Something is "ticking" my hard drive LED.

squeaky

OK... here goes...

MsMpEng.exe ___ PID=1104 ___ File Events=172 ___ Reg Events=351

svchost.exe _________ 1144 ______________ 75 ______________ 492

csrss.exe ___________ 692 _______________ 59 ______________ 5


Those are top three for file


The above svchost is top for Reg Entries then...

Isass.exe ______ PID=772 ____________F E = 0 __________R E=463

Then MsMpEng.exe again.

Top of CPU usage is Firefox but zero file and reg entries,
Then a different svchost - again 0
devices... also 0
explorer FE=13 RE=9
And then the above scvhost again


MsMpEng.exe is part of Windows Defender, it's Live One Care

csrss.exe shows on google either as an MS process or a trojan

Isass.exe same as for csrss on google


Hmm... well Win Def and One Care are on their way out right now!

And thanks for telling me how to use procmon

squeaky

Removed Win Def and still ticking. Reboot. Still ticking.

I opened Task Manager - went full screen, set for high refresh rate and added columns for IO read and IO write.
Isass was busy as heck.
csrss was next.

squeaky

OK... After all the stepping back through restore points and then doing a windows repair I decided to bite the bullet and start from fresh.

Format C: Install windows XP to SP3 and then install motherboard drivers.

That's it. There's not a single other program on this machine at all.

I've unchecked indexing for drive c: and I have physicall opened up the box and disconnected drive d:

And it's STILL "TICKING"

daily_2

Have you tried disconnecting the cd/DVD drive as well as the second drive? If you can capture the procmon output by clearing the log, and doing control E quickly at the time of the tick, it should show the process and the files it is accessing.

squeaky

Hang on, that's going to entail a bit more work with the screwdriver. Than I'll need to go get the software. But hang on a sec... it's the HARD drive led that's "ticking". The CD/DVD ones aren't doing anything, and there are no discs in them.

daily_2

Just trying to rule out an ide problem, just pull the cable out of the motherboard, or disable the channels in the bios

squeaky

Right, Will do, but I ran procmon a moment ago.

Everything on my very short processes list showed zeros across the board except:-

explorer FileEvents=6

Isass RegEvents=248


That's it.

I'll power down and pull cables

Jaffa.

A shot in the dark here, but I noticed when I was installing my HP PSC 1510 driver software that the drive started doing that 'ticking' and it matched the HDD led. Could it be HP's dodgy software? I guess if you dont have any HP software installed then you can rule this out lol

Maybe you have some sort of rootkit that keeps pumping information out and has made it's-self hidden to windows Do you think it would be worth running DBAN on quick to wipe the drive clean? Have you tried pulling the ethernet cable and seeing if the ticking stops Seriously though, try it...

squeaky

Jaffa. wrote: »

A shot in the dark here, but I noticed when I was installing my HP PSC 1510 driver software that the drive started doing that 'ticking' and it matched the HDD led. Could it be HP's dodgy software? I guess if you dont have any HP software installed then you can rule this out lol

Maybe you have some sort of rootkit that keeps pumping information out and has made it's-self hidden to windows Do you think it would be worth running DBAN on quick to wipe the drive clean? Have you tried pulling the ethernet cable and seeing if the ticking stops Seriously though, try it...

No HP software.

Erm... this is a complete format and clean install, and the only program I have loaded over and above windoze is the process monitor.

squeaky

daily wrote: »

Have you tried disconnecting the cd/DVD drive as well as the second drive? If you can capture the procmon output by clearing the log, and doing control E quickly at the time of the tick, it should show the process and the files it is accessing.

With the two DVD drives pulled (one IDE one ATAPI) the ticking has pretty much stopped (after the main drive activity) I get a few "ticks" three to five seconds apart before it dies down. But the hard drive led is very faintly lit.