Why is my disk light blinking...constantly? 1

[jsteph]

Hi all,
My HD light pulses at a rate of just over 1 blink per second.

I have turned off all anti-spyware, anti-virus, etc, I've closed all windows. I've gone into systray and taken out the usual junk like quick-time update checks, realplayer checks, iTuneshelper--all of that junk.

This machine is on a home peer network, and I've un-shared my drives, I even unplugged the network cable in case any other machine was even attempting to read my disks.

I look in Task Manager, and and the only thing using cpu is the usual system idle process. I have the I/O read and write columns showing, and nothing is incrementing--By all diagnosis, nothing whatsoever is running.

This is something I would have noticed if it had alwasy been happening, so I'm fairly certain it's a recent development.

Does anyone have any idea what this may be?
Thanks for any help,
--Jim

 

[Glenn9999]

Probably some kind of file access. I understand if you have the newer version of Process Explorer it should do this for you, but if you don't, you can try out Filemon and see what kind of files are being accessed (that's invariably why the light is blinking, probably), and then go from there on solving it.

 

[stduc]

XP and Visa both "scribble" to disk all the time. For some reason taskmanager shows this activity as I/O Other!

Explorer, System and Taskmanager do a lot of I/O all the time. SVCHost produced regular bursts as well.

If you really want to see what is going on try using Perfmon - the performance monitor and add I/O traces.

[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[jsteph]

I have perfmon somewhere here...I'll have a look. Thanks!

I know I used to see the occasional blip every now and then when everything was idle, but it's just this is so constant and so perfectly pulsed that it's seems different than random scribbling.
--Jim

 

[gbaughma]

Keeping in mind that when the system is idle, stuff like indexing the drives will happen, if you're running google desktop it will index files... if you have RSS feeds those will be happening.... lots of things going on "Behind the scenes"



Just my 2¢
-Cole's Law: Shredded cabbage

--Greg

http://parallel.tzo.com

 

[jsteph]

Greg,
I think you may have hit it with the indexing service. As a rule, I always have that off. But I'd just added a new drive and apparently Windows sets indexing by default, because it was on. I don't know about the light yet, I've remoted-in to my machine and turned indexing off that drive, so I'll see tonight if the blinking is gone.

I'm assuming the MS hides whichever process that does the indexing, becuase there was still nothing incrementing in the i/o read/write columns, and nothing taking up cpu.
--Jim

 

[jsteph]

Well it's not the indexing service.

I got down to where I'd stopped almost every process in Process Explorer that would let me kill it, and the light still blips. One of the processes that couldn't be stopped is wscntfy.exe--the Windows security center. Not sure if that's it...but again this is a relatively new phenomenon and wscntfy has always been there.

Filemon show no activity at all after I shut everything down.

I guess I'll just let it go but it just seems like an odd thing that the disk is constantly being accessed.
--Jim

 

[Glenn9999]

You sure you don't have a rootkit? You might try throwing a rootkit scanner at the system like RootkitRevealer or AVG Anti-Rootkit (or numerous others I'm sure).

 

[jsteph]

Glenn,
I ran the rootkitrevealer tool (I think it's from Sysinternals) and it came up with a few clsid entries that it said had an embedded null.

When I went to the registry and found those clsids, I couldn't open the key, I got the error "Error opening key". I couldn't delete the key, rename it, or look at it. Does this sound like a corrupted registry or something more sinister?
Thanks,
--Jim

 

[MicroZealous]

Is Windows Defender also a suspect? Before I Disabled this Service, the disk was manic for about ten minutes after startup.
This Just In: Soon after disabling Defender, my machine caught MalWareAlarm. Coincidence.... or Satan?
Those &%$#@*() !
Defender service now starts automatically, and I get up 10 minutes earlier every day . . .

 

[stduc]

I just had another thought. You do have write behind, or write disk caching enabled? Don't you? If you don't then every little write will make the disk light come on.

[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[jsteph]

I've never had Windows Defender (at least that I know of). And my SATA drives are set for 'optimize for performance', which entails write-caching, the IDE drives have the 'enable write caching' checked.

I'm still baffled.

