Computer Support Forum

lsass.exe and csrss.exe causing constant hard drive usage

Question: lsass.exe and csrss.exe causing constant hard drive usage

Hello. I've got a very strange problem on my hands here. I recently upgraded my case and to go with my new case I got a SATA Sony DRU-190S DVD-writer to replace my IDE writer. After completing the transfer to my new case I noticed that my hard drive light was flickering every second. It was pretty noticable as the Antec 900 HD light is very bright.Upon investigating further I noticed that lsass.exe and csrss.exe were constantly producing many I/O reads and writes to the hard drive. After googling lsass.exe and csrss.exe I discovered that these two processes have caused other Windows users to experience the same problem, but every cause seems different e.g. A virus, CPU utilization issue, corrupt profile etc. and I couldn't find one that matched mine.I managed to find a thread that mentioned a Microsoft service called Terminal Service, which I disabled, and that seemed to tame lsass.exe. The problem is csrss.exe remains and is reading the hard drive many times an hour causing the hard drive to flicker every second.I found a thread that told me to use Disk Monitor and Process Monitor together to try and capture what exactly is accessing the hard drive. Unfortunately I couldn't get Process Monitor to work it just came up with an error 'unable to allocate memory with a block size 4000', I tried googling that error but found nothing that could fix Process Monitor. I tried using filemon and process explorer, but its not really giving me the information that I need and I don't really know how to use them properly.I've used KAV7, Ccleaner, Spybot, Ad-aware, Spyware Terminator - All came back clean. I even cleaned out my nvidia drivers and reinstalled them - still the same. Unfortunately the solution seems to evade those that it afflicts and a fix is usually never found according to the threads I've read.I'm going to try and disconnect the SATA optical drive and try my old IDE optical drive. The reason is someone on CD Freaks forum had the exact same problem as me about a year ago. Installed a Sony Optiarc SATA Optical drive and this problem started to affect him in the same way as it is affecting me now.In the end he couldn't find the problem so I'm not too happy at this moment.So I'm still stuck as to what to do next. I'm going to try and repair my XP installation, failing that I will try a clean installation using first my SATA writer and then if that fails revert back to my IDE writer and see if that makes a difference.I'm on windows XP SP3.Has anyone suffered anything similar?

Relevance 100%
Preferred Solution: lsass.exe and csrss.exe causing constant hard drive usage

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: lsass.exe and csrss.exe causing constant hard drive usage

Quote from: Man_With_Beard on July 12, 2008, 05:08:33 AMHello. I've got a very strange problem on my hands here. I recently upgraded my case and to go with my new case I got a SATA Sony DRU-190S DVD-writer to replace my IDE writer. After completing the transfer to my new case I noticed that my hard drive light was flickering every second. It was pretty noticable as the Antec 900 HD light is very bright.Did you have this problem in your 'old case?'I'm a literal reader! Does this mean that the only hardware change was the external case and the Sony DVD, i.e., you put the old motherboard, video, harddrive, etc, into the new case? What about power supply?Is this computer on a network?Does the computer exhibit any 'problems' - slowness, etc.Have you tried to create a new user profile per the MS article that you referenced? (http://support.microsoft.com/kb/555021)Have you verified that the only copies of the two files are in C:\Windows\System32?The more info that we have the better chance of finding a solution.

2 more replies
Relevance 88.97%

Not the virus one!

If I open up task manager and enable the I/O columns, this Lsass.exe keeps reading and writing onto my hard drive. What's causing this and is it normal? I have Windows xp SP2. I'm always been checking for viruses and spyware, so i'm positive some windows service is writing some logs or doing something! Am I the only one?!
 

Answer:Lsass.exe constant hard drive activity!

I had a similar problem on a laptop at work. The user was having the internet sessions hang; seemingly going no where. Then the machine would get really slow for everything.

Take a closer look through the Task Manager Processes to see if you can find a Webassist. If you see it running after you've connected to the internet this may be what is happening.

The real problem for the machine referrenced above was Webassist which would start chewing up CPU time any time IE (internet) was started. You can end Webassist and Lsass will continue to chew away at the CPU time. Webassist is some spyware. You can run SpyBot (its freeware) and it may correct the problem. I finally just rebooted the machine, immediately went to webassist and renamed it something else. Poof, problem gone. There doesn't seem to be any issues without Webassist enabled and this user/machine doesn't need it for any programming, etc.
 

2 more replies
Relevance 78.72%

So I have performed a complete wipe of the laptop, formatted it, did a clean install of Vista Business. Installed all the drivers, added all the hotfixes, Windows Updates, etc. I then stopped all non-essential startup items, so that only these startup: Services:AD Monitor [fingeprint related service]AuthenTec Fingerprint Service [fingeprint related service]Data Transfer Service [fingeprint related service]ThinkPad PM ServicesInstallDriver Table ManagerOn Screen Display Applications:TPHOTKEYTpShocks Why is it, my hard drive accessing light constantly blinks. I've left my computer on for a few hours, come back, and it still blinks once a second. Why is the hard drive being accessed so much? Is it a specific driver? I could only assume that's got to be some wear on the ball bearings, I never had this problem with my T60.





_______________________________________________________T400 6474-11U, Vista Business 32-bit, Core2 Duo P8400, 4GB DDR3, 160GB HD

Answer:[T400] Constant Hard Drive Light Usage

Hi number65, I could only assume that's got to be some wear on the ball bearings:-) Most hard drives have now switched to fluid bearings for the disk spindle. I don't know what sort of bearing the actuator head pivot has, I assume simple sleeve bearing? In any case, the hard drive activity is unlikely to prematurely wear out your drive. Unless you're noticing user interface slowness or battery drain or bothersome noise caused by the hard drive activity, you can safely ignore it. On the other hand, if you want to track down what's causing the hard drive accesses, some of the tools from Sysinternals may help. In particular:AutorunsProcess ExplorerProcess Monitor   





---------Results of Your Ideal Business-Class Laptop survey, concluded 2009-07-29.Did someone help you?Say thanks! with a kudo.Even better: Pay it forward, help someone else.

4 more replies
Relevance 72.98%

For the past month I've had disk usage spikles that cause my to lag and stutter in short bursts that interrupt games, music, and youtube videos. It first begaiin with my Mushkin ssd 120gb which I attributed to be the problem so i swapped it out for my current Sandisk 128gb ssd which seemed to fix the problem for about 3 days. Now its back and not as bad as it was with my first ssd but I'm still getting the 100% usage spikes and stutter. I used the SF tool and will attach some screenshots as well. Thanks in advance. This is super frustrating since its my first custom build and was hoping for better performance. I'm on a intel i7 4790k, windows 7 home premuim 64 bit, boot disk is 128gb Sandisk ssd, and 1tb westage hdd.

Answer:Constant disk usage spikes causing lag and annoying stutter.

How much free space you have in C?

Download and run trimcheck-0.7 Index of /trimcheck, follow the directions and verify TRIM is enabled.

5 more replies
Relevance 68.88%

Hi guys
Just looked at running processes and lsass and csrss are running.
I've searched the net and come up with conflicting info so I've done a hijackthis scan.
The results are below...PLEASE have a look and help me if I need it!
Thanks in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:01, on 22/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodata Limited

Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT

Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common

Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Common Files\Teleca

Shared\Generic.exe
C:\WINDOWS\System3... Read more

Answer:lsass & csrss help!

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

I apologize for the delay in responding, but as you can probably see the forums are quite busy
and sometimes a post manages to slip by us.
Unfortunately there are far more people needing help than there are helpers.

If you still require help please post a fresh Hijack This log to this thread.
I will be notified and I will get back to you ASAP.

Please include a description of your current problem/s

Please make sure Wordwrap is unchecked when you use notepad ( click "Format" )

1 more replies
Relevance 68.88%

okay, so...

Around late April, my sister's and I's computer started having some start up troubles. it was running WAY slow, and then stopped starting up. We took it to the shop, which did nothing, and wound up fixing it ourselves with our PC Recovery mode that came with the cpu. (Compaqs are cool like that.) All our old files and such were saved and we were rather happy.

BUT...

My sister needed to get a movie for a school project, and she thought she found a legit download site for it. She downloaded the movie, and wound up putting a virus on our computer. ( sysguard.exe ) We've had this virus before, about a year ago, and she knew how to get rid of it with Norton, Spybot, and Clamwin, as did I. But None of those are working anymore. We've uninstalled, and reinstalled them, but still they do not work.

So at the moment we've just been ending their processes from task manager. But I can't get rid of lsass.exe or csrss.exe. I've found them, tried to delete them and remove them, but they wont go away. I know they are torjans, but I'm not sure if all the dumb pop ups that keep plagueing me are from sysguard.exe (spyware protect 2009, the dumbest virus ever that I can't get rid of cause our programs aren't working.) or from the two trojans.

HELP!

Answer:lsass.exe and csrss.exe help

Hello -

Depending on location, lsass.exe and csrss.exe are generally legit, core Windows files and should be left alone if in System32

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

1 more replies
Relevance 68.88%

how do i identify if it is a virus

Answer:csrss.exe and lsass.exe

These are both critical system files. Windows cannot run without them.Do have some reason to suspect they are viruses?

7 more replies
Relevance 68.88%

MBAM found what it said was a trojan a couple of weeks ago and said it quarantined and deleted it.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS (Malware.Trace) -> Quarantined and deleted successfully.

I wrote here and asked if it was a problem, but got no answer. It showed nothing on a scan after or today. Today my game was running slow so I checked the Task manager and found CSRSS.EXE and LSASS.EXE. Googled them, they are a trojan or trojans. Microsoft says of the first that I need to delete my profile from another account... I have not idea how to do that.

Answer:CSRSS.EXE and LSASS.EXE

csrss.exe is the user-mode portion of the Win32 subsystem (Win32.sys is the kernel-mode portion) and the main executable for the Microsoft Client/Server Runtime Server Subsystem. It is responsible for managing most graphical commands in Windows, console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. This process is important for stable and secure operation of your system and should not be terminated. Determining whether csrss.exe is malware or a legitimate Windows process depends on the location (path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file. However, it then places itself in a different location (folder) than where the legitimate file resides and runs from there. The legit csrss.exe file is located in the C:\Windows\System32 folder. If found running from a different location, it's usually indicative of malware.lsass.exe is the Local Security Authentication Server which verifies the validity of user logons to your computer and generates the process responsible for authenticating users for the Winlogon service. The lsass.exe process receives authentication requests from WINLOGON and calls the appropriate authentication package (implemented as a DLL) to perform the actual verification, such as checking whether a password matches what is stored in the SAM (the part of the registry that contains the definition of the users and groups)... Read more

1 more replies
Relevance 68.06%

For a while now, some of my games have been going real slow for some odd reason. If I restart the computer, everything works perfectly fine... but I'm not really sure what I do (if it is me), but eventually some programs or my games will begin to run... sluggishly, I guess. The music (on some games) will be fine, but the characters will look like they are running under water or something.

