[Skill&determination]

While running a DELL Inspiron 1150 laptop with 256MRAM and P4-2.8Ghz with Win XP home SP1.

My problems is the disk I/O light flickers every second, even when nothing is running, no mouse movement and no internet connection.

Further investigation has revealed that LSASS.exe is doing about 3 reads and write per second. With CSRSS.EXE doing a little here and there. I have run norton AV and AVG and found no virus (both where upto date). I've also run Ad-aware and Spy bot S&D - clearing the minor items, without any change to the read/writes. I've run HJT clearing suspicious items- without effect.
This activity also occurs in safe mode -although task manager shows no I/O the HDD light flickers and while sitting at the log-on screen. I have disabled everything in sight (devices and services) without effect.
I've searched a fair bit on google and here without a solution.

Can anybody help stop this disk access?

[Advertisements]

Same happening to me and I have also done a Virus Trojan Malware etc check and there is none. I Dont think it has much to do with malware more to do with the RAM and Programs you have.

How much RAM have you got ?

Is there a specific reason that you are on SP1 and not going to SP2 as it has more security features.

Have you got your HJT log checked out by the Malware Experts Here /

[cleverboy12]

Same happening to me and I have also done a Virus Trojan Malware etc check and there is none. I Dont think it has much to do with malware more to do with the RAM and Programs you have.

How much RAM have you got ?

Is there a specific reason that you are on SP1 and not going to SP2 as it has more security features.

Have you got your HJT log checked out by the Malware Experts Here /

[Pi rules]

Try going to Start/Run and type sfc /scannow. I doubt it will work, but it's worth a try.

[Skill&determination]

Thanks for your replies,
I forgot to mention a few things that I have tried, SFC /scannnow was one- without success.
I have 256M RAM, and a Lexmark printer.
I intend to go to SP2 after this is resolved.

My HJT log is:
Logfile of HijackThis v1.99.1
Scan saved at 9:21:32 AM, on 2/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

Still my HDD light flickers!- ad-aware and S&D were put on to resolve this issue.
Thanks for your attention.

[ukbiker]

Hi There

We do not offer HJT analysis in the Off Topic Forum. If you think you have a malware problem, then please go to the Malware Forum and follow the instructions at the top....Especially the section labelled "START HERE".

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- post a hijackthis log in THAT forum, not in Off Topic.

[Skill&determination]

I gave up and enough is enough and would have to live with it, so I installed SP2 and things went from bad to worse. It would not boot- tried doing the repair - no good either.
So it was re-install time. Guess what our rythmic disk access was back after a re-install!
I was able to stop LSASS and friends from showing any IOs (by disabling terminal services and a few other) but the disk access light continues to flicker with nothing seeming to be responsible.

I assume that it must be a Dell issue, and I dont want to update the BIOS (after SP2 fiasco), so it will have to be lived with.

Please consider this issue closed and thanks for the suggestions.

[ScHwErV]

We are glad that you got your problem figured out, but your issue could have been solved by our malware staff without the format and reinstall.

Your problem is software related, so its not Dell's fault. Why is that everyone wants to blame the computer?

For future reference for you and for anyone who reads this. We do not recommend the upgrade to SP2 until you make sure your computer is malware free.

Since you have resolved this issue and requested that this thread be closed, it is.

ScHwErV