Windows Legacy OS forum

General discussion

Runaway hard drive

by sknoof / January 12, 2010 12:03 AM PST

I'm usually pretty good at getting under the hood and solving odd problems, but this one has me bewildered.

The computer is an HP pavilion 763n. P4-2.4, 160GB primary (with second partition for pagefile) and 160GB secondary drive aliased to "My Documents." 2GB RAM, XP home sp3 updated religiously. Norton NIS also updated religiously.

About 2 weeks ago, I noticed the hard drive was audibly running virtually all the time. If I restart the computer, it runs normally for about six or seven minutes and then the HD starts running away with itself again, with NO CHANGE in the process table. Everything in the table looks completely normal. System Idle Process hovers near 99%. There's nothing unusual in "Scheduled Tasks." I disabled Windows Search. I disabled indexing. I turned Norton off. I checked manually for viruses, spyware, sevearl different ways with several different products. And the computer's speed and even HD access seem totally unaffected. This goes on and on, even when I am running no software at all. I kill all killable processes, one by one, and there's no change. Whatever is going on here, it seems totally invisible. I'm completely baffled.

And no, I've changed nothing. Installed no new software, done no reorganizing or repartitioning. (The pagefile has been in a separate partition for a couple of years now.)

??

Discussion is locked
You are posting a reply to: Runaway hard drive
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Runaway hard drive
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
second partition for pagefile can = hard working drive.
by R. Proffitt Forum moderator / January 12, 2010 12:45 AM PST
In reply to: Runaway hard drive

Here's the rub. Every time the page file is accessed that's one LONG seek to that partition. You can find tomes (web pages) about this.

But the most common reasons are forgotten motherboard drivers and the old XP DMA issue. We can't count on XP to report the DMA proper so we set it to PIO, OK it and then back to DMA and OK it. Repeat for all channels.

Another common item I see today is overlapping protections. Mix Spybot's Teatimer and Norton (there are some dozen combos like that) and the machine runs hard and slow.

What confuses the usual owners is "I didn't change a thing." But we still find the usuals at play.
Bob

Collapse -
runaway hard drive
by sknoof / January 12, 2010 12:55 AM PST

Yeah, I don't run TeaTimer for that very reason. And I'm doubting that it's the pagefile since this has never happened before. But I didn't think of the DMA/PIO thing, I'm going to investigate that. Thanks!

Collapse -
runaway hard drive
by sknoof / January 12, 2010 3:02 AM PST
In reply to: runaway hard drive

The DMA thing made no difference, I'm afraid. Nor did removing the pagefile partition.

It's utterly maddening that this thing is churning away so fiercely and I can't find any smoking gun.

Collapse -
Any indexing?
by R. Proffitt Forum moderator / January 12, 2010 3:57 AM PST
In reply to: runaway hard drive
Collapse -
runaway hard drive
by sknoof / January 12, 2010 5:22 AM PST
In reply to: Any indexing?

Nope -- I had already checked both of those -- sorry I neglected to mention it.

Collapse -
Still haven't figured this out...
by sknoof / January 16, 2010 7:49 AM PST
In reply to: runaway hard drive

More info: the churning hard drive does NOT stop churning, even for a second, when I restart the computer. But when I shut down fully and bring it back up, it takes about a minute or two to start churning (after the normal drive-access associated with bootup has finished.) Watching the task manager when the churning starts, I see no change.

Nothing in the Hijack This report looks out of the ordinary:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:43:25 PM, on 1/16/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet

Security\Engine\17.5.0.127\IPSBHO.DLL
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233586055593
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1233586343765
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -

http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 4627 bytes

Collapse -
3 things that could be it.
by R. Proffitt Forum moderator / January 16, 2010 8:12 AM PST
Collapse -
I thought I sounded smarter than...
by sknoof / January 16, 2010 11:09 AM PST

"...it can't possibly be a virus because I have Norton." Geez!

Well, I'm two thirds of the way ahead of you...I had already disabled snmp as well as all the Apple stuff. Removed the Apple stuff from the services table too. I haven't killed off the Norton yet, but that was my next step...

Collapse -
Glad to read that.
by R. Proffitt Forum moderator / January 16, 2010 11:24 AM PST

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

FALL TV PREMIERES

Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!