I thought maybe there was an error or something in one of the Processes in Task Manager, so I went looking through them all. I put most of them in a google-search, to see what each one of them did and such.

Two caught my eye though, because the search results said they were listed as Trojans.

-lsass.exe
-csrss.exe

I didn't want to "End Process" though, because some of the other results said they were a windows process... and I know what happens if you close out an important windows process (BSOD city I believe). Plus, my virus scanner (AVG8) doesn't detect them as viruses... or really detects any viruses at all.

Any suggestions? I could post the entire list in my Task Manager if necessary, or am I just stuck with having to restart the computer in order to get these things to work? If it is too big of a problem, I'm not going to worry about it, since once my friend sends me this portable hard drive, I plan to wipe this computer clean and give it a fresh re-installed XP.

Thanks ^_^
 

Answer:Solved: Can anyone tell me about lsass.exe and/or csrss.exe?

8 more replies
Relevance 68.06%

I did a checkup with ProcessLibrary.com and discovered several unwanted processes running on my computer. I followed the MajorGeeks.com seven steps before posting, and these are the processes still running after a fresh reboot:

csrss.exe (Trojan.W32.Rontokbro)
lsass.exe (Trojan.W32.Windang, Trojan.W32.Spybot & backdoor.W32.ratsou)
rundll32.exe (Backdoor.W32.Ranky)
services.exe (Trojan.W32.Sober)
smss.exe (trojan.w32.Sufiage)
spoolsv.exe (Backdoor.Ciadoor.B/Iambigbrother spyware)
svchost.exe (Trojan.W32.Neshuta)
winlogon.exe (Trojan.W32.Rontokbro)

I'm running an AMD Athlon 64 Processor 4000+, 1.0GB RAM, NVIDIA GeForce 6800 GT

There are no major side effects, although I've noticed an overall lag when using the computer for Photoshop and Windows Media when there was no lag before. Occasionally the cpu usage jumps to 100% and sits there for a while when no programs are running, though I can't figure out the pattern for when this happens.

A hijackthis log is attached, along with the bdscan.txt and Activescan.txt reports. Thanks in advance for your help!
 

Answer:csrss, lsass, winlogon, etc...

zackisaiah said:



I did a checkup with ProcessLibrary.com and discovered several unwanted processes running on my computer.Click to expand...

You are misreading the information on those pages. You do not have any of those malware problems. All those processes can be either good or bad. It depends on where they are running from. If they are in the system32 folder (where yours are), they are valid Windows processes.

Based on your logs, you have no malware issues.
 

3 more replies
Relevance 68.06%

I was going down the Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help page and when I opened the 'gmer' file , I got the dreaded BLUE SCREEN OF DEATH screen, with a warning and told me it was doing a physical memory dump. What shoud I do now? Please and THANK YOU!!
DDS (Ver_10-12-12.02) - NTFSx86
Run by Mike at 21:49:51.85 on Sun 12/26/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1025 [GMT -6:00]

AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Immunet Protect *Enabled/Updated* {F1220F1F-7E2E-48CD-846D-B98C6F85CD37}
AV: Microsoft Security Essentials *Enabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: AVG Firewall *Disabled*

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
svchost.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Pro... Read more

Answer:lsass.exe, csrss.exe, smss.exe

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructions that pop up for posting... Read more

2 more replies
Relevance 68.06%

Hi,

I have a laptop, IBM T40 running Windows XP Pro.

It is mainly used for internet surfing and on-line shopping.

When I received it, it had virus/maleware type error pop ups and the internet browsers could not locate any pages even though I was showing fully connected.

I have updated and ran AVG free 8.0, Malewarebytes, Ad-Aware, Dr. Curit, and Winsock fix. I have ran all but Winsock more than one time. This cleaned numerous other things off that were found and fixed the internet connection problem, but I am stuck with these last two virus which can be see in task manager.

A google search turned up that csrss.exe could be Trojan.32.Beagle or others with a similar name. Lsass.exe was said to be part of Trojan.W32.Downloader.

After removing these, will the computer be cleaned and secure enough for continued online shopping use?

Please suggest the next course of action.

Thanks,
Doug

Answer:Need help removing csrss.exe and lsass.exe.

Hello db,I apologise for the delay, the forum is extremely busy.Unfortunately there are a lot of people waiting for help, and we are doing our best.----------------------------------------------I will be assisting you with your malware issues.Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.Continue to respond to this thread until I give you the All Clean! If you have any question or you're stuck in there please reply it to me. I will try my best to help you!Please bookmark or favourite this page. In case you need it as reference or etc.If you fail to reply in 5 days period from now, this thread will close, and you will have to open another topic, and wait for another helper.----------------------------------------------A google search turned up that csrss.exe could be Trojan.32.Beagle or others with a similar name. Lsass.exe was said to be part of Trojan.W32.Downloader.After removing these, will the computer be cleaned and secure enough for continued online shopping use?I can't really tell unless i see some reports. It those infections are backdoors, it would be better to Reformat this pc, since it's used for online shopping.----------------------------------------------Download and Run HijackThis Download HJTInstall.exe to your Desktop. Doubleclick HJTInstall.exe to install it. By default it will install to C:\Program Files\Trend Micro\HijackThis . Click on Install. It will create... Read more

2 more replies
Relevance 67.24%

Hi,

I have Vista with Avast Antivirus.

CSRSS. LSASS are melting the hard drive along with several svchost subtasks.

To the point it takes about 45 minutes post a boot to be able to use the machine. Dual core, and hard to do anything.

Avast is in there doing IOs too.

I have done my best to shut down somethings like Windows Defender, and de-installed some software.

Suggestions welcomed.

The following is a Hijack log:

d

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:04:56 AM, on 9/25/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\ico.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\Windows\System32\FSRremoS.EXE
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\Pelmiced.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Pr... Read more

Answer:CSRSS LSASS IO MASS, Lockout for use

Sysinfo:
Tech Support Guy System Info Utility version 1.0.0.1
OS Version: Microsoft® Windows Vista™ Home Premium , Service Pack 2, 32 bit
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+, x64 Family 15 Model 75 Stepping 2
Processor Count: 2
RAM: 957 Mb
Graphics Card: NVIDIA GeForce 6100, 64 Mb
Hard Drives: C: Total - 231233 MB, Free - 61187 MB;
Motherboard: LENOVO, LENOVO
Antivirus: avast! Antivirus, Updated and Enabled
 

1 more replies
Relevance 67.24%

Everyday my antivius finds these files in the C:\Windows directory. I suspect something is running on my sytem that is causing them to be downloaded, but I can't figure out what. I've ran Sophos, Malwarebytes and Adaware, but none of them seem to find anything else. Any help would be appreciated.

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
Run by Administrator at 10:30:23 on 2011-07-08
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2056 [GMT -7:00]
.
AV: Sophos Anti-Virus *Enabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k H... Read more

Answer:lsass.exe and csrss.exe files being dropped

Hello and welcome to Bleeping Computer.My name is km2357 and I will be helping you to remove any infection(s) that you may have.I will be giving you a series of instructions that need to be followed in the order in which I give them to you.If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.Please do not start another thread or topic, I will assist you at this thread until we solve your problems.Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:Step # 1 Download and run DDSDownload DDS and save it to your desktop from here or here or hereDisable any script blocker, and then double click dds.scr to run the tool. When done, DDS will open two (2) logs: DDS.txt Attach.txtSave both reports to your desktop. Post them back to your topic.Step # 2: Download and Run GmerPlease download gmer.zip from Gmer and save it to your desktop.***Please close any open programs ***Double-click gmer.exe. The program will begin to run.**Caution**These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security AnalystIf possible rootkit activity is found, you will be asked if you would like to perform a full scan. Cli... Read more

5 more replies
Relevance 66.42%

After startup my Dell Dimension running XP now spends lots of time grinding the hard disk. Not sure when it started, unfortunately.

Windows task manager clearly shows that LSASS is the main I/O producer when nothing else happens, with CSRSS coming in second.

I checked and this seems to be the true LSASS/CSRSS not some trojan.

what is going on here? The stuff I found googling did not help.

Other info
* 1GB RAM, not filled with stuff when this happens
* Happens when Norton is on or off, doesn't matter
* Diskeeper is installed but runs only at night

[edited to add HJT log below]
Logfile of HijackThis v1.99.1
Scan saved at 8:46:01 AM, on 12/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Prog... Read more

Answer:Massive I/O reads after startup - LSASS/CSRSS I/O

Moved to security; you will get more response there on hijack logs.
 

1 more replies
Relevance 65.6%

If this is the wrong board to post this in, my apologies.
 
So, about two or three months ago my laptop's motherboard died. It was an old asus machine, and was years out of warranty, so I decided to simply recycle it and buy another desktop... I've always liked them better anyways. I bought a Dell Inspiron from Office Depot, seemed like a pretty nice deal on the machine that I got. In any case, it ran smooth, and the built in graphics on its i5 processor allowed me to play quite a few of my games until I could invest in a dedicated GPU. A month ago, I bought a new Thermaltake power supply to facilitate eventually getting said GPU, and a week or two later, grabbed an Nvidia GTX 750ti for a nice price, threw it in, and drooled over how nicely it played my games. Two monitors, Skyrim at max settings on one screen, Netflix streaming House on the other.
 
For a couple weeks everything was groovy. I was able to play my games typically at least at 60 FPS smooth, I was able to multitask, I was even able to record plenty of my games at 60 FPS with fraps, NO PROBLEM, I was thrilled with how quickly windows 8.1 started up every time... The suddenly, about a week ago, that all changed.
 
For some reason, my ram usage in task manager is almost always above 75%, even with nothing but skype and the task manager running. (No call going on skype, that is, just the program open.) My hard-drive usage is fine at times, but most of the time I'm doing ANYTHING at all, including open... Read more

Answer:Constant high memory and constant hard-drive reading

Go to the Performance tab in Task Manager and click on Resource Monitor.
See what image names are taking up the most in each column (you can click on the column header in order to sort that column).
 
Also, please do the following:
- open Event Viewer (run eventvwr.msc from the "Run" dialog)
- expand the Custom Views category (left click on the > next to the words "Custom Views")
- right click on Administrative Events
- select "Save all Events in Custom View as..."
- save the file as Admin.evtx
- zip up the file (right click on it, select "Send to", select "Compressed (zipped) folder")
- upload it with your next post (if it's too big, then upload it to a free file-hosting service and post a link here).
FYI - If we're looking for Event ID 41 errors (unexplained shutdowns), there's more info on that here:  http://support.microsoft.com/kb/2028504
While waiting for a reply, please monitor your temps with this free utility:  http://www.cpuid.com/softwares/hwmonitor.html
 

17 more replies
Relevance 63.96%

ok one of my freinds got ahold of a virus and he got black screen and lsass exe error when he logs on and cant get to virus scan.

so what i did was take a working hard drive i had laying around hooked it up as master put his as slave so i could run scan on his hard drive and get rid of the problem but for some reason it says that his hard drive is not formatted witch i know it is. how could i fix this?

running xp seagate harddrive with sata connection (his)
xp with ide connection Maxtor

he has a compleat custom build

if u need any more info. let me know

Answer:lsass exe error/hard drive

Did you switch the jumpers? Did you try getting into Safe Mode?