I've been doing this so much that I have a Favorites entry in the registry for the HKLM\...\Run key to make sure nothing pops in there that I don't know about. I also had temporarily disabled so many services while doing this that I started getting Event log errors due to dependancies. But all along, the blip continued at it's perfect pace without a hitch. And I know the disk light works because it does light up when I open a program or file, as it normally would, but once that activity dies down, it's back to the blip...blip...blip.
--Jim
--Jim

 

[Freestone]

Big guess here - any sort of SMART utility running, be it in Windows or BIOS? And, by the way, I had this exact symptom on a system a few years ago, but never pursued it.

 

[linney]

When I went to the registry and found those clsids, I couldn't open the key"

Did you look at the Access Permissions on the Registry Key, were you logged in as an Administrator?

Do you see the same activity from Safe Mode, or from Normal Mode but as another user? What about if you load the Recovery Console, or boot to a Startup Floppy, does it still flash?

Perhaps all you can do is make sure machine is clean of all malware and then forget about the flashing. When did you first notice it anyway?

 

[jsteph]

linney,
I had run regedt32 and was logged on as admin. I made sure the key and it's subkeys inherited full control and were owned by admin. I could only do this from the parent key, because going to the security tab on the subkey (Inproc32) showed a blank tab, I assume because of the same error.

I noticed this a few weeks ago, and the only recent change I recall is my replacing a failed sata drive. For all I know, the seagate sata drive might have it's own stuff going on to cause this.

I'll try safe mode and see what happens there.
--Jim

 

[linney]

What is the Registry location (Full Key address) that does not have a Security Tab or Access, we can check that out for you on our machines (if we have it)?

While your at it you could also post a "Hijack This" log for others to look at and comment on.

 

[stduc]

Is there a CDROM or DVD drive on the same channel? In which case I would suspect the activity may be Windows checking to see if a disk has been inserted.

You could turn of autorun to see in the registry?

Select "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CdRom"
Double click on "Autorun"
Change the value from "1" to "0"

 

[jsteph]

This is one of the keys (in HKCR\CLSID)
{47629D4B-2AD3-4e50-B716-A66C15C63153}
...with a single inaccessible subkey of InProcServer32

There are a few other CLSID's that showed up in the Rootkitrevealer with embedded nulls, all of which exhibit the same error behavior.

There was also a Microsoft reg key that showed up as something like "Inconsistent with windows API", and the key was some MS Cryptographic services key. I assume this is an MS thing, but it could also be a problem. However I do remember seeing a similar API inconsistnecy error a couple years ago when the Sony/BMG rootkit issue had first hit the fan and I ran that tool back then.

The CD/DVD was something I'd thought of, but during diagnosing I had disconnected the cable and turned of the sata channel that the dvd was on. However, I'm not sure if the autorun regkey for cdservices still attempts to check even without a device at all--it may well do that--just assume there is always a device and check for it--so I will disable that autorun key and see what happens,
--Jim

 

[linney]

That key brings up lots of hits on Google, so you are not alone in having access problems with it.

http://www.google.com/search?q={47629D4B-2AD3-4e50-B716-A66C15C63153}&rls=com.microsoft

 

[jsteph]

stduc,
That was it! The CDROM Auto was set to 1, which appears to be default and won't normally cause this problem of blinking, but I think the issue was that my DVD was (literally) on the blink--I'd noticed in the last few weeks that when I'd burn a dvd the write-speed dropdown box only allowed 2x or 4x, and it used to allow up to 32x. It also took very long to read anything from the drive--CD or DVD. So I think the autorun was just always trying to detect something and was having trouble reading.

Then when I totally disconnected the sata cable from the DVD drive, Autorun was apparently still always trying in vain.

An interesting note, at the same time I changed the Autorun key, I'd also removed another HKLM\..\Run item--the KernelFaultCheck which which popped a lightbulb in my head because it is supposedly always writing memory dumps in case of a crash.

So when I restarted (I know I broke the law of diagnosis--to only change one thing at a time--but restarting was getting tiresome) the blipping stopped. I was so sure it was the KernelFaultCheck that I reset the Autorun to 1 and restarted for what I thought would be the last time--and the blipping was back. So it was indeed the Autorun key that was the culprit.

Thanks everyone for all your help and ideas,
--Jim