Solved What is it that's booting up my external hard drives?

[tbcam88]

Hi,


I currently have two USB hard drives (1TB WD - 1TB Maxtor) which both power down after 5 minutes of inactivity or so.

However, every now and again one of them will boot up and begin spinning while the computer is still sitting idle. I've had a look at MSCONFIG/Task Manager and cant see anything obvious which would be responsible for this behaviour. Is there any way I can determine which process is causing the drives to power up again? A utility for example that could detail which processes are linked to each device?


Many thanks.

 

[tbcam88]

No one?

 

[madcratebuilder]

Look in MSConfig, both "startup" and "services" WD installs two or more programs for the external drives, those may be the reason the drives wake up.

 

[tbcam88]

Hi,


I've had a look in both but other than Microsoft's services, all that's running is:

Realtek HD Audio Manager
Apple Mobile Device
Norton Internet Security

It could may well be Norton that's the culprit since it insists on performing background checks irregardless of how you configure it.

I was hoping there was a utility available which could inform of processes as they launch. That way I could determine what it is that's causing the issue next time the drive goes to power up.

Guess I'll just need to disable processes one by and one and try decipher what it is that's responsible.


Cheers.

 

[madcratebuilder]

Try it with Norton disabled. I would recommend you remove Norton and go with MSE and Malwarebytes, both are free and work well together.

I have MSE and MBAM running and well run SuperAntiSpyware about once a week to catch anything the first two miss. Only thing that I ever see is adware that if MBAM doesn't kill it, SAS does.

 

[Mark Phelps]

Norton has the ability to disable scan on drives. As a test, I would disable the Norton scan and detection for the two USB drives and see if that prevents them from being wakened. I have that on my PC as I have some very large USB drives and don't want to scan them over and over.

 

[tbcam88]

Try it with Norton disabled. I would recommend you remove Norton and go with MSE and Malwarebytes, both are free and work well together.

I have MSE and MBAM running and well run SuperAntiSpyware about once a week to catch anything the first two miss. Only thing that I ever see is adware that if MBAM doesn't kill it, SAS does.

Norton has the ability to disable scan on drives. As a test, I would disable the Norton scan and detection for the two USB drives and see if that prevents them from being wakened. I have that on my PC as I have some very large USB drives and don't want to scan them over and over.

Norton is certainly a likely candidate. I plan to temporarily disable it altogether and see if that makes any noticeable difference.

Meanwhile, I've recorded a Task Manager "before and after" log with regards to everything running when the drive(s) begin to act up.

So far, the only processes active which didn't seem to be in use beforehand are:

dllhost.exe
trustedinstaller.exe
msiexec.exe
wmiprvse.exe
searchfilterhost.exe
searchprotocolhost.exe

Mark, how is it you disable Norton from auto-scanning drives at will? The only two relevant settings I can find with regards to background scans can be seen below. Are there any further configurations you're aware of? (NIS 18.7.2.3)

Cheers.

 

[Britton30]

Try disabling Network Drives Scan.

 

[tbcam88]

Try disabling Network Drives Scan.

Roger that!

 

[NoN]

Found that tutorial that might help you trace events:

Devices - See Devices that are able to Wake Up the Computer

Also, is there some "Allow Wake Timers" set in your power plan settings turned ON?

 

[tbcam88]

Found that tutorial that might help you trace events:

Devices - See Devices that are able to Wake Up the Computer

Also, is there some "Allow Wake Timers" set in your power plan settings turned ON?

That's a neat CMD script matey but it seems to be in relation to waking the computer from sleep status (same with the "Allow Wake Timers" setting), in my case the computer is still running as normal (just sitting idle while I'm AFK).

Gonna have to go through the processes one by one me thinks. I'll start with Norton, that seems most plausible!

Cheers.

 

[Ex_Brit]

Could it be Windows Defragger?

 

[tbcam88]

Could it be Windows Defragger?

Hmmmm... Had a look but it seems to be disabled from scheduled runs.

Could it be active elsewhere do you think? Windows Defender is disabled also...

 

[Ex_Brit]

Do you have any software that looks for files? I was just wracking my brains to think what the heck this would be, sorry I can't be of more help.

 

[tbcam88]

Do you have any software that looks for files? I was just wracking my brains to think what the heck this would be, sorry I can't be of more help.

Yeah, it's a tough one mate. Got me stumped so far... Can't think what else could be responsible, there's nothing obvious at present anyway. I'll start with Norton and report back with results. Thanks for the input!

 

[Ex_Brit]

Could be the real-time scanning in Norton.

 

[tbcam88]

Could be the real-time scanning in Norton.

Turns out you can't fully disable Norton... In order to exit the program completely I would need to uninstall it (last resort!).

I'll try running "Silent Mode" first and foremost. This cancels all alerts/background scans. Fingers crossed!

 

[Ex_Brit]

No idea about that, sorry. I use McAfee and I can uncheck Network Drives from the real-time scan, external media I can set it to only scan files as I use them.

 

[tbcam88]

Progress! I stumbled upon the "Resource Monitor" earlier which does pretty much exactly what I was looking for.

As you can see, it was "svchost.exe" which caused the G:\ drive (Western Digital) to wake. I can't find this "$Mft" directory present on the drive, however.

Both "Show hidden files and folders" and "Hide protected Operating System files" are set accordingly so I can't quite out why this is the case...

Anyone any ideas?

 

[NoN]

Have you try to run CHKDSK System file checker on that particular disk?

Also could be Superfetch, Shadow Copy running in the background, looks also the PID is low and some tells it is normal

There's related infos here

There are a couple of things that Windows does in the background:

• Search and install updates,
• Index documents for search,
• Prefetch frequently used files,
• Defragment the hard drive.