8 more replies
Relevance 63.55%

Every time i use my DVD drive on my computer, my CPU Usage spikes up and down (about 40% difference), causing enough lag to make my Bluetooth mouse sluggish and unresponsive. I have noticed that a couple of applications appear and disappear on my processes tab in the Task Manager in sync with these spikes. I believe it is the wl.exe and cmd.exe items.

Here is the good old HJT Log

Thank you for you help in advance.
Kyle


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:00 PM, on 1/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files... Read more

Answer:DVD Drive causing high CPU Usage

Still having this same problem. is anyone able to help me out with this?

Braamzor
 

1 more replies
Relevance 63.14%

I'm trying to fix a friend's HP laptop. It seems to have some weird problems. I've done scans with Avast boot scan and Windows defender which found some stuff that they removed. I also tried the Kaspersky rescue disc but the laptop froze during the scan.

The computer hibernates randomly and sometimes freezes. The freezings are probably overheating problems because the Kaspersky disk is Linux-based.

The computer froze during the GMER scan but I can try it again.
I've googled the lsass.exe problem, it can occur from various different reasons but i suspect malware.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by Heikkinen at 12:55:46 on 2012-03-31
Microsoft? Windows Vista? Home Premium 6.0.6002.2.1252.358.1035.18.3069.1534 [GMT 3:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNe... Read more

Answer:Excessive hard drive access by lsass.exe

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/448287 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

2 more replies
Relevance 62.32%

Background:
For the past few weeks or so I was on W8.1 on my SSD and Arch Linux on my SSHD. However now when loading up Arch I get a { DRDY } error presumably on the SSHD, and W8.1 crashed very soon after logging in. I noticed that sometimes that the computer does not freeze until I open up a game (Total War 2). TW2 had been working fine previously. I would go ahead and reset/refresh my main W10 drive but I'm not sure if that's the issue. I have never gotten a BSOD just a freeze then sometimes black screen with a mouse.

What I've tried:
I consistently virus scanned with Malwarebyte's and Defender to find nothing.I hoped upgrading to W10 would fix the issue, but it did not./sfc scannowSMART check (no issues)check Task Manager/used Proc Explorer (or variants) can not see cause of disk usage spike

What I believe could be the issue:
I want to say the drives are failing, but I'm honestly dumbfounded.I've read it's possible to the SATA cables.

Any ideas?

EDIT: Tried creating another user account, and so far no issues with the new account. Also added some logs, if more are needed I can add them.

EDIT 2: TW2 crashed it again

Answer:Not BSOD but constant freezing with drive spiking at 100% usage

Partounian, welcome to the forums. It is difficult to say without the proper documentation. It could be your hard drive, or several other things.

Please upload the BSOD Posting instructions BSOD - Posting Instructions - Windows 10 Forums. Upload them here. This will tell you how Screenshots and Files - Upload and Post in Ten Forums - Windows 10 Forums.

8 more replies
Relevance 59.86%

In taskmgr I see that Lsass.exe runs a rundll32.exe every 20 sec. This causes a little hourglass to appear next to my cursor every 20sec which is annoying. What the heck is it doing. The rundll32.exe just pops up for two seconds and disappears. I know that it is caused by Lsass because I can see it in the process tree. Confused.

Answer:Lsass.exe causing hourglass every 20 sec?

This link may help.

5 more replies
Relevance 59.86%

My brother is having probs with his pewter. Error message c\win\sys32\lsass.exe terminated unexpect with code 1073741819. What is this and how do we stop it?He said he has checked for sasser. Xp homeThanks

Answer:lsass.exe causing shutdowns

Sounds very much like Sasser click hereTry running Stinger click here

2 more replies
Relevance 59.45%

Hello again TSF

my problem:
When i boot the PC it gives me error:
Cannot find csrss.exe in C:\WINDOWS\system32\config\csrss.exe"

There is constant traffic (i use a download meter, I've used it for like 3 years now (DUmeter)) It tells me something is downloading at like 2-5 kb/s constantly.

Also, my internet has suffered from this or something else and its getting mega slow.

After properly installing IE-Spyad, there was no success msg, but
"failure to import"
and then a wide list of websites.

Edit: I cant seem to upload the activescan.txt
Upload Errors
nameActiveScan.txt:
Attachment in Progress. Can be deleted here.

It stays like that, so Im gonna copy it here, sorry if its not appropriate

ActiveScan
-----------

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-06-21 15:15:20
PROTECTIONS: 1
MALWARE: 7
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Syman... Read more

Answer:[SOLVED] csrss.exe not found / constant traffic

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\system32\config\csrss.exe"

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\WINDOWS\system32\config\csrss.exe

Go to http://www.bleepingcomputer.com/comb...o-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

10 more replies
Relevance 59.45%

Hi I am running Windows Xp Pro and the process called csrss.exe is slowly consuming more and more ram until it is at about 1.5 gb and my machine freezes.There is a hotfix for this problem but it is for windows NT and I have been unable to find a solution for XP.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:45:37 PM, on 11/4/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS.1\System32\smss.exeC:\WINDOWS.1\system32\winlogon.exeC:\WINDOWS.1\system32\services.exeC:\WINDOWS.1\system32\lsass.exeC:\WINDOWS.1\system32\svchost.exeC:\WINDOWS.1\System32\svchost.exeC:\WINDOWS.1\system32\spoolsv.exeC:\WINDOWS.1\Explorer.EXEC:\WINDOWS.1\system32\RUNDLL32.EXEC:\Program Files\Wallpaper Master\Wallpaper.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exeC:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exeC:\WINDOWS.1\system32\nvsvc32.exeC:\WINDOWS.1\system32\svchost.exeC:\Program Files\MSN Messenger\usnsvc.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\uTorrent\uTorrent.exeC:\WINDOWS.1\system32\wuauclt.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program F... Read more

Answer:Csrss.exe eating ram and causing eventual freeze

Xp is running on NT...run the fix.

3 more replies
Relevance 59.45%

Im am having issues with csrss, smss, lsass.exe and "winupdate86". only after running spybot and manually deleting "hkey_user...\disable task mgr was i able to end process on "winupdate86". Im still getting a redirection online, i cant create a new user or change the "critical warning" jpg on my desktop. i know that if i restart ill be back where i started. Spybot and adaware find and "fix" the corrupted files but on reboot there is no change, because, i guess, im not able to remove the original file. It has made its own user "Administrator" which i completely deleted. i cant DL "MBAM". ive even got a "critical warning" jpg on my desk top. I have put the above three exe files in RemoveOnReboot.exe but am hesitant to restart. It is better than it was, but this is beyond me. I could use some assistance.
log:
---------------------------------------
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 3:11:57 PM, on 12/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C... Read more

Answer:Virtumonde, csrss, smss, lsass.exe and "winupdate86" haalp!!

Setup is ended by dialog box: "unable to execute file...create process failed; code 2. the system cannot find the file specified.
 

2 more replies
Relevance 59.04%

I have an Acer Aspire laptop which is around 11 months old, and has Windows XP Media Centre Edition SP2 on it. I went to reboot my PC as you do, and once again it came up with the Windows logo screen and then came up with 'Windows is now starting...' and then suddenly an error popped up which said:

The system process
'C:\WINDOWS\system32\lsass.exe'
terminated unexpectedly with a status code
-1073741819
The system will now shut down and restart.

And then after 60 seconds my laptop restarts and it keeps on doing this. I have even tried going into 'Safe Mode' and the rest of it, but none of them seem to get me away from this annoying error.

I have been searching the error code and 'lsass problems' which came up with many results, but I have a slightly different story. I do not currently have a XP disk because I did not receive one from Acer when I brought it and I also have a couple of valuable files that I unfortunately didn't back up, and which I need. Although I could ring or email Acer to send me an XP disk.

I do however have a Windows Vista disk which I was sent a couple of months after buying the laptop because it was part of a free XP to Vista upgrade. But I am slightly worried about installing Vista, because I have heard it uses a lot more RAM, and that some of the games that I play need twice as much RAM as normal, meaning my mere 1GB is not enough to run the minimum specs.

So basically I have a couple of questions to ask, so I can basically determine... Read more

Answer:'lsass.exe' error causing pc to shut down

does the laptop have a non destructive repair option

3 more replies
Relevance 59.04%

I am running under Windows XP Home, SP2. I noticed that my disk is constantly cranking, even when I'm not logged on. After investigating for a number of days, using Task Manager and pulling up the I/O writes column, I found that lsass.exe is performing an unbelievable number of writes. I've had the computer up for about 15 minutes this morning, and there have already been 15,000 writes.

I've already done the following, multiple times:

Scanned for viruses
Ran AdAware
Ran Spybot

I also did some house cleaning, uninstalling unused programs, defragmenting the drive, cleaning up temp folders.

Nothing has worked. Please help!

Answer:Lsass.exe Causing Runaway I/o Writes

"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server. It generates the process responsible for authenticating users for the Winlogon service. This process is performed by using authentication packages such as the default Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates inherit this token.http://www.neuber.com/taskmanager/process/lsass.exe.htmlIf lsass.exe isn't located in C:\Windows\System32, then it's probably a malicious file. Can you check where lsass.exe is located using Task Manager or another program?EDIT: I looked at the comments on that url, and one showed:Its just a normal OS file. If you have problems with your computer shutting you down saying there was an error with it...Then you should look into the sasser virus. Once you update to the windows xp service packet 2 you will have the lsass.exe file in two if not 3 folders. All three in windows one in the service packet folder one in the system32 folder and one on some computers is in a folder called SoftwareDistribution. If the file is in any or all of these directories it is fine.

6 more replies
Relevance 59.04%

I have an Acer Aspire laptop which is around 11 months old, and has Windows XP Media Centre Edition SP2 on it. I went to reboot my PC as you do, and once again it came up with the Windows logo screen and then came up with 'Windows is now starting...' and then suddenly an error popped up which said:

The system process
'C:\WINDOWS\system32\lsass.exe'
terminated unexpectedly with a status code
-1073741819
The system will now shut down and restart.

And then after 60 seconds my laptop restarts and it keeps on doing this. I have even tried going into 'Safe Mode' and the rest of it, but none of them seem to get me away from this annoying error.

I have been searching the error code and 'lsass problems' which came up with many results, but I have a slightly different story. I do not currently have a XP disk because I did not receive one from Acer when I brought it and I also have a couple of valuable files that I unfortunately didn't back up, and which I need. Although I could ring or email Acer to send me an XP disk.

I do however have a Windows Vista disk which I was sent a couple of months after buying the laptop because it was part of a free XP to Vista upgrade. But I am slightly worried about installing Vista, because I have heard it uses a lot more RAM, and that some of the games that I play need twice as much RAM as normal, meaning my mere 1GB is not enough to run the minimum specs.

So basically I have a couple of questions to as... Read more

Answer:'lsass.exe' error causing pc to shut down

14 more replies
Relevance 59.04%

I must have opened something online or downloaded something I shouldn't have because these two issues are brand new and they're pissing me off! I could use some help. About to go to bed because I've spent too much time tonight trying to figure it out and coming up with nothing.
 
Anyone have any idea about either of my fun new issues?
 
 

More replies
Relevance 59.04%

Search and searched, be it here or google. I am by no means a newbie and have yet to ever need to seek the advice of others, but I am just plain stumped on this one.

Everyone has heard of the csrss.exe cpu spike. Many attributed it to the virus. Something I know I don't have. Other solutions have been posted. Mine only spikes when I open a PDF file. Be it on the internet, one I have saved on my computer, or on an external drive. I open it, the PDF program launches (have tried with Adobe and 4 other pdf readers) and then csrss.exe goes nuts. It has full CPU usage for the next 30 second to 2 minutes or so.

Any ideas?

OS: Windows XP Professional
 

Answer:csrss.exe and pdf CPU usage

12 more replies
Relevance 58.63%

Yesterday evening, I sat down to use the internet after my mother logged off of her User Account. I pulled up Firefox, and had Gmail, Facebook, and a yarn website all open in tabs, while I listened to a song in Winamp, and added a new mp3 to my playlist. I was chatting via AIM using Trillian. I then received an error message stating "system32 lsass.exe terminated unexpectedly" and that it was shutting it down in 60 seconds. It would not allow me to do anything else. It restarted my computer and the same error message popped up after I logged back into my User Account, before I had pulled anything up. The third time, I managed to pull up the Task Manager, and the only thing running was something titled "Project1". I tried starting my computer in Safe Mode and it would not allow me to, it just brought me back to the boot screen. I put in my XP disc and attempted to do a Repair Install, but it did not give me the option. With the help of a friend, I found the "shutdown -a" command which managed to stop the auto-restarts; I also did "End Task" for the Project1 application. I tried to install Windows Updates; it would not let me. Internet Explorer refuses to sync with my DSL, which is probably not related; I have not used IE since we had the DSL put in. I even downloaded the latest version of IE8, and it will not work. I tried to download the free AVG program; it would not install. When I try to shutdown my computer from my User Account (w... Read more

Answer:Project1/Lsass Virus - constant restarting

bump, please

15 more replies
Relevance 58.22%

I recently have converted my c drive to NTFS because i can't use the Windows Live Messenger's File Sharing option with my previous FAT 32 c drive. ok, all is well, i follow the guys on the net forum to convert my c drive using the command prompt and it went smoothly, becoming a NTFS c drive.

But problem is, my c drive start to lose free disk spaces almost magically. I have about 15GB of free hard drive but it went down to 3 GB and less and less in just a few days. WTF?!

I check the c drive already, says that most of the disk usage is on My document but i had not been putting files into it since a long time ago, so what is going on?! I think that maybe the converting process screwed up the system, not very sure, though. So, guys, anyway i am going to get back my lost spaces without having a disk format? please help, thanks a lot.

Answer:NTFS C drive causing hard drive spaces to vaporate, plz help!

Cable/DSL is extremely braud as you got the verious speeds depending on the reigon and plans that are being offer.

Plus you have also completely forgot Mobile Broadband that is using the 3G or Unwired Networks.

9 more replies
Relevance 58.22%

I have an issue with csrss.exe and spoolsv.exe utilizing almost 100% of the CPU until the point that printer can print faster than Windows XP will spool. It just started happeing within the last month or so and it only happens on certain network printers...mainly our HP9000 series printers. I have not changed the driver or the network configuration recently. And it doesn't seem to matter if I print to the printer directly or through the network print server. I have loaded all of the latest service packs on the print server and the workstations. Any guidance would be of help. Thanks.
 

Answer:csrss.exe cpu usage while printing.

Check to see if there any print jobs waiting on MS Office Document Image Write and not on your installed printer. Terminate these print jobs and all should be well.
 

1 more replies
Relevance 58.22%

csrss.exe is making my computer run at very high cpu usage at idle. around 50-60% i have a hijack this log file below.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:18:32 AM, on 5/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\System32\DLA\DLACT... Read more

Answer:csrss.exe high cpu usage

Hello and Welcome to TSF.

We no longer use HijackThis as our initial analysis tool.

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

------------------------------------------------------

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new thread, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

------------------------------------------------------

1 more replies
Relevance 57.81%

I'm running on a Dell Inspiron 700 Laptop. It is a friend of mine's so I'm not sure what they must have changed, but it was running fine until recently, when upon start-up, CPU Usage stays around 90 or above and under Task Manager, it looks like the lsass.exe process is what's causing the problem. Also, the Commit Charge gradually increases until around 1500, where the computer basically can't run anymore. I have run a Norton scan in safe mode and came up with no results. What I thought was strange is that under a new user account I created, none of these problems showed up. Anyways, here is the HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 1:44:09 PM, on 6/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Fi... Read more

Answer:Help! CPU Usage @ 100% Lsass.exe 90 CPU

8 more replies
Relevance 57.4%

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:12:19 PM, on 9/22/2009
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\NComputer\bootsrv.exe
C:\WINDOWS\System32\KmServc.exe
C:\Program Files\Quick Heal\Client Agent 4.0\ACCASRVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\QUICKH~1\QUICKH~1\opssvc.exe
C:\PROGRA~1\QUICKH~1\QUICKH~1\EMLPROXY.EXE
C:\PROGRA~1\QUICKH~1\QUICKH~1\quhlpsvc.exe
C:\Program Files\TrueCafe\TrueCafeServer.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\QUICKH~1\QUICKH~1\EMLPROUI.EXE
C:\PROGRA~1\QUICKH~1\QUICKH~1\UPSCHD.EXE
C:\PROGRA~1\QUICKH~1\QUICKH~1\OnlineNT.EXE
C:\Program Files\NCT-2000-XP\KmMsg.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\acmewin\acmepro.exe
C:\WINDOWS\system32\winlogon.exe
D:\Acmewin\Infinity\Ver5.000\Infinity.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ctfmon.exe
d:\acm... Read more

More replies
Relevance 57.4%

csrss.exe and nvsvc32.exe are use abnormally high cpu usage aroung 30% - 50% of the cpu usage. i suspect that it may be mailware or a virus.

DDS (Ver_09-03-16.01) - NTFSx86
Run by Derek Cossey at 10:33:28.93 on Mon 05/04/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1413 [GMT -4:00]

AV: Webroot AntiVirus with AntiSpyware *On-access scanning enabled* (Updated)
FW: Webroot Internet Security Essentials *disabled*

============== Running Processes ===============

C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\dlcgcoms.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
c:\WINDOWS\system32\... Read more

Answer:csrss.exe and nvsvc32.exe high cpu usage

please bump me

4 more replies
Relevance 57.4%
Relevance 57.4%

Hi, i have recently been noticing that i have had a fluctuation of CPU usage from a combination of the lsass.exe and Winlogon.exe process. They tend to accumulate a CPU usage between 75%-100%.

This is my Hijack This Log:


Edit by chaslang: Incomplete, inline HJT log removed. READ & RUN ME sticky not followed.


Thanks in Advance!
 

Answer:lsass.exe & Winlogon.exe 100% CPU Usage

Welcome to Major Geeks!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions. If something does not run, write down the info to explain to us later but keep on going. Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide
 

1 more replies
Relevance 57.4%

any way to help fix this problem with be greatfull

Answer:LSASS.exe spiking CPU usage to 80% and up

Hi chocobaba and welcome to TSF !

Some virus or trojan can disguise themselves as lsass.exe. Please download and run process explorer, right-click the lsass.exe process => properties. Tell us what's the command line and user in the image tab. If there's more than one lsass.exe process tell us about it.

Is there any other process that's taking some cpu usage ?

Have you installed anything new recently ? Are you loged with an administrator account ? What antivirus, firewall and anti-spyware do you use ? Have you installed all the latest critical updates from Windows update ? Does the problem also happen in safe mode (repeatedly press F8 while the computer starts) ?

5 more replies
Relevance 56.99%

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:39:22 PM, on 2/20/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18372)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\BRMFRSMG.EXEC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Plaxo\3.17.0.16\PlaxoHelper_en.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\DrvMon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Creative\SBLive\Diagnostics&... Read more

Answer:CPU usage is at 100% all the time csrss.exe is running high

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.comDDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructions that pop up for p... Read more

2 more replies
Relevance 56.99%

First post on here. Hi everyone!

I was wondering if any of you might be able to help identify a problem I'm having. A couple of weeks ago I upgraded my graphics card and PSU and noticed hard drive activity when my PC was idle. About three little clicks every 2-5 seconds (The hard drive light doesn't always come on). There isn't any effect on Performance. CPU usage is usually at 0% like normal. When I boot up it goes abit crazy with disc access, but it settles down after abit. Programs are maybe a little slow to start, but it's just so borderline I just don't know.

I wondered if it was because of downloading a new driver for my graphics card, so I tried system restore, but it still did it. I've also scanned for viruses with Avast and security essentials but nothing has come up. I don't use this machine for web browsing really, and havent downloaded any mods recently or visited any spurious webpages. Maybe I should mention I uninstalled some antivirus software I had called webroot not long before. I've heard that some antivirus sabotages your computer when you uninstall it?

I read on the net that the clicking noise might be the "click of death" so I downloaded SeaTools and HD Tune and it passed tests from both of them except one on HD Tune - CRC Interface errors. It suggested that it was a faulty cable but I didn't touch the hard drive other than to connect the power cable to it, which wasn't anywhere near the drive itself. After a bit of research I... Read more

Answer:Constant Hard drive access

CRC interface errors are usually because the SATA cable has issues. Those cables are very very picky, must do smooth curves, hate to get bent like a spiral or do straight 90 degress turns. Can you make sure that the cable is mounted according to what I said? Try cleaning the interfaces of the cable with compressed air and also changing sata port on the mobo.

Also, can you post a screenshot of Resource Monitor's tab about disk usage when you notice such things?
write "resource monitor" in the search box of Start menu to open it.

