WhoDunIt: accessing Drive A:

peterchen

We have a PC here that persistently accesses the Disk drive A: Behavior is persistent for almost a year, PC was replaced in the meantime but problem persists - so I suspect one of the applications running on it. I've ruled out the things obvious to me (searched registry for A:, virus scan). Any idea how to find the culprit? The pattern is not quite clear, sometimes it seems to coincide with (Windows) Explorer activity, sometimes in ca. 5 minute intervals, sometimes nothing. I already tried process explorer to hunt it down, but I couldn't catch it this way. Suggestions?

We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighist

Matthew Faithfull

One culprit could be Quicktime, it wakes up periodically and does some very strange things like enumerating disk drives, including A: and grabbing a bunch of locks in the DirectX runtime which kills the performance of games. I don't know if the latest versions are any better but a I caught it a couple of years ago when I was playing with DirectX dev.

Nothing is exactly what it seems but everything with seems can be unpicked.

Ennis Ray Lynch Jr

Need a C# Consultant? I'm available.
Happiness in intelligent people is the rarest thing I know. -- Ernest Hemingway

Chris Losinger

peterchen wrote:

sometimes in ca. 5 minute intervals,

got any HP printers on that PC ?

image processing toolkits | batch image processing

David Crow

Do you have any AV software running?

"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for, in order to get to the job you need to pay for the clothes and the car and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman

"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne

Douglas Troy

Have you got any Jacks? after those last two posts, I couldn't help myself

:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTL

Shog9 0

Ah, i'd forgotten about that bit of HP madness. Had me convinced of some bizarre virus 'till i tracked it down (and then disconnected the floppy drive). What, is HP running a retirement home for demented VB coders or something?

every night, i kneel at the foot of my bed and thank the Great Overseeing Politicians for protecting my freedoms by reducing their number, as if they were deer in a state park. -- Chris Losinger, Online Poker Players?

Chris Meech

Go Phish. :)

Chris Meech I am Canadian. [heard in a local bar] Donate to help Conquer Cancer[^]

DaveX86

You can get a 'Drive Monitor' utility free at MS Sysinternals: http://www.microsoft.com/technet/sysinternals/default.mspx[^] ...all those utilities are great for sleuthing what's accessing registry, network, drives, etc. Correction: should say "Disk Monitor" Update: The 'File Monitor' one looks like it tells you more than the Disk Monitor -- modified at 14:21 Tuesday 6th November, 2007

Gary Wheeler

Who said they retired?

Software Zen: delete this;

peterchen

for a variety of reasons, it is still necessary (And I guess one of them IS the culprit!)

We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighist

peterchen

not anymore, but drivers/funny software may still be installed. Any details?

We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighist

Shog9 0

Make sure the automatic updater and "share to web" shell extension crap is completely gone.

every night, i kneel at the foot of my bed and thank the Great Overseeing Politicians for protecting my freedoms by reducing their number, as if they were deer in a state park. -- Chris Losinger, Online Poker Players?

Shog9 0

peterchen wrote:

I already tried process explorer to hunt it down

Have you tried Procmon? Diskmon? Filemon? If not, try 'em. In that order.

every night, i kneel at the foot of my bed and thank the Great Overseeing Politicians for protecting my freedoms by reducing their number, as if they were deer in a state park. -- Chris Losinger, Online Poker Players?

Chris Losinger

what Shog9 said. HP has some utilities that wake up every 5 minutes, do something, then disappear. i noticed them when i was playing games: their auto-update thing would spawn a top-level window, then immediately close it. that would send the game to the background and bring up the desktop.

image processing toolkits | batch image processing

UncaDanno

Try checking your MRU lists. Not easy to get them all. You'll have to check the registry and data files, depending upon the application(s). Take a look at your "My Recent Documents" list. Same thing happened to me a couple of years ago. I found a path to a file on the A: drive in an MRU list, removed it, and the floppy drive ghost was exhorcised.

Rocky Moore

You still have a Drive A? ;) Like others have mentioned the SysInternals drive monitor should help you.

Rocky <>< Blog Post: LINQ - Disconnected-Attach, no change tracking fix.. Tech Blog Post: Cheap Biofuels and Synthetics coming soon?

hairy_hats

Not a Compaq is it? My (Compaq) test rig won't go to sleep properly because it keeps flicking the A drive.

springjazzy

Maybe somebody shared Drive A in network with description "Interesting Films" 8)

peterchen

Now THAT's an idea! :D

We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighist