Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

HP Pavilion hard drive writing all the time

Mar 17, 2006 1:52AM PST

My boss brought me his home computer. HP Pavilion 521c, 512mb ram, athlon 1800+, 60gb HDD, XP home, an expired installation of McAfee Security (A/V, firewall, spamkiller). Used by his wife & kids, now he wants it cleaned up for his use.

The first thing I did was to install & scan with Ad-Aware & Spybot, deleting everything they found. Also installed & scanned with Ewido & CCleaner & deleted everything found. Through several iterations of this I got to the point where nothing more is found. It was so bad I created a new account with administrator rights and deleted the user account that they had been using.

This machine never had any Windows updates posted that I can see to once it was nominally clean I took care of that, too.

This machine runs like a snail. It sucks. The hard drive runs virtually all the time. When I got it it had 256mb of ram, some being used by the video system, so I went and got another 256 and stuffed it in. First time I've ever fed XP ram and didn't see a positive change.

It's got to be infected with something more, but I can't find it. I tried running HouseCall online scan but it won't complete. I says it detects multiple instances of TRAK_SE and ADW_SE but blows out while trying to delete them.

I'm hoping to get some suggestions here.

Discussion is locked

- Collapse -
Update: Just ran Stinger
Mar 17, 2006 2:49AM PST

Just scanned with Stinger and it didn't find anything either. So I've disables system restore and am scanning again with Ad-Aware & Spybot in safe mode while waiting for other suggestions.

Even while sitting idle, the damn hard drive light is flashing arythmically.

- Collapse -
Henry
Mar 17, 2006 2:59AM PST

Maybe clean all unwanted files,click HERE

Also Shut Down Unnecessary Start Up Programs,click HERE

Just in case it's not a virus.

Tom

- Collapse -
Just a thought - did you run DEFRAG ??
Mar 17, 2006 3:12AM PST
- Collapse -
Mariana & Tom: Thanks for the replies
Mar 17, 2006 5:33AM PST

I have done both of the Tom recommended and also defragged, but in the interest of thoroughness (and in case I blundered) I'm doing them again.

After disabling system restore, then scanning everything in safe mode with spybot, ad-aware, & stinger I went back to HouseCall and got a successful scan that listed a huge number of items:

ADW_SE.76094, ADW_SE.76095 (83687, 83688, 76847, 58161, 58163, 73762, 95575, 95576, 95578, 95579, 95580, 95581, 95582, 95583, 95584, 95585, 98648, 98649, 79311, 82572, 58167, 29766, 41299, 89994)

TROJ_SE.85638

TRAK_SE.116060 (116061, 116062, 116063, 116064, 116065, 116066, 116067, 116068, 116069)

DOWN_SE.70336

This time at the end of the scan the system completed the cleaning phase of the operation.

Then I went back and rescanned with Ad-Aware and it found Zango and Windupdate. Supposedly eliminated both.

Still the drive runs.... on/off, on/off, intermittently as it sits idle.

I'm totally confused now. Any other ideas?

- Collapse -
Indexing?
Mar 17, 2006 5:59AM PST
- Collapse -
Need To Run Chkdsk And Other Things Also..
Mar 17, 2006 8:21AM PST

First, make sure to run all those antispyware/antivirus tools in Safe Mode repeatedly till you find nothing. Next, please follow ALL of the instructions in the link below. It will take a while to perform all of the procedures, but it should help stop some of those background programs and services from running. The last item in the list is Chkdks/Error Checking. :

Things To Do

Hope this helps.

Grif

- Collapse -
if after you have followed the post by Grif and Bob
Mar 18, 2006 4:48AM PST
'Still the drive runs.... on/off, on/off, intermittently as it sits idle', you could be experiencing a power supply issue.

Regrettably I do not know enough about laptops to provide you with a solution but our PC Hardware Forum might or even the HP Help desk, at a pinch.
- Collapse -
2nd round of cleaning results...
Mar 20, 2006 1:15AM PST

Note: This unit is a desktop, not a laptop.

Summary: This was all done a second time for thoroughness and due to previous response recommendations.

XP home sp2, all updates
System restore off.
Temp files cleaned, TIF cleaned, turned off every startup program I didn't recognize with msconfig.
Ran Chkdsk /f /r.

Scanned online with housecall & deleted what it found.
Scanned in safe mode with Ad-Aware, Spybot S&D, Ewido, Stinger. Even the MS malicious software remover. Nothing found.

Scanned with CWShredder. It scrolled by so fast that I can't say for sure what it did or didn't find. Only thing is that after the scan, one immediate change was that when I use Windows Explorer and properties click on a file or folder I now have the security tab whereas I didn't before (& never noticed).

Turned Indexing off (at least I think so...disabled indexing for the C drive).

The upshot is that after all of that the drive still runs and runs....

I'm now doing an online scan at PandaSoft.

- Collapse -
Addendum to 2nd round results
Mar 20, 2006 4:46AM PST

Here's something I never noticed till now:

After running CWShredder, I got the Security tab on the properties box, but only when running in safe mode.

When I reboot into normal mode, the security tab goes away again. This isn't normal, is it?

- Collapse -
Yes, That's Normal On XP HOME..
Mar 20, 2006 9:13AM PST

The "Security" tab is only visible in "Safe Mode". On XP PRO, it's visible all the time..

Hope this helps.

