jukken Posted December 29, 2007 Share Posted December 29, 2007 In my windows XP installation, the system harddrive constantly (every 3 sec about) writes to the drive. This ofcourse makes alot of unessessary noise.Nothing special is running according to the taskmanager (system waitprocess is using 99% cpu).When I check what is accessing the harddrive at these intervals (using sysinternals FileMON)...it is the files NTUSER.DAT and NTUSER.DAT.LOG that is cousing these constant harddrive-writing.Why is it doing this, and how do I fix it? Extremly annoying. Link to comment Share on other sites More sharing options...
Tarun Posted December 29, 2007 Share Posted December 29, 2007 Have you defragged recently? Link to comment Share on other sites More sharing options...
jukken Posted December 29, 2007 Author Share Posted December 29, 2007 The installation is very new...and there drive is not used for anything but the system.It is not fragmented. Link to comment Share on other sites More sharing options...
Joe K Posted December 29, 2007 Share Posted December 29, 2007 I've found a clean install and then loading software does fragment the drive a lot. Defrag is a simple quick step to take before looking deeper. I defrag at least once a week. If I've done complex stuff like video or photo editing I run after I finish.Joe Link to comment Share on other sites More sharing options...
jukken Posted December 29, 2007 Author Share Posted December 29, 2007 Drive is now defragged. Fragmentation at 0%.No change at all, system is still constantly accessing NTUSER.DAT. Link to comment Share on other sites More sharing options...
spacesurfer Posted December 30, 2007 Share Posted December 30, 2007 Is the drive new or old? If old and making noise, depending on type of noise, your HDD may be failing. Link to comment Share on other sites More sharing options...
jukken Posted December 30, 2007 Author Share Posted December 30, 2007 It is brand new (Seagate Cheetah 15k.5).The problem is the drive is accessed constantly by the system...even when totally idle.This was not the case when I just installed windows.I really don't want to reinstall windows again to get rid of this. Link to comment Share on other sites More sharing options...
Mijzelf Posted December 30, 2007 Share Posted December 30, 2007 NTUSER.DAT is a part of the registry. Probably some software is constantly updating some register key, causing the System to write it to file. You can use RegMon to find out which program. Link to comment Share on other sites More sharing options...
jroc Posted December 30, 2007 Share Posted December 30, 2007 indexing service will do that too...see if your have that in the services...usually it will continue until it done..sometimes it takes a while..then settles down once in makes a complete index...you can set it to 'disable' or 'manual' in the services Link to comment Share on other sites More sharing options...
jukken Posted December 30, 2007 Author Share Posted December 30, 2007 Indexing service is not runningThese are the ones that is mostly active according to RegMon (gets on list when drive makes sound):C:\WINDOWS\system32\services.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\nvsvc32.exe Link to comment Share on other sites More sharing options...
cluberti Posted December 30, 2007 Share Posted December 30, 2007 C:\WINDOWS\system32\services.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\nvsvc32.exenvsvc32.exe is the Nvidia driver helper service, and I think this is your culprit - and here's why:- services.exe will be listed any time a service is accessed (nvsvc32.exe is a service)- svchost.exe will be accessed any time the nvsvc32.exe is accessed - not sure why, but I've found a few posts on the net stating that the nvsvc32.exe binary uses something in a shared svchost (probably RPC or COM)- lsass.exe is invoked when a read or write to a user's registry is done by a service (nvsvc32.exe is a service)Try setting the Nvidia Display Driver Service to manual or disabled and stop the service (from services.msc), and see if the problem goes away (it seems likely that it will) Link to comment Share on other sites More sharing options...
jukken Posted December 30, 2007 Author Share Posted December 30, 2007 Did it.No change.Especially120.04818726 lsass.exe:960 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Access: 0x20019 120.04819489 lsass.exe:960 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFFER OVERFLOW 120.04820251 lsass.exe:960 CloseKey HKLM\SECURITY\Policy\SecDesc SUCCESS Pops up all the time Link to comment Share on other sites More sharing options...
Jeremy Posted December 31, 2007 Share Posted December 31, 2007 Network virus? Link to comment Share on other sites More sharing options...
jukken Posted December 31, 2007 Author Share Posted December 31, 2007 I uninstalled .Net Framework 1.1Much better now.Crappy network system. Link to comment Share on other sites More sharing options...
cluberti Posted January 1, 2008 Share Posted January 1, 2008 120.04818726 lsass.exe:960 OpenKey HKLM\SECURITY\Policy\SecDesc SUCCESS Access: 0x20019 120.04819489 lsass.exe:960 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFFER OVERFLOW 120.04820251 lsass.exe:960 CloseKey HKLM\SECURITY\Policy\SecDesc SUCCESSThat's really, really odd.Wonder why .net would be trying to look up a SecDesc ACL on something... Have I mentioned that is odd? Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now