7 more replies
Relevance 56.99%

I have just put together a new system with windows 7 pro as the operating system.
It all went pretty smothly, the only thing that is niggling at me as there is a constant
hard drive access which I didn't get with windows xp. My first thought that it was a virus
but looking at the resource monitor most of the activity seems to be down to the fllowing file.

c:\windows\system32\wfp\wfpdiag.etl

Having googled this it seems to have something to do with windows firewall but thats as
about as much as I can find out. I haven't installed any third party firewall controllers
which seemed to be the source of his problem for some people, Any one have any ideas how to
stop all this hard drive activity relating to this file?

Thanks in advance.
 

More replies
Relevance 56.99%

Can't figure out how to stop constant hard drive access:RootRepeal gives me a blue screen of death.DDS (Ver_09-07-30.01) - NTFSx86 Run by Port at 15:12:01.84 on Wed 09/09/2009Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07============== Running Processes ============================= Pseudo HJT Report ===============uStart Page = hxxp://www.google.com/uInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = *.localuURLSearchHooks: H - No FileuURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dllmURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dllBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:program filesavgavg8avgssie.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:program filesjavajre1.6.0_07binssv.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:program filescommon filesmicrosoft sharedwindows liveWindowsLiveLogin.dllBHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dllTB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:program filesavgavg8toolbarIEToolbar.dllTB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No FileTB: {A057A204-BACC-4D26-9990-79A187E2698E} - No FileTB: {00000000-0000-0000-0000-00... Read more

Answer:constant hard drive access

Process Monitor shows what is happening every second or two:


System 4 SUCCESS Thread ID: 2496 108 Process System NT AUTHORITY\SYSTEM

System 4 SUCCESS User Time: 0.0000000, Kernel Time: 0.0000000 2496 Process System NT AUTHORITY\SYSTEM

System 4 SUCCESS Thread ID: 2928 108 Process System NT AUTHORITY\SYSTEM

explorer.exe 1608 HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2C05FD31-C6C0-4295-8994-0544470B4E33} SUCCESS Desired Access: Read 4020 Registry C:\WINDOWS\explorer.exe BASE\Port C:\WINDOWS\explorer.exe

explorer.exe 1608 HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2C05FD31-C6C0-4295-8994-0544470B4E33}\EnableDHCP SUCCESS Type: REG_DWORD, Length: 4, Data: 1 4020 Read Registry C:\WINDOWS\explorer.exe BASE\Port C:\WINDOWS\explorer.exe

explorer.exe 1608 HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2C05FD31-C6C0-4295-8994-0544470B4E33}\LeaseObtainedTime SUCCESS Type: REG_DWORD, Length: 4, Data: 1252623254 4020 Read Registry C:\WINDOWS\explorer.exe BASE\Port C:\WINDOWS\explorer.exe

explorer.exe 1608 HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2C05FD31-C6C0-4295-8994-0544470B4E33}\LeaseTerminatesTime SUCCESS Type: REG_DWORD, Length... Read more

17 more replies
Relevance 56.99%

I know this has been posted time and time again, but I have not found any solution to my problem. I do not know which drive it is, but one of them (I have 4) will sometimes spike to 100% activity, and the only way to resolve that is by rebooting.
Now I know that doesn't sound so bad, but when you're in the middle of photoshopping something, doing some homework, or gaming, it gets to be a real pain, very quickly.
I can imagine that having a hard drive at 100% activity for hours on end will take a very large toll on its life span.

Here are my system specs:
ASUS M3A32-MVP Deluxe motherboard
AMD Phenom x4 9950 BE 2.6 GHz
2GB DDR2 1066 MHz RAM
160GB HDD
250GB HDD
300GB HDD
500GB HDD

I read on another thread that indexing or scheduled defrags may be the cause, but I have already disabled index since I installed 7. My defrags are scheduled for 1AM every wednesday (but that has long passed, and I have already had to reboot).
I also read somewhere that it could be a missing AMD processor driver, which indeed I had no luck finding.

Please guys, I don't know why it's doing this, and I'm fed up with rebooting every 2 hours.

Answer:Constant 100% Hard Drive Activity

try opening up "task manager" on the top choose the process tab, and then click on the "cpu" column, and see what is taking most of your cpu.

9 more replies
Relevance 56.99%

For some time now my Hard Drive light remains ON even with no programs running. It blinks as I start up in the morning but soon goes ON and remains so. I've checked Task Manager and had a local geek help me look at processes running, but stopping everything but essential Windows systems, the HD light won't go out. I have uninstalled my antivirus program and the light will go out, but it reappears at next startup. I've uninstalled my antispyware program and the light will go out, but it reappears at next startup.

Can anyone offer a suggestion? I've also changed AV programs but with the same results.

Answer:Constant Hard Drive Light

Maybe those programs you removed...are running scans (which would account for HD activity).

Uninstalling a program shouild have no impact on a hard drive...unless doing so terminates a running application.

Louis

7 more replies
Relevance 56.99%

Cookiegal said:


It doesn't appear to be malware related so I suggest you start a new thread in the XP forum.Click to expand...

I just built a brand new system several months ago with an ASUS Rampage Extreme, Q9650 Quad Core and XP Pro Service Pack 2. It has 2GB of RAM with an ASUS HD4890 video card. I have a bunch of games installed and some graphic utilities but not much more than that. It's mostly used for gaming and graphics. I installed AVAST home edition immediately after the first start up. Configured the system to Classic mode and patched everything up. It has two SATA2.0 320GB drives.

I have this very annoying problem. I have 2 other computers running exact same versions of XP Pro and none do this. I get a constant hard drive led flashing about once a second. I've installed and run "Process Explorer" and slowly went through all and suspended them and it keeps running. I ran an AVAST scan and nothing came up. I've also run every malware detector recommended here and found nothing.

I do browse the internet frequently with this computer and I was concerned that I picked up a trojan program but Cookiegal worked with me for quite a bit and said it isn't malware. I'm concerned about what it may be doing to my hard drive though and I would like some help if someone can give it to me. I want to find out what is accessing the hard drive constantly and shut it off if possible or make sure it's not a problem.

Thanks,
Scott... Read more

Answer:Constant Flashing Hard Drive LED

9 more replies
Relevance 56.99%

So, last week, my computer, which was running just fine, pretty much brakes to a halt. HD usage skyrocket to between 95 and 100% percent and stays there. However, CPU usage stays more or less normal-- only running about 10 percent with no programs running. Nothing particular noticed on my task manager. Ran Norton AV with updated definitions and nothing showed. Also ran AAW and nothing.

However, I got an error when trying to shut down the other day, stating Sample.exe was running, halting the shut down. I ran both Symantec Nimda removal tools and no dice.

The hard drive was replaced within the past year and the disk check utility that I use claims that my drive is 100 percent healthy aside from the access rate, so I don't believe that this is a hardware problem.

Any ideas??? At this point I'm almost willing to wipe the hard disk and reinstall, but I'm worried that in transferring the data over I will also transfer whatever is causing the problem.

Dell Inspiron 8600
Windows XP Pro, SP3
Pentium M 1.60 GHZ
2 GB ram
60 GB HDD

Answer:Constant Hard Drive Access

Hello,Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/274864/mystery-trojanvirusbad-thing/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.Please be patient. It may take several days, up to two we... Read more

1 more replies
Relevance 56.99%

Does Vista constantly run its hard drive for anyone else out there?
Thanks,
Mancow
 

Answer:Vista - Constant Hard drive

6 more replies
Relevance 56.99%

Is there a utility that will tell me what program is constantly scanning my hard drive (windows XP)? I think I have the indexing services off and findfast off...I've used Process Explorer and msconfig, but can't tell what is running my drive..

Answer:Constant hard drive scanning

Two of the most common problems of constant hard drive scanning are, the drive is going bad or you have a virus.You didn't mention what brand of computer you have. HP computers have a built in utility in the BIOS to check the hard drive. You might check if your computer has this option. The next step would be to do a virus scan. There are many good free virus scanners available, Trend Micro and Avast are two good ones.

5 more replies
Relevance 56.99%

I recently installed Norton AntiVirus. It found a Magistr virus in one of my email files. It reported that it had removed the virus. However, in the last several days I've heard something accessing my hard drive on an ongoing basis. I can't figure out what it is. I looked at running programs with CTRL+ALT+DEL. They seem normal. Things like: Rnaapp, Systray, Mixer, Directcd, Navapw32, Conmgr, Ptsnoop, and Explorer. Is there some other place I could look. I disabled Auto-Protect to see if that was it - NO. Does anyone have any other ideas of what it could be or where to look to find it?

THANKS
slider14
 

Answer:Constant Hard Drive Accessing

16 more replies
Relevance 56.99%

Recently my computer has suddenly begun to act a little strangely. Whenever it is idle for more than a few minutes it begins to grind terribly as if it is trying to constantly access the hard drive or something. It has never done this before and it's really getting annoying. Is there any reason this might suddenly have started and more importantly how can I stop it?The only thing I have recently done is upgrade to the latest version of msn. I'm tempted to think this is the culprit since the problem only started after I did this, but I can't see why it would cause this problem.I have Windows XP Home which is up to date with the latest service pack, an Intel Pentium 4 CPU 2.66GHz processor and 1024Mb RAM.Thanks.

Answer:Constant Hard Drive Access

Do you have indexing service on ? ?This can be checked under the Properties of the HDD...if so turn it off.What kind of schedule are your protection apps set to ? ?How old is this HDD ? ?It may be headed South.Let us know...

14 more replies
Relevance 56.99%

can any one help I dont know if this is normal or not but my hard drive light flashs about once a secound and sometimes stays on for longer periods I also notice the floppy drive light is on at times even when the system is idle with no programs runing. I am using window xp and have run a virus scan with the latest updates.

Answer:constant hard drive activity

Hi archerman .......what O/S and how much memory have u got?regardsobbit

10 more replies
Relevance 56.99%

Just installed Xp onto a new hard drive and now the drive is constantly working. Possibly after Critical updates have been downloaded. I have run Anti virus and Spyware nothing showing there.Found this in Task manager - "system idle process" showing 99%I've a look on tinternet and this came up click hereSome people say it's normal but can anybody explain the constant disk activity?Thanks Ps Sorry for looking elseware for help.

Answer:Constant Hard drive activity!!!!!

System idle process is a special process which just uses up spare time on the CPU. It doesn't do anything, so it is unlikely that this is the source of the problem. Could be something like antivirus running a background scan or something like that. Norton and Sophos are particulary bad at continuous disk usage.HTHChris

8 more replies
Relevance 56.99%

I came home Saturday night around 3am to look at my computer monitor led yellow. I knew something was wrong. I have tried to replace the battery on the mother board swapped the motherboard tried switching the video card slots everything. I am left clueless. I am not very experienced in working on computers so any help would be greatly appreciated. I am going to try replacing my video card next. I have also tried plugging a different hard drive in and it still makes no beeps or anything on power up but I know it is getting power because the fan is working. The Hd LED is SOLID RED!!
 

