Constant HD Activity ???

[Texun]

Personal File Server Specs:

Shuttle AN35N, XP1800m 512PC3200, 2 WDJB's, 1 Seagate, DVDR and DVD all on Windows 2000 Pro with updates.

I have constant HD activity on one of the WD's which is also my boot drive. I mean it runs non stop. I've checked the Task Manager and the CPU is 98% idle and remote administrator is 2%. RA is super small and doesn't run the HD once loaded, at least it never has before. I've checked inbound and outbound traffic and when idle it's usually 5-6k which is the overhead for Remote Admin.

I've done a full virus and spyware scan and it comes up clean. Also downloaded an app called Security Task Manager to check for suspicious activity. Nothing out of the ordinary shows up there either.

I need something to report what is actually accessing the HD. Does anyone know of a monitoring tool that will do this and report the source? I found a tool to monitor HD activity but it's nothing more than an idiot light for the systray.

Thanks in advance.

 

[DarkAmeba]

If you just put it together, check to see if your front panel IDE light connector is connected correctly. If it's reversed, the light might stay on constantly.

 

[w0ss]

If you find anything let me know. I had the same issue lastnight my machine was slowwww and the HDD light was constantly flashing. CPU was 1-5% utilization so nothing should be making it that slow. It cleared up on it's own but I woulda liked to know what it was doing.

 

[Corpun]

Are you using office '97 by any chance? 'Find fast' which is installed with office '97 and a useless lil pice of sh!t can make the HD run constantly

Hmm, just checked again and looks like it gets installed with office 2k as well.

Windows help page for killin it

 

[GoSharks]

in drive properties, uncheck "allow indexing service to index this drive for fast searching"

 

[mechBgon]

Recommendations:

ZoneAlarm
Microsoft Baseline Security Analyzer
The Symantec security scan in my signature (port check) before installing ZoneAlarm, to see if the system's visible to the Internet

All those and more here

 

[Jiggz]

Is it just the red hdd light being on everytime or you can actually hear the hdd head reading and writing? From the symptoms you mentioned in the Task Manager, there seems to be no activity except for the RA at 2%. So it must just be the red hdd light being on everytime. If this is the case, then the hdd cable is reverse in connection. If there is actual reading and writing in the hdd, then disconnect the nic ethernet cable just to see if the activity stops. If it stops, then somebody could be accessing your hdd remotely. If it doesn't stop then let it ran until it stops with the nic cable disconnected. After it stops, then reconnect the nic cable and see if it'll do it again.

 

[Texun]

Thanks. I'll give those suggestions a shot.

I don't think it's a trojan or a backdoor hack. The first thing I did was pull the Ethernet and the HD access continued. I thought it was indexing or find fast, and I am almost 100% positive that I have those disabled but will check again. It's not the HD light. I can hear constant random chatter from the drive like defrag or file transfers. I don't have any scheduling enabled other than the virus scanner and I don't think that's it either, it runs for hours and hours non-stop.

I'll let you know what I find. Thanks again.

 

[Perplx]

In the task manager view>select columns, check off "I/O Write Bytes" and "I/O Read Bytes" it should be obvious if any process is using the hard drive alot.

 

[Jiggz]

I've seen this on one of the laptop brought to me last night. And come to find out it was the TMK Trojan Virus. Norton did not detect the virus but when we did the McAfee house call scan, and Trend Micro online scan, it showed the virus. You might want to try this also.

 

[Texun]

I scanned all drives with Housecall and it found one Hybris-B worm in 250 gigs worth of files. AVG never picked up on it so I don't know if it was a false positive or not. I deleted the file anyway.

I also ran Mech's link to the Semantic security page and it came back tight.... no holes at all.

It's getting late here so I'll check it again later. It may be my imagination but it seems less tonight than before. Thanks everyone for the help!!!!!! I've got a few more suggestions that I will try later.

It is appreciated.

 

[flexy]

any virus scanner installed ?avg ???? i had something yesterday wondering whats going on on my notebook.
For some unknown reason AVG did a complete virus scan thru the HD.

 

[Texun]

Originally posted by: flexy
any virus scanner installed ?avg ???? i had something yesterday wondering whats going on on my notebook.

For some unknown reason AVG did a complete virus scan thru the HD.

Yep.... I've been using AVG for a long time. I used to use Norton SysWorks but the last one was so buggy that I removed it and never looked back. AVG has worked well enough so far and I haven't missed Norton a bit.

Are you sure it wasn't scheduled to do that? It may sound like a dumb question but I've turned that feature off only to find it back on again after an update. Not all the time but it has happened.