Hdd constantly being accessed

Kakarot · Post by **Kakarot** » Fri May 10, 2002 3:09 pm

Here's the system specs:

Intel 820 motherboard
p3 667
384mb RDRAM
Viper V550
IBM 30gb hdd
Mitsumi 32x cdrom
above hooked to primary ide
Plextor 12x10x32 burner(ide)
LS120
above hooked to secondary ide
SB Live
Intel Pro/100+ Management adapter
Maxtor UATA 100 PCI adapter w/13gb IBM hdd attached to it
Windows 2000 Pro w/SP2 and all applicable updates

Whats happening is the hard drive is constantly being accessed(the main 30gb one). I loaded up performance monitor and found it to be the CSRSS.EXE process that was accessing the hdd all the time. This is a windows component that can't be shut down, client server something or another if I remember correctly. But I can't figure out why its doing it. It even does it in safe mode when there are no other programs loaded or running. I've updated drivers for everything in the computer to the latest ones available, including the Intel motherboard. I've updated the bios(VC820 motherboard) to the latest revision. And the computer seems to be running perfectly fine and stable other than this annoyance. Anyone have any ideas as to what could be causing this? Any help is definately appreciated.

Post by **FlyingPenguin** » Fri May 10, 2002 4:19 pm

You sure there's no virus or adware running? Client Server sounds like it's part of the file server system so it might be a background app trying to send files over the network.

It might also be another background app causing your problem, but using that service to do it's work.

Here's a screen shot of task manager showing what's running on a clean install of Win2K. These are the ONLY processes required (of course you may have others for scanners, printers, anti-virus apps, etc. but these are all you need to run Win2k).

Anything running on yours you can't identify I'd shut it down and see if it stops the drive access.

Hope this helps...

Jim Z · Post by **Jim Z** » Sat May 11, 2002 1:39 am

Anything running on yours you can't identify I'd shut it down and see if it stops the drive access.

well, he says it's CSRSS, which is a critical system process. Even if you could kill it, you'd just BSOD.

is there anything like drive indexing running?

any possibility of a virus? I only ask because of this about nimda:

The worm finds vulnerable Internet Servers via randomly selected IP addresses. The address generation and scanning is performed by the process named csrss.exe (the file csrss.exe is overwritten by the worm with its own copy). Users of affected Win NT/2000 systems may experience a significant deterioration of their system performance when the csrss.exe process is running. Additionally the worm copies itself as Httpodbc.dll to the root directories of all accessible drives (the worm marks Httpodbc.dll as a true DLL).

http://www3.ca.com/solutions/collateral ... 65&ID=1133

more reading material:

http://searchsystemsmanagement.techtarg ... 75,00.html

Post by **FlyingPenguin** » Sat May 11, 2002 6:11 am

You misunderstood. I did not imply disabling CSRSS - I know it's a required service.

I'm saying that there might be another background process running that's ACTUALLY causing the problem, but that CSRSS is being used to perform the access.

I'm suggesting he stop (NOT DISABLE) any process that is NOT on the list I gave him that he can't identify and see if it stops the drive access.

Kakarot · Post by **Kakarot** » Sat May 11, 2002 9:42 am

I'll check out the virus route to see if that leads anywhere. Thanks for the suggestion.

I'm not sure its a backround app doing it only because it happens in safe mode also(when there is barely any processes listed there). Although that doesn't mean that isn't the case.

One thing that just came to mind is a couple of times I was shutting the machine down the end program box came up for about a second and it said "should not see me" on the blue bar across the top of the dialog box. But it ended itself pretty quickly and let the machine shut down.

nexus_7 · Post by **nexus_7** » Sat May 11, 2002 9:51 am

Please Look Elsewhere! I always love those messages when my PC is shutting down...Hay, anyword on that monitor?

Hope you bought your Mdays card...Remember last year

Peace

Greg

PreDatoR · Post by **PreDatoR** » Sat May 11, 2002 10:31 am

Kak i've seen that before on my computer with XP and the womans computer with Win2k... Haven't figured out what it is but don't have any probs over here...

Post by **FlyingPenguin** » Sat May 11, 2002 10:50 am

Run Adaware and a virus checker on it. Play safe. That new Klez virus caused a LOT of background disk access on the one system I found it on. It apparently goes through all your exe files and infects them in the background.

Free online virus checker here: http://housecall.antivirus.com/

Be aware that the Klez worm will prevent you from running most virus scanners (don't think it'll affect the onlien one above since it runs in java but not sure).

One sure way to tell if you have it is to see if there's an entry in the registry startup called WINKxx.EXE (the xx part is two randomly generated letters). That's the virus, although just deleting the EXE will NOT eliminate it since it infects all your EXE files as well.

Since finding the startup registry entries in Win2K is a pain without MSCONFIG try this neat app: http://www.mlin.net/StartupCPL.shtml