Answer:Constant Hard Drive Led Light on

if u get no beeps, try flashing the bios. look in your mobo's manual how to do it. it should be shortin some pins using the jumper provided there. if that doesnt work, try takin out the ram. if your comp starts beeping that means its the ram thats the problem. check your mobo for any bulging capacitors. or no...you said you changed your mobo. if you have any pci cards plugged in, take them out and also disconnect all ide or sata devices so you only have the cpu, video card and memory plugged in...if that doesnt work, like i already said, start by removing the ram first...if no beeps are heard, proceed to the video card...if it still doesnt work, change the power supply...if again, doesnt work, remove the cpu and if u have another one, try installing it. wish you the best of luck
 

3 more replies
Relevance 56.99%

I am having a huge problem with my PC.Everything was working if until a few nights ago when the game I was playing started stuttering really hard.After some investigation a great fear that I been infected with some kind of root got into by brain.I wiped my computer clean and performed a clean install but the same problem exists.Explorer.exe constantly access the registry for a tcpip information.I have disabled the nic and it continues.The hard drive light flashes like a beating hart.I can time the hiccups in game play with the the flashing of the hard drive light.Panda, Trend, AVG show nothing.S&D and xoftspy show nothing.Hijack this looks cleanTCPview shows no network access I have no idea what to do.Here is a screen shot of what see occurring 20 times a second in Processes monitor.

Answer:Constant Hard Drive Access

Hi erexx.Your hard drive could be failing and trying to successfully read the same bit of data over and over again.Identify the make of your HDD and download the diagnostic program from it's manufacturer.Seagate/Maxtor/Quantum, http://www.seagate.com/www/en-us/support/downloads/ Western Digital, http://support.wdc.com/download/ Hitachi/IBM, http://www.hitachigst.com/hdd/support/download.htm Samsung. http://www.samsung.com/in/products/harddis...ities/hutil.htm_

4 more replies
Relevance 56.99%

I installed vista on my machine and at boot when you first reach the desktop, the hard drive just goes on and on. And then through out, its constantly access it not a solid just here and there. Is there something its doing that i could just turn off? Heres my specs

Amd 5200+
2 gigs of ram
abit kn9 board
nvidia 7900GS
36GB raptor
 

Answer:Constant hard drive activity

Oh dear...are people allergic to the Search button?

This is perfectly normal for a new install of Vista. It's indexing your drive and optimizing it, and should go away in a week or so.
 

5 more replies
Relevance 56.99%
Relevance 56.99%

Hello. My computer seems to always have hard drive activity even when doing nothing. I have defragged and also run spybot. I have also ran malwarebytes but found nothing. Could someone possibly take a look at my hijackthis log and see if there is something wrong causing the activity. IE8 and Firefox are very slow to open also. I have windowsXP and 512 mb of ram. Thanks so much

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:48:04 AM, on 3/17/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\anyone\Application Data\mjusbsp\magicJack.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Fi... Read more

More replies
Relevance 56.99%

Just noticed one of my folders, running Ubuntu 5.1 (upgrading to 6.06 LTS as I type). The hard drive activity light has been going crazy for the last hour or so. I have not been using the computer, except for folding. It also seems 'sluggish' lately, so evidently the CPU is doing something. I checked the System Monitor, well, not sure what to look for there.

I did see one thing odd, at least to me, gam_server would change from sleeping to uninteruptable every few seconds. Being unfamiliar with Linux, what should I look for if the update does not solve the issue.

The computer is an AMD Athlon 2800XP, Abit NF7-s mobo, 512megs of RAM, 80Gig hard drive, ATI 9800XT video. I don't think it is a hardware issue, but never hurts to post the specs... No problems or errors previously, and the computer 'seemed' much faster yesterday. Any ideas?

E
 

Answer:Constant hard drive activity?

Fred_G said:





Just noticed one of my folders, running Ubuntu 5.1 (upgrading to 6.06 LTS as I type). The hard drive activity light has been going crazy for the last hour or so. I have not been using the computer, except for folding. It also seems 'sluggish' lately, so evidently the CPU is doing something. I checked the System Monitor, well, not sure what to look for there.

I did see one thing odd, at least to me, gam_server would change from sleeping to uninteruptable every few seconds. Being unfamiliar with Linux, what should I look for if the update does not solve the issue.

The computer is an AMD Athlon 2800XP, Abit NF7-s mobo, 512megs of RAM, 80Gig hard drive, ATI 9800XT video. I don't think it is a hardware issue, but never hurts to post the specs... No problems or errors previously, and the computer 'seemed' much faster yesterday. Any ideas?

EClick to expand...

Are you using Gnome or do you have a server installed with the folding software? Is the box used exclusive for folding?
 

6 more replies
Relevance 56.99%

maybe someone could help me...have only just started to notice this really but when my computer is on the hard drive activity light flickers on about twice a second no matter how long the computer has been on for and am sure that it is affecting gameplay...have asked in other forums but people seem to think that i need more ram..i currently have 512 mb ddr ramhave checked task manager but it says that nothing is runningany help or comments would be very much appreciated as i dont know where to look to find out whats causing the hard drive to do this.many thanks all

Answer:constant hard drive activity

You don't have something like Norton Goback installed, do you?I did, but decided to get rid of it afetr a while because of the constant disk activity.

5 more replies
Relevance 56.99%

Hi,

I installed Windows 7 RC. When ever I am booted into Win7 one of my hard drives (probably not system drive - sounds like my secondary storage drive) is constantly working. Not very much but still making sounds.

I have completely turned off indexation, there is no automatic defrag going on. I have set a constant size to the paging file and there is no antivirus activity going on. The hard drive is making noise even when the system is idle for a long time and also when I am using it.

The processes tab in the task monitor shows no process that is using CPU.

What can this hard drive activity be?

Thanks!

Answer:Constant hard drive activity?

Windows Search service perhaps?

9 more replies
Relevance 56.99%

I just set up my computer with the new motherboard. I have Windows XP pro. While my computer is being used it runs fine but when you leave it idle for maybe 5 minutes or so the hard drive crunches and the hdd led lights up continuously. It does this until you move the mouse then it stops. Repeats this everytime. Anyone know what could possibly cause this?

Answer:constant hard drive crunching

Is it possibly going into power save mode? If so then its just storing whats currently in ram to the hard drive. Might want to set the power saving options to a higher number than 5m.

4 more replies
Relevance 56.99%

Greetings, all!
I'm a computer technician in Ohio. I deal with the daily grind of fixing computers five days a week, but this one is puzzling me.
I've found a couple things that annoyed me so far and turned them off (LLMNR, since IPV6 doesn't exist on my network... yet. For example, anyway.) However... I don't care what I'm doing, I can be sitting without anything open, just on my desktop, and my HDD activity light is spazzing out 24/7.
 
Now, I deal with malware daily. I'm nowhere near the expert, but this was a fresh installation of Win 7 Pro a couple months or so ago, all data scanned as it was going back. Constant drive activity light flashing. I want to resolve this ASAP.
 
What I've got:
Board: Biostar MCP6P M2+ Ver. 6.x, AM2+
Processor: AMD Phenom 9550 quad-core 2.20 ghz
RAM: 4GB Kingston HyperX DDR2-800
HDDS: Primary: Hitachi Deskstar  500GB (This is getting cloned to a better drive soon, so long as cloning will work)
           Secondary: Western Digital Caviar Black 1TB newly purchased less than two months ago.
           Tertiary:  Maxtor 200GB IDE drive (this will soon be replaced with another WD SATA DRIVE, sooner if this one is my issue)
 
I've done some looking and found a few small issues, but nothing that points me in the right direction.
 
As far as security software, Kaspersky Internet Security 2013.
Browsers: IE 9, Chrome, Firefox, Opera, Safari (I'm working on a... Read more

Answer:Hard drive activity is CONSTANT!

Perhaps Process Monitor can help narrow down the problem.

1 more replies
Relevance 56.99%

my hard drive will just not stop working...all day long! Im running windows 2000 and there are no visible programs running...I think.
Any ideas?
 

Answer:constant hard drive light

WIN2000 HIT CRTL + ALT + DELETE TO BRING UP TASK MANAGER THERE SHOULD BE A LOT OF PROGRAMS RUNNING

LOOK FOR ANTI-VIRUS , ANY SCHEDULED TASKS , LIKE DEFRAGE,

OR BACKUP
IF YOU ARE NEW TO WIN 2000

GOTO HOW TO http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/howto/Default.asp

G7
 

1 more replies
Relevance 56.99%

My laptop is crashing nearly every time it goes into sleep mode after waking it back up. I only have one csrss.exe process running.

Answer:csrss.exe possibly causing BSOD, computer crash dumps after sleep mode

Hi Mix,

I see your dump files but I need you to follow the link below and post the other files required.
Blue Screen of Death (BSOD) Posting Instructions

1 more replies
Relevance 56.58%

iv experiencing slowdowns in my machine, im noticing that the lsass.exe process is taking alot of memory all of a sudden - up to 2GB !

Here:
(Win7x64,Vertex2,Gtx460,i7-2600,8gb ram)

I wonder what can that be, suggestions plz
tnx.

Answer:lsass.exe process very high ram usage

Hi!

I found this which might answer your question.

"lsass.exe" is the Local Security Authentication Server. It verifies the validity of user logons to your PC or server. Lsass generates the process responsible for authenticating users for the Winlogon service. This is performed by using authentication packages such as the default, Msgina.dll. If authentication is successful, Lsass generates the user's access token, which is used to launch the initial shell. Other processes that the user initiates then inherit this token.
Note: The lsass.exe file is located in the folder C:\Windows\System32. In other cases, lsass.exe is a virus, spyware, trojan or worm!

Hope this helps!

9 more replies
Relevance 56.58%

Hi since the latest series of MS patches 16th March 2017, Lsass.exe is off its face!!!
Usage at about 80 - 90% every time I boot up.  Using Windows 7 Home Premium, SP1, i5-3210M, 12 GB Ram, 64 Bit OS.
Has MS stuffed up in the patches or do I need a quantum computer to now run Windows 7 (with latest patches).
Anyone with some sage advice, i'm all ears.

More replies
Relevance 56.58%

iv experiencing slowdowns in my machine, im noticing that the lsass.exe process is taking alot of memory all of a sudden - up to 2GB !

