"Working in Background" Blinking Hourglass Issue (svchost.exe related, possibly)

[hqarmstrong]

This issue started about two weeks ago, and has been consistient since then. My cursor constantly shows a blinking hourglass icon (listed as "working in background" in control panel\mouse) which coincides with faint, but audible hard drive access noise... think "heartbeat".

After failing to locate any infection after multiple scans, and then attempting to restore my system to multiple points far prior to when the issue started, I decided to reinstall my OS (XP ME 2002) last night. After two attempts, both including deleting all partitions and reformatting (full) through the built-in Windows XP partitioning utility, the issue persists.

It's causing noticeable system slow-down, even though I don't see any high CPU usage from processes. If I boot into safe mode, it stops. If I start ending processes, it stops only when I end svchost.exe (user name: system and showing the highest mem usage of any svchost.exe, usually 24-30k).

However, when I end that svchost.exe, a box will sometimes popup stating my system will be shutting down in 60 seconds and to save any work I might have. No options. Other times ending the process alleviates the issue for that session.

My initial fear was that this was a hardware (hard drive) issue, but due to the issue not persisting while booted into safe mode I no longer think that to be the case.

Any assistance would be greatly appreciated, and if any further information might be of use please say and I'll respond as promptly as able.

-hqarmstrong

 

[hqarmstrong]

Here's the popup.

 

[momok]

Hi,

I must say your problem is indeed strange, and your log strange too; one of the shortest I've ever seen. Please do the following.

Important: Please read this thread HERE before you decide whether to clean or reformat your system.

Should you decide to clean your computer, please go ahead to Viruses/Spyware/Malware, preliminary removal instructions and follow the steps given. Do follow all the instructions exactly. They will provide logs for analysis of your system so I will know how to instruct you to proceed.

Thereafter, please post fresh HijackThis, AVG Antispyware and Combofix logs as attachments into this thread. Do not copy and paste your logs if not it will be ignored and/or removed.

Also, please let me know the results of the AVG Antirootkit scan


Regards,
Your friendly momok =)

This thread is for the use of hqarmstrong only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[thatonecoolkid]

I have a solution.

I had this problem just recently. I couldn't find any solutions at all on any websites, but I found out how to fix my problem so easily; I thought I'd put it on one of these sites in case somebody else has the problem. This might not work for all cases, but it did for me:

SOLUTION: Enter the password for your Flash Drive (or other password-protected media), or unplug it from the computer.

EXPLANATION: I have a U3-enabled USB Flash drive plugged into my computer. Just a week ago I activated the password protection utility on the flash drive, and now, if I leave the flash drive plugged in when I start up the computer, the cursor blinks constantly with the hourglass. I looked up my processes in Task Manager and the problem is the Shell Hardware Detection service (ShellHWDetection) running under svchost.exe. This service is in charge of AutoPlay functionality such as digital cameras, CD ROMs, etc. My guess is it is trying to run the AutoPlay because it detects a drive plugged in, but it is password-protected, so it can't. The result? It gets stuck and constantly tries to open it.

I hope this helps somebody, because I looked on about 20 different sites and nobody had any answers.

 

[LookinAround]

I had this problem just recently. I couldn't find any solutions at all on any websites, but I found out how to fix my problem so easily; I thought I'd put it on one of these sites in case somebody else has the problem. This might not work for all cases, but it did for me:

SOLUTION: Enter the password for your Flash Drive (or other password-protected media), or unplug it from the computer.

EXPLANATION: I have a U3-enabled USB Flash drive plugged into my computer. Just a week ago I activated the password protection utility on the flash drive, and now, if I leave the flash drive plugged in when I start up the computer, the cursor blinks constantly with the hourglass. I looked up my processes in Task Manager and the problem is the Shell Hardware Detection service (ShellHWDetection) running under svchost.exe. This service is in charge of AutoPlay functionality such as digital cameras, CD ROMs, etc. My guess is it is trying to run the AutoPlay because it detects a drive plugged in, but it is password-protected, so it can't. The result? It gets stuck and constantly tries to open it.

I hope this helps somebody, because I looked on about 20 different sites and nobody had any answers.

thatonecoolkid Good job on troubleshooting your problem so well.

 

[DreamU]

Good Advice

I had this problem just recently. I couldn't find any solutions at all on any websites, but I found out how to fix my problem so easily; I thought I'd put it on one of these sites in case somebody else has the problem. This might not work for all cases, but it did for me:

SOLUTION: Enter the password for your Flash Drive (or other password-protected media), or unplug it from the computer.

EXPLANATION: I have a U3-enabled USB Flash drive plugged into my computer. Just a week ago I activated the password protection utility on the flash drive, and now, if I leave the flash drive plugged in when I start up the computer, the cursor blinks constantly with the hourglass. I looked up my processes in Task Manager and the problem is the Shell Hardware Detection service (ShellHWDetection) running under svchost.exe. This service is in charge of AutoPlay functionality such as digital cameras, CD ROMs, etc. My guess is it is trying to run the AutoPlay because it detects a drive plugged in, but it is password-protected, so it can't. The result? It gets stuck and constantly tries to open it.

I hope this helps somebody, because I looked on about 20 different sites and nobody had any answers.

I just want to confirm thatonecoolkid's advice. I had the same blinking hourglass cursor and found either ejecting the U3 thumbdrive or entering my password cleared the blinking cursor. The most annoying part of this issue is that each time the cursor blinks it closed my Windows file 'Save as/Save in' or 'Open/Look in' drop down box.

I also found nothing on the web, nor this thread, till after I resolved my issue. So here are some more keywords for the search engines: Microsoft Windows blinking hourglass cursor thumbdrive flashdrive sluggish performance dropdown refresh.