Svchost Continuously Accesses Hard Drive

[Jorolat]

Hi,

In Windows Task Manager an instance of svchost.exe (with a PID number
of 972) is continuously accessing my hard drive at a frequency of just
under once per second.

With the help I got on a related post I've used tasklist.exe to
establish that svchost.exe (PID 972) has the following components:

AudioSrv, BITS, Browser, CryptSvc, Dhcp,
ERSvc, EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC

Bearing in mind I'm a novice what I would like to do (subject to
advice!) is disable each service one by one in an attempt to narrow
down the source of the problem?

Would this be a realistic way to go about the problem? If so what
would be the best way to do it & would I need to reboot each time I
disable a service?

Hope you can help smile.gif

(nb I've run Avast, Trend, Sophos, McAfee, Spybot and Adaware without finding any problems)

Jorolat

 

[Mictlantecuhtli]

Hi,

Hi,

AudioSrv = Windows Audio - needed for audio,

BITS = Background Intelligent Transfer Service - can be set to manual, needed by Windows Update,

Browser = Computer Browser - can be set to manual or disabled if not sharing files & printers with other computers,

CryptSvc = Cryptographic Services,

Dhcp = DHCP Client,

ERSvc = Error Reporting Service - personally I've set this disabled, it just logs errors,

EventSystem = Event Log,

helpsvc = Help and Support, not needed unless you have tendency to hit F1,

lanmanserver = Server, not needed if not sharing files & printers with other computers,

lanmanworkstation = Workstation, not needed if not sharing files & printers with other computers,

Netman = Network Connections,

Nla = Network Location Awareness, not needed unless you're using wireless networking or something that changes settings often,

RasMan = Remote Access Connection Manager,

Schedule = Task Scheduler, not needed unless you've scheduled tasks,

seclogon = Secondary Logon, not needed unless you need to start applications with different rights than the current user has,

SENS = System Event Notification, I'm not sure which applications use this but I've disabled this myself,

SharedAccess = Windows Firewall/ICS, not needed if you're using 3rd party firewall and not sharing the connection,

ShellHWDetection = Shell Hardware Detection, if you disable this, all CD/DVD drives will show up as "CD Drive",

srservice = this is something I don't have,

TapiSrv = Telephony, not needed unless you're using a modem or a fax,

Themes = Themes, if you use the classic (Win2k) look then you don't need this,

TrkWks = Distributed Link Tracking Client, not needed if you're using FAT32 or if you're not using links with NTFS,

W32Time = Windows Time, not needed if you don't want to set computer clock automatically from the Internet,

winmgmt = Windows Management Instrumentation,

wscsvc = this is something I don't have,

wuauserv = this is something I don't have,

WZCSVC = Wireless Configuration, not needed unless you use wireless networking.

would I need to reboot each time I disable a service?

You don't need to reboot. Just run services.msc (or open Control Panel - Administrative Tools - Services) and change the settings from there.

 

[Jorolat]

Thanks for the info Mictlantecuhtli

I'll try services.msc tomorrow (getting late here) because when I looked at services through Control Panel not all of the ones I'm interested in are listed.

Jorolat

 

[Jorolat]

Today I installed XP slipstreamed with SP2 onto a new hard drive (but I'm back on the old OS & HDD now) and as soon as I installed the modem drivers the svchost disc activity started. I uninstalled the drivers & the problem went away.

I ain't gotta clue why this is so & it'll be a few days before I can spend some time on it. In the meantime, if anyone has any ideas I'ld be glad to hear them!

Jorolat

 

[Nodsu]

See if the modem drivers install a new system service. If it looks unimportant (fax?) then just stop and disable it.

 

[Jorolat]

Hi Nodsu - um, how would I spot a new service being installed? (I'm not too good at this stuff!)

Jorolat