OS and the hard drives activity differs when in the same idle state.
Maybe this is not a hardware issue, but the cleaning utility programs I ran also came up clean...

Thanks for your help.. guess I'll put a piece of tape over the light.. at least my eye's won't contradict my brain..

denny

 

A disk intensive program is not necessarily a CPU intensive program. Start a full scan of the system by the antivirus and I don't think you will see much CPU activity (look in Task Manager).

Try uninstalling and reinstalling the antivirus program, then go to their website and check for any separate updates for it.

I doubt the antivirus (or antispam?) cares if the program is opened or closed, it will still check the email store.

Matt

 

Matt.. I'll try your suggestion this weekend.. In the meantime I did used msconfig to disable everything in "Startup" and the HD light was still flashing frequently. Some parts of ZoneAlarm and Avira did still load at start up.. must have been a registry start.. Odd that's there no way to monitor whats being written or read from the hd as its happening and from what program.
thanks,
denny

 

Try this, (probably best after a restart) go to Task Manager -> Processes tab, click on the CPU heading/bar to list the processes by CPU usage and see which one/s seem to correspond with the disk access. The process could be identified by doing a websearch or finding the file and looking in the Properties.

A maybe, check if Zonealarm might be blocking a program from accessing the internet and it is continually retrying.

Matt

 

Matt.... I tried looking at the task manager and referencing the HD flashes but nothing conclusive. I also uninstalled Avira and reinstalled it. Than I uninstalled ZoneAlarm and activated the Windows Firewall in its place. I turned off the "autostart" option for the CD & DVD drives. All that didn't do much to stop the frequency of the HD led flashing. Than I found a different program from a site that broni had me download from earlier. Its Called DiskMon. It monitors all HD activity in real time.. get it here.. http://technet.microsoft.com/en-us/sysinternals/bb896646.aspx
After running that program I believe that the HD led is being lit by something other than activity on the HD. The HD led lights about every second religiously but the DiskMon program shows no activity. When I do open a file DiskMon reports it correctly. What was interesting to see was when Firefox was open there was much more "Writing" to the HD going on. I assume it to be Firefoxs background housekeeping as I'm not "surfing" so to speak at the time. I was under the impression that most everything is run in RAM, and only saved to the HD (temp file, cookies, etc) when one exits a program or at some default pre-set time interval or when actually saving a file or when RAM is exhausted (pagefile).. So for now I'm done worrying about whats accessing my hard drive..
Broni, Mitch, & Matt Thanks for all your help.. denny

 

Good try. Thanks for letting us know how it went.