Here:

(Win7x64,Vertex2,Gtx460,i7-2600,8gb ram)

Need help, tnx
 

Answer:lsass.exe process very high ram usage

hiya plase have a read here,http://www.google.co.uk/url?sa=t&rc...i4GACw&usg=AFQjCNGhgvhCdlzpyCZVthtOXLaS4zQU2Q
 

2 more replies
Relevance 56.58%

I have recently reformatted my computer, and I started updating windows. But suddenly after installing an update and restarting, windows started up in with a error message about lsass.exe failed to initialize (0xc0000005), and the after clicking the message nothing happend nomatter what i did, ctrl+alt+del didnt work either. So i had to stick in the windows cd, and ask it to repair it. And then it was just fine again. until i tried to update windows again and the same happend again.
I have then found out that it is the update KB928255 there makes my computer do so, by installing the updates one by one.
Anyone got any idea how to fix this?
 

More replies
Relevance 56.58%

Dear all fellow on Bleeping Computer,
 
Can you guys help me with my computer, it always shows pop up that says low disk space on (D:) everytime I start my computer. I have run the DDS, and the result is below. Please help me to fix my computer.  Your help is really appreciated. Thanks
 
DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 11.0.9600.17239
Run by Andrew at 11:11:02 on 2014-09-06
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4001.1832 [GMT 7:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\ASUS\FaceLogon\smartlogon.exe
C:\Windows\system32\FBAgent.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
C:\Program Files (x86)\Bluetooth Suite\adminservice... Read more

Answer:Something causing my hard drive (D:) Full

Hello and
My name is Sandra and I will help you with your problem.
Please follow my instructions in the order they are given
Read the instructions carefully before you start. If  you get in trouble or do not understand what is to do then stop with the execution and describe the problem as good as you can
Do only run Scans which I advise to you
Do not do crossposting (Posting in different forums)
Do not de- or install software during removal, expect I advisted that to you
Please post all logfiles as a reply instead of attaching them unless I asked you for do so. If the files are too big then use more posts, thanks
Please keep in mind that we are all doing this here in our freetime, if I do not reply in within 48 hours, feel free to send me a PM
 
 
Scan with FRST
Please download Farbar Recovery Scan Tool  and save it to your Desktop.(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)
Start FRST with administator privileges.
Make sure the option Addition.txt is checked and press the Scan button.
When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
Please copy and paste these logs in your next reply.
 
 

25 more replies
Relevance 56.58%

Recently most games and apps I open are not responding and then crash and I notice my hard drives disk usage spikes up to 100% during these crashes. I've installed CrystalDiskInfo to do the S.M.A.R.T reader/test thing and it said the health of my hard drive is good, so I don't get it. What can be the issue??
 

Answer:Is my hard drive causing crashes, or is it something else?

7 more replies
Relevance 56.58%

Hi

Very often I notice that my hard drive is chuntering away busily when I am not doing anything drive intensive at all!! I am woindering if there is a way to determine which application is causing this to happen?

If it is something that needs to ocurr then fine... so be it - but I find it very frustrating indeed when the drive is chattering away for long periods of time. It also makes me somewhat nervous about what and why this activity is - hence wondering if there's a way to find out what it is.

Any advice appreciated... thanks

John
 

Answer:Can I find out what is causing my hard drive to always be on??

Well, it COULD be the idiotic Search / Index service, or it could be something else entirely. Many people (myself included) find it both annoying AND useless; I'd rather avoid the wear 'n tear on my HHDs. I'd suggest turning off Indexing (go to Start > Search, then find the option to disable the Indexing), then reboot, and be SURE Indexing is off. Hey, it's Micro$oft, you never know....

If the noise returns AFTER you've disabled Indexing, you'll have found the culprit. If not, you've got some more detective work to do.

Good luck - hope this helps

- slingshotter
 

2 more replies
Relevance 56.58%

Hey people, my computer has been going through some maajjoorr problems lately, and I was wondering if the hard drive is what the problem is. So around august, I reformatted my HP Pavilion a6120n running windows vista 32-bit (the computer i am currently using to type this message) because I wanted to put the release candidate for windows 7 on it. It worked and the release candidate ran fine for a couple of weeks. But then things started messing up badly. First firefox started messing up. It would crash so frequently and soon after that you couldn't get it open because whenever you click the icon you just get the crash report window. That didnt go away. A little bit after that happened, the computer itself started messing up. Similar to the firefox problem, the computer would get the blue screen quite frequently and at the most random times (you could be in the middle of anything and the blue screen would pop up) until pretty soon that's all you got. You couldnt turn on the computer without getting the blue screen. the blue screen would tell you to restart, and the same thing would happen all over again.

So after that happened, I reformatted the computer back to windows vista again (with the recovery disk that i created when i first bought the computer). It ran fine for a few weeks and then the blue screen started appearing again. Actually when i reformatted back to vista after windows 7 was messing up, my computer had this weird problem with the sound. No matter wh... Read more

Answer:Do you think the hard drive is causing these problems...

16 more replies
Relevance 56.58%

Windows XP-64 SP 2
8 gb ddr2 ram
2 - 2.8 ghz xeons
WD Raptor hard drive
Hitachi hard drive


I had just installed my new hitachi 500 gb hard drive and transferred lots of files onto it that was spillover from some externals that were full. No OS installed. All was fine and the installation of a new hard drive may not mean anything to the rest.

So I bring my computer back from sleep (not really sleep I don't think, but a low power state of some sort) a few days after installing the hitachi and the hourglass goes on and it's acting so slow then not really responding at all. So naturally I restart my computer only to get the message (paraphrased) "no OS found". However in POST both hard drives were "seen". I assume after coming back from sleep it was just running on what was in RAM.

So dang... I figure it's messed up physically but hopefully it's a logical reason. I put in my XP-64 cd to try and repair the OS. It loads up all the drivers and when it says "windows is preparing setup" it hangs there and doesn't continue further.

I unplug the drive with the OS and boot from the XP CD again. This time it works fine... but of course that doesn't help me. So I pulled out an older drive and installed XP to it with the original hard drive unplugged.

I got XP on it fine and shut off the computer, replugged-in the problem drive and now it hangs on the normal windows XP start-up for a very long time. H... Read more

More replies
Relevance 56.17%

Hello,

I have an 1 yr old HP Pavilion dv9000 running Vista home prem, I have IE installed but fun FireFox and Norton 360 security. I have MANY Adobe editing programs and other purchased programs.

I am fairly new to computers but pretty sure something has infected my laptop. I will start it up and it will run fine, then if I open a program all hell breaks loose and my cpu rises to 100% usage!

When I open the task manager and look, I see programs turning on and off faster than lightening and moving up and down the processes list. I know what many/most are and beside them it says what program they come from in the description column, but there are 2 that have no description what so ever that are also running high cpu, these are rundll32.exe and csrss.exe. unsecapp.exe and Even though Internet explorer is not open, in the process list it starts up and stops, then again... though IE never opens as a window... there are many instances of 'Windows.exe' many programs are showing on there doing that.

The CPU running so high keeps stalling the PC, there is nothing at all I can do to make it stop, I have tried shutting down various programs while they are showing high CPU but it doesn't help. The two with no description I posted up top will not shut down with end program.

I have Norton 360 installed on my pc and I ran that scan, I downloaded Trend Micro scan and ran that. I also used Auslogics which did all kinds of cleaning and also ran Advanced System... Read more

Answer:Laptop useless, 100% CPU usage... rundll.exe or csrss.exe virus?

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****
Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.


After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
Helpful Notes:


If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
If you cannot seem to login to an infected user account, try using... Read more

1 more replies
Relevance 56.17%

I have a problem caused by constant hard drive activity, and, after some research and work on my part, along with some reading, here is what I learned.

First, I ran Ad-Aware, then Spybot, then I went to TrendMicro for a free online scan, then Symantec. I run NOD32 from Eset as my scanner. None of these solved the problems mentioned, although some minor cookies were found. I noticed this problem after installing a Blackberry Storm, but I'm not 100% sure this was the root cause. Anyway, I changed phones again, and installed Mobile Sync 6.1 for this, and removed the Blackberry software, but the problem continued. I then did a system restore, and at this point, the problem disappeared, until the first time I connected the new phone, a HTC Touch Pro. At this point, the problem started again. Finally, the problem did not occur in Safe Mode.

I will attempt to describe the problem in some detail, at this point. The constant disk access would cause the computer to lose focus whenever it hit the harddrive. What this meant for me was every time I would try to access a file located in the All Programs folder off the Start button, the list would disappear. If I opened the Control Panel in the Start list, which on my computer is set as an expansion folder, the open list would "blink" on and off constantly, but I could access it. As to typing anything into the Run Program screen, I too would get about two to four letters typed, then the flicker would happen, and the letters I... Read more

More replies
Relevance 56.17%

Hello guys, For about a week now I have searched through endless forums looking for an answer... but to no firm conclusion.Problem:On startup, I have constant hard drive activity. The desktop does load eventually but is so unstable I haven't a clue what to do. It works perfectly in safe mode, so it is obviously nothing to do with core drivers etc.DDS.txt log ______________________________________________________________________DDS (Ver_10-03-17.01) - NTFSx86 NETWORK Run by Euan at 15:10:26.25 on 01/06/2010Internet Explorer: 8.0.7600.16385Microsoft Windows 7 Ultimate 6.1.7600.0.1252.44.1033.18.1012.624 [GMT 1:00]SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}============== Running Processes ===============C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\Explorer.EXEC:\Windows\system32\ctfmon.exeC:\Program Files\Trend Micro\H... Read more

Answer:On startup, constant hard drive activity

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

3 more replies
Relevance 56.17%

Hi There,

I'm rather worried that my laptop has been "got-at". The Belkin router has an LED which flashes constantly indicating traffic (I presume); it's the one associated with the channel to which the laptop is connected, and it flickers away all the time. I'm getting paranoid wondering to whom it may be chatting.

I've noticed that coincident with this activity is a file (PFIREWALL.LOG) which is constantly being updated, and its contents are of the following form:

2008-01-03 05:38:03 OPEN UDP 192.168.2.2 24.87.165.142 56168 60313 - - - - - - - - -
2008-01-03 05:38:03 OPEN UDP 192.168.2.2 84.211.9.251 56168 9213 - - - - - - - - -
2008-01-03 05:38:05 OPEN UDP 192.168.2.2 125.27.73.45 56168 8345 - - - - - - - - -
2008-01-03 05:38:08 OPEN UDP 192.168.2.2 121.23.89.192 56168 11381 - - - - - - - - -
2008-01-03 05:38:08 OPEN UDP 192.168.2.2 140.135.254.9 56168 15352 - - - - - - - - -
2008-01-03 05:38:08 OPEN UDP 192.168.2.2 71.123.210.223 56168 26749 - - - - - - - - -
2008-01-03 05:38:10 OPEN UDP 192.168.2.2 99.244.77.88 56168 24869 - - - - - - - - -
2008-01-03 05:38:11 OPEN UDP 192.168.2.2 58.209.158.39 56168 10849 - - - - - - - - -
2008-01-03 05:38:11 OPEN UDP 192.168.2.2 220.191.23.140 56168 25598 - - - - - - - - -
2008-01-03 05:38:12 OPEN UDP 192.168.2.2 222.20.224.107 56168 16001 - - - - - - - - -
2008-01-03 05:38:14 OPEN UDP 192.168.2.2 89.103.133.137 56168 13171 - - - - - - - - -

I have also noticed that the "used" level of my har... Read more

Answer:Constant Router/Hard-Drive Activity

Please download and run HijackThis, available here:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

And copy and past the log produced here. Someone with a golden shield will have to help you out.