Grif

- Collapse -
(NT) (NT) Good to know that...thanks Grif
Mar 20, 2006 10:08PM PST
- Collapse -
Download This
Mar 20, 2006 2:57AM PST

free trial called Security Task Manager.Shows all running processes and level of possible dangerous qualities.Will show what's using cpu usage and might flush out the problem.

- Collapse -
Thanks
Mar 20, 2006 5:23AM PST

I downloaded it and ran it but it didn't tell me anything that msconfig didn't already tell me...

Any other suggestions welcome.

- Collapse -
It was worth trying
Mar 20, 2006 6:07AM PST

sometimes certain programs will reveal extra things.So there is nothing visible taking up your cpu?.Will post back if i think of something else.If you figure it out, let us know.

- Collapse -
Henery
Mar 20, 2006 6:29AM PST
- Collapse -
Good suggestion there...
Mar 20, 2006 10:55PM PST

Should have thought of it myself. Already doubled the ram and it didn't do a thing.

got rid of the paging file completely, defragged the disk, rebooted & defragged again. Let the machine stand idle and still the drive runs.

The only time it doesn't run is when I start it up in safe mode and haven't logged in yet. As long as it sits at the "choose profile" screen the drive won't run. I wonder if it has anything to do with all the McAfee apps that load at startup.

Anyone know if I'll let the smoke out by stopping the McAfee processes one at a time?

- Collapse -
Henry, Question About 'Hard Drive Runs'
Mar 21, 2006 12:39AM PST

First, a hard drive is supposed to 'run' all the time. It never really stops spinning. Are you sure it's not one of the fans you're hearing.. What type of sound makes you believe the hard drive is "running"? Or are you seeing the small lights flashing on the computer which are indicative of hard drive activity? This type of activity is normal for most computers.. They tend to flash occasionally as various background programs operate..

As to McAfee, both the standard Virus Scan and Security Suites constantly check for updates about every five minutes or so. Although you can disable ALL McAfee activities in the System Configuration Utility, some update processes in the Task Scheduler may continue to run.. If the program has expired and the owners don't intend on renewing the subscription, you should uninstall it completely. Even if they intend on purchasing a newer version of McAfee, then old Security Suite will need to be uninstalled. (It would help if I knew the EXACT Security Suite version installed.) Most McAfee Security Suites required uninstalling from the Control Panel/Add-Remove Programs section and if each separate program is listed separately, then remove them individually.

Hope this helps.

Grif

- Collapse -
RE: Question
Mar 21, 2006 1:08AM PST

When I say the hard drive runs, what I mean is this:

As the machine sits there at idle (logged in, at the desktop, no foreground applications open) the hard drive light flashes continuously (on for 1 to 3 seconds, off for 1 to 5 seconds) yet arythimically. There doesn't seem to be a pattern.

With repeating processes at intervals, you can often see a pattern of disk access.

With applications running, the disk access is of course intermittent according to application requests.

I've got 50 other units in house running anything from 98 to XP Pro that don't act this way (none running XP Home or McAfee, though).

The McAfee version is:
Virus Scan 9.1
Firewall 6.1.6144
Spamkiller 6.1.07

Went an did an online scan at Panda yesterday and it came back with the following finds but was unable to clean:

Adware/Favoriteman
Application/Funweb (2 different files)
Adware/Statblaster
Spyware/Betterinet
Aware/Ist.Istbar (3 different files)
Adware/Wupd
Adware/Netpals
Adware/Adware program (wildapp.inf)
Virus:Trj/Downloader.cjx

I recognize some of these as having been discovered and cleaned by Ad-Aware, Spybot, or Ewido early on in the process. These could be remnants. Nothing else finds them when scanning in normal or safe mode.

I went back to rescan with Housecall for confirmation but couldn't get that one to go after the first scan.

The users who own this are not very computer savvy and I don't want to give this unit back infected. I'll admit that it's only a gut feeling that something's going on but it's not totally without cause. This machine was infected seven ways from Sunday when I got it and I just don't think it's clean.

Thanks again for your effort. I do appreciate it.

- Collapse -
Henry, Clean Out 'Quarantine' Folders
Mar 21, 2006 2:35AM PST

Many scanners will detect infected files that are stored on the computer in the various "Quarantine" folders for malware scanners such as "Ad-Aware", etc. Before running any other scans, make sure to remove ALL Quarantined files from the various scanners you've used. If the comp is clean, then is shouldn't find them again.

Next, did you do ALL of the procedures I mentioned in my previous post AT THIS LINK? One of the unnecessary services mentioned is one called "Indexing". Although you mentioned a different way of turning off "indexing", try disabling the actual service by clicking on Start-Run, type services.msc, then click on OK. When the "Services" window loads, scroll to and double click on the "Indexing Service" listing. When that loads, change the "Start Up" type to "manual" instead of "Automatic", then click on the "Stop" button. Click on "Apply", then OK. Now scroll back up to and double click on the "DNS Client" service listing and change it to "manual" also and "Stop" the service like before. Click on "Apply", then OK, then close the Services window.

There are other services that can be shut down as well but I'd recommend you follow the "Things To Do" link that I posted in the other response.

Hope this helps.

Grif

- Collapse -
Thanks everyone for all the suggestions....
Mar 23, 2006 6:26AM PST

Just to let everyone know that after following all the tips, I've finally written it off to paranoia. The drive still cycles like before, but no scanner finds anything and the machine seems to run fine. I guess I was just looking too hard. I just wanted to be sure it was clean.

But then, is it paranoia if they really are out to get you?

- Collapse -
(NT) (NT) No,its being realistic
Mar 23, 2006 7:48AM PST