Every few seconds…kkkccsss…kkkccsss…kkksccss…XP keeps accessing my hard drive.
I’ve disabled the indexing service and turned off that ISPEC thing. I don’t think its a virus; I’ve run the GriSoft AV and the online Housecall AV. From monitoring the task manager it appears to be a combination of lsass.exe, csrss.exe and services.exe
I ran a hard drive monitor that logs all HD access:
52319 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 21504 Length: 4096
52320 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 25600 Length: 4096
52321 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 29696 Length: 8192
52322 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 37888 Length: 4096
52323 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 41984 Length: 8192
52324 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 50176 Length: 4096
52325 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 54272 Length: 4096
52326 2:54:54 AM System:4 IRP_MJ_WRITE C:\Documents and Settings\Patrick
tuser.dat.LOG SUCCESS Offset: 58368 Length: 4096
53262 2:55:04 AM System:4 IRP_MJ_WRITE* C:$Directory SUCCESS Offset: 0 Length: 4096
53263 2:55:04 AM System:4 IRP_MJ_WRITE* C:$Mft SUCCESS Offset: 0 Length: 4096
53264 2:55:04 AM System:4 IRP_MJ_WRITE* C:$Directory SUCCESS Offset: 0 Length: 4096
53265 2:55:04 AM System:4 IRP_MJ_WRITE* C:$BitMap SUCCESS Offset: 28672 Length: 4096
53266 2:55:04 AM System:4 IRP_MJ_WRITE* C:$BitMap SUCCESS Offset: 20480 Length: 4096
53267 2:55:07 AM System:4 IRP_MJ_WRITE* C:$LogFile SUCCESS Offset: 48590848 Length: 16384
53268 2:55:07 AM System:4 IRP_MJ_WRITE* C:$LogFile SUCCESS Offset: 12288 Length: 4096
This keeps happening over and over (well, not these exact commands, but similar ones). what are these “#files”? None of them exist, nor does that ntuser.dat.log…I’ve got a bunch of those files in various directories.
This is a symptom of the problem, not the problem. ntuser.dat is part of the Registry - the part that pertains to your user profile. ntuser.dat.log is a log of changes made so Windows can recover in case of disaster. Something is writing to your user profile like crazy. Adware? (www.lavasoftusa.com) Also try RegMon from www.sysinternals.com - it will show you what is writing to the Registry.
Darren is correct, but I have to add that the ntuser.dat file also keeps track of such mundane stuff as your desktop wallpaper, screensaver, password, desktop icons, blah, blah, blah.
Something is constantly modifying your user profile. Here are a couple WAGs:
If this is happening mostly while you are on the Internet, it might be constantly writing cookies to your profile. Disable or minimize the space that the cookies can use by going to Tools -> Internet Options.
Virus. Always a good scapegoat.
If this is happening in an application such as Word or Excel, then it might be automatically saving the changes to the document that you are working on.
XP has a service called System Restore. Start -> Programs -> Accessories -> System Tools -> System Restore. It makes periodic backups of your system information, so that your computer can be restored if there is a major problem. There you can set the time distances between each such backup. Maybe this time setting is extremely short, for some reason.
I would not recommend shutting down the services that you mentioned, especially IPSEC. These are integral to the stability and security of your system.
Check things out with AdAware and Spygot Search and Destroy to make sure you don’t have any usage checkers running. Do a good virus check (if you don’t have software installed, TrendMicro has a product called HouseCall that is free which does an online virus check). AFAIK nothing should be constantly writing to your Registry.
The problem is caused by OfficeXP’s “Indexing Service”
which tries to index your entire harddrive to make searching faster.
Open any Office XP application (Word, Excel, etc) then go to File>Search
This opens the search “pane” in the window. Below “Other Search Options” click on the link which says “Search Options…” (in blue, by default).
This opens the “Indexing Service Settings” dialogue box.
Click to bullet “No, do not enable Indexing Service.”
Then, bask in the silence of your hard disk drive NOT running all the time.
Since this seems to be related to your userid, what happens if you create a whole new userid under XP and log on with that?
Is there any way in your file monitor to see what is being written?
Lastly, that CLSID that keeps showing up - {53f5630d-b6bf-11d0-94f2-00a0c91efb8b} - seems to be Windows’s identifier for storage volumes like hard drives and CDs. Search for the CLSID (without the curly braces) on Google and newsgroups - it gets mentioned a few times (including on microsoft.com). I don’t know why something keeps accessing it though.