Do you run any peer to peer file sharing program ?
 

3 more replies
Relevance 56.17%

HiI have a Lenovo S10-3 064748U.I've never owned a laptop/netbook before, so I don't know what is normal to expect.A problem I've noticed is that I can hear the hard drive stopping, and then starting up again as soon as something (which in windows is inevietably anything) reads the HD again. So basically, the hard drive will turn off (while I am still using the computer and it does not interrupt the use) but then it will start up again in a mere 3-5 seconds. It never stays off for longer than 5 seconds or so, so I fail to see any positive purpose of it shutting off if it's just going to be starting itself up within mere seconds.Again, this can occur while I'm browsing, so therefore I don't see how it could be stopping due to inactivity. Also, I had my "Turn off hard disk" thing set to 15 minutes by default in power management options, but it can shut itself off and on and off again within seconds of each other.For example, I'm browsing, it shuts off, turns itself back on again within 3 seconds, and then turns off within 10 seconds often, and can continue to do so unless I do something like install or anything that uses consistent and high performance hard drive activity. What I'm getting at is that I doubt that this can have anything to do with the "turn off hard disk" option in power management.I can't help but think that the constant stopping and starting of the hard drive must be bad for it. If power consumption isn't an issue, wouldn't it be better for the hard ... Read more

Answer:Hard drive constant stopping/starting

Hi and welcome,
Did you upgrade to 2GB memory ?
If you have 1 GB mem ... i prefer to upgrade especial when using Windows 7.. that reduces HDD activity,
 
sincerely KalvinKlein 
 

6 more replies
Relevance 56.17%

I finally had to set up a dual boot with Ubuntu so that I could browse the net in peace. The constant clicky-clack of my hard drive drove me nuts. Windows lately has not given it a rest. Ubuntu on the other hand hardly ever causes overuse of the hard drive. Windows needs to get a handle on this problem..

Answer:No relief from constant hard drive activity

"It is not a bug, it is a feature."

Seriously, Windows has many tasks to improve functionality, which cause HDD activity, like indexing, superfetch, cortana/search, windows defender, smart filter, not to mention various logging being sent to MS to improve user's experience. You have to customize it the way you want it, like in Ubuntu, mine Windows is calm.

3 more replies
Relevance 56.17%

I just bought a new computer and installed a graphics card for it(Ati Radeon X1300). I installed Norton Systemworks 2006 Premier. The hard drive has almost constant activity, but no apparent reduced performance. Any ideas?
 

Answer:New computer, constant hard drive activity

12 more replies
Relevance 56.17%

Hello,Last week I started getting blue screens just after start-up. I posted over in the Windows XP area and received help. The problem ended up being with Microsoft Security Essentials. After removing it, I have not had any more blue screen issues. Here is that thread:LinkI am not sure if the problems that I have been having are related. The computer has been running fine, however as soon as I turn on the wireless, or connect through a cable, the computer slows down. The hard drive light indicates that it is constantly being accessed. I've ran Malwarebytes and Spybot and both give no issues.Does this sound like a security issue or something hardware related?Thanks for any help.Emil

Answer:Constant Hard drive access when wireless is on

Download Security Check from HERE, and save it to your Desktop. * Double-click SecurityCheck.exe * Follow the onscreen instructions inside of the black box. * A Notepad document should open automatically called checkup.txt; please post the contents of that document.=============================================================================Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.Make sure the following options are checked:
Internet ServicesWindows FirewallSystem RestoreSecurity Center/Action CenterWindows UpdateWindows DefenderPress "Scan".It will create a log (FSS.txt) in the same directory the tool is run.Please copy and paste the log to your reply.====================================================================================Please download MiniToolBox and run it.Checkmark following boxes:Report IE Proxy SettingsReport FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList last 10 Event Viewer logList Installed ProgramsList Devices (do NOT change any settings here)List Users, Partitions and Memory sizeClick Go and post the result.=============================================================================Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop. * Double-click mbam-setup.exe and follow the prompts to install the program. * At the end, be sure a checkmark is placed next to Update Malwar... Read more

15 more replies
Relevance 56.17%

I have Bitdefender 2008 trial running and have used Uniblue SpeedupMyPC. Can anyone help me please? My pc stands in the living room and the sound of my hard drive is rather disturbing... Please find here my HiJackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 21:01:41, on 9/11/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\CTHELPER.EXE
C:\Windows\System32\CTXFIHLP.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Windows\CNYHKey.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\CTXFISPI.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Wi... Read more

Answer:constant hard drive activity driving me mad!!

I don't see any malware in your HJT log. You do have a lot of programs running in the background that could be started manually.
Check your enabled services (type services.msc in the run box, click ok) with the list Blackviper suggests:
http://www.blackviper.com/WinVista/servicecfg.htm

Rescan with HJT, check this item:
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Close all windows except HJT, then click 'fix checked'. Exit HJT and reboot/restart your computer.
 

2 more replies
Relevance 56.17%

does having raid 0 (data striping) mean that the hard drives run constantly (light and noise every 3seconds, since forever)?
 

Answer:constant hard drive activity and raid 0

First and formeost, it could be nothing; Windows is most likely moving apps around, usually when idle, so if you notice hard drive activity while your doing nothing, then yes it is normal.

I was told you could disable it with Powertoys, but I can not confirm this. If you use XP and want to tinker, we zipped all the toys up: http://www.majorgeeks.com/Microsoft_Windows_XP_PowerToys_d710.html

Drive indexing could cause this as well, if you dont use search much disable it by right clicking a drive or managing its service. Frankly, I dont really think this would cause it constantly, but i disable it for performance because I dont use search.

Finally, we can go old school and blame malware, but you should know if that is a risk or not.
 

3 more replies
Relevance 56.17%

I have recently noticed a problem with my hard drive running constantly while I am on the internet. This makes surfing very slow and annoying because my computer will not do anything until the hard drive finishes whatever it is doing. What can I do to get it to stop running at randum?
 

Answer:Hard drive runs constant while on internet

This could indicate that the computer is busy transfering data around the HD to available space. Increasing RAM could help. Only a thought.
 

2 more replies
Relevance 56.17%

Hi folks. My hard drive appears to be working almost constantly. I have cleaned the pc with ccleaner, defragged and Malwarebytes reports no infections. Any help is appreciated!

Answer:XP SP3 Hard Drive Light indicates almost constant activity

1) Does this happen only shortly after boot or all the while the system is up?
2) What is new or different since the last time everything worked properly (ie, new hw, new sw, virus, error, etc)?
3) Open Task Manager to the Processes Tab and sort on the cpu column with highest usage at the top. Which process is using the cpu cycles?

40 more replies
Relevance 56.17%

Using FileMon, I see that csrss.exe and Norton's Aluscheduler (Live Update) are constantly access the hard drive. And I mean CONSTANTLY! The HD LED is always lit up and flashing. If it does stop, it's for less than 2 seconds and then it starts up again. I'm not sure what csrss.exe does, but I know it's an important Windows service. But why is it (and Aluscheduler) accessing the drive all the time? I know something is amiss somewhere, because I've seen plenty of PC's with both of these files running, and they don't have continuous hard drive activity..... Any help or suggestions will be appreciated.

hopperdave2000
 

Answer:Constant hard drive access in WinXP

Please, need help w/ this... it's making the PC mega-slow....
 

3 more replies
Relevance 56.17%

I was advised in the "Am I infected" thread to start a new topic here so here is the post I made there:
I am running a Win 7 Home Premium PC with the following hardware configuration:

CPU: AMD Phenom II X3 720
RAM: 4 GB
SATA HD: 500GB/ 191GB Free
GPU: GeForce 460XT
AV: Norton Internet Security 2012 & SpyWare Blaster 4.6
I have noticed recently that the lass.exe process continues to "chew" away at my memory over the course of several days. It starts out at around 4,000K and will climb to around 100,000K. I do not believe my PC is running as well as it could either and I am suspicious of this activity.
In an effort to try and fix this, I have done the following:

Full Scan with Malwarebytes: No Threats found
Ran the sasser removal tool from Symantec: The sasser worm was not found on your system
Stoppped a variety of services (too numerous to remember which ones) and watched process explorer to see if the memory would recover.

Thanks for any help or any info you could provide on this

Answer:lsass.exe memory usage higher than normal

Is there nothing we can come up with on this?

5 more replies
Relevance 56.17%

I am running a Win 7 Home Premium PC with the following hardware configuration:

CPU: AMD Phenom II X3 720
RAM: 4 GB
SATA HD: 500GB/ 191GB Free
GPU: GeForce 460XT
AV: Norton Internet Security 2012 & SpyWare Blaster 4.6
I have noticed recently that the lass.exe process continues to "chew" away at my memory over the course of several days. It starts out at around 4,000K and will climb to around 100,000K. I do not believe my PC is running as well as it could either and I am suspicious of this activity.
In an effort to try and fix this, I have done the following:

Full Scan with Malwarebytes: No Threats found
Ran the sasser removal tool from Symantec: The sasser worm was not found on your system
Stoppped a variety of services (too numerous to remember which ones) and watched process explorer to see if the memory would recover.

Thanks for any help or any info you could provide on this.

Answer:lsass.exe memory usage higher than normal

Hello,lets first check for other malware.Please download MiniToolBox, save it to your desktop and run it. Checkmark the following checkboxes: Flush DNS Report IE Proxy Settings Reset IE Proxy Settings Report FF Proxy Settings Reset FF Proxy Settings List content of Hosts List IP configuration List Winsock Entries List last 10 Event Viewer log List Installed Programs List Users, Partitions and Memory size.Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run. Note: When using "Reset FF Proxy Settings" option Firefox should be closed.Please download TDSSKiller.zip and and extract it.Run TDSSKiller.exe. Click on Change Parameters Put a check in the box of Detect TDLFS file system Click Start scan.When it is finished the utility outputs a list of detected objects with description.
The utility automatically selects an action (Cure or Delete) for malicious objects.
The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click ContinueLet reboot if needed and tell me if the tool needed a reboot.Click on Report and post the contents of the text file that will open.

Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log have a name like: TDSSKiller.Version_Date_Time_log.txt.I'd like us to scan your machine with ESET OnlineScanHold down Co... Read more

5 more replies