Jump to content

External Hard Drives constantly spinning up and down every few minutes


Treadstone

Recommended Posts

Uninstalled and machine re-booted.
Problem persists unfortunately.


I have attached the latest Process Monitor Log files for the last ten minutes or so of activity since re-boot (both XML and PML versions with Stacks included).


What is very strange since uninstalling Dell Support Assist, is that now the drives are not even spinning down at all. The mysterious read/write/query type activity now appears to be consistent. Although this sux majorly, is this perhaps a clue that some dell software is perhaps involved in the PC calling home to the 5 drives? (because there was a minor change in symptoms).

The fact they are not spinning down at all now is in fact why my reply is so delayed... I have been waiting for them to spin down like usual so I could perform consistency in testing before reporting back as I have been thus far. All I can deduce is that the drives are seemingly now completely ignoring the Windows Power setting to spin down after 2 mins of idle activity (I reduced it from 5mins to 2mins yesterday when I realised this troubleshooting unfortunately for me, may end up being like the 'Never Ending Story' film.

Before powershell is invoked I notice a greater prevalence of the WmiPrvSE service in process monitor this time around (in case that means anything). There just appears to be many more instances of WmiPrvSE before the powershell entries begin.
As I write this, the drives are still spinning which is completely inconsistent with how they have been behaving this whole time you have been assisting me. The removal of Dell support Assist and re-boot took merely minutes (maybe 4-5mins) and I conducted it almost immediately after you posted your last response.

Logfile.zip

Link to post
Share on other sites

The WMI service also showed IP Helper accessing it.  Please try disabling IP Helper as instructed in this article and restart the system to see if it makes any difference.  You can re-enable it if disabling it causes any issues, but it isn't likely to cause any problems.

The next item it showed was your mouse's driver update service.  While I have no idea why it would be accessing your other drives, it might be interacting with your USB controllers/ports in a way that is causing the drives to spin up.  To disable it, use services.msc or Autoruns and disable Evoluent Driver Update Service (displayed as EvoDriverUpdateService in Autoruns) and restart your system.

Once all that is done, launch services.msc again and try to restart the Windows Management Instrumentation service again and see what it shows this time for other services that would need to restart and let me know what it shows (after all these changes it should only show Malwarebytes, but I want to make sure).

If it does only show Malwarebytes, open Malwarebytes and go to settings by clicking the small gear icon in the upper right, then select the Security tab and toggle the option under Windows startup to off and restart the system and leave Malwarebytes off for a while to test and see how your drives behave.  I don't think Malwarebytes is the cause of the issue, but I want to eliminate it as a variable.

Please let me know how it goes.

I've given you a lot to do so just take your time, working on each item as you have time to do so and test to see how it impacts your drives' behavior.  I'm in no hurry so there's no need to rush, just get to it when you have the time.

Thanks

Link to post
Share on other sites

Thanks for the fresh tips to try.

Actions:

  • Windows Backup permanently disabled through Services. I don’t know if this service was running when I viewed it (apologies) but It was definitely enabled to run during startup and is no longer.
  • IP Helper stopped and permanently disabled through Services
  • Dell update uninstalled

Results:

I got excited there for a bit, but unfortunately drives are continuing to do there spasmo consistent spin up and down process.

Link to post
Share on other sites

Though I note the spin time was MUCH shorter. Like not just a little bit... instead of spinning for usually 5-10 minutes each time.
They started up and spun for only around 60 seconds and are now spun down and inactive again as I type this.
Gonna monitor a few more cycles if they happen. Fingers crossed they don't happen and you've performed a miracle.

Link to post
Share on other sites

I am getting VERY excited Exile. It has been 30 mins since I made that reply post to you and the drives have not spun up once since.
I appreciate this is not enough time or enough computer use to determine if the problem has been eradicated as yet and although tempering my expectations, I'm optimistic.
If this works it will a case of you, like Jackson... having discovered the Seventh Symbol.

Link to post
Share on other sites

Sounds like a plan.  One more thing to try would be to shut down the system, unplug all of the external drives, boot the system back up with the drives unplugged and allow everything to settle down so that the system is fully started and idle, then try plugging the drives back in just to sort of reset everything as far as how Windows handles the drives to see if that makes any difference.  We've made a lot of changes, so such a fresh start would probably be a good idea.

At the very least it seems we reduced the amount of access to the drives, so we're definitely moving in the right direction.  I just hope that we're able to get things to fully get back to normal for you.

Link to post
Share on other sites

I’ve returned from shopping and once home, ran the process monitor log for the last half hour which shows it’s same old tactics again of calling the drives pretty regularly.

I saved that half hour Process Monitor log as the proprietary format, I forget what the extension is (same as last time) and as and xml if it’s helpful to view.

However unfortunately I believe it may only show the same process we’re already aware of but haven’t pinned down the cause of. The entries look the same to me.

I shut down and did what you said reconnecting the drives again one by one unfortunately to no avail it would seem.

Even though I am still plagued by this problem and it’s stressing me out, I would like to give you some already proven positive results amongst this.

In removing all that (let’s call it crap).. the processes under ‘Log On’ you have increased the boot time by an absolutely astonishable amount.

Once I log in to the Windows 10 OS from the password screen, there is no loading or anything that remains anymore. It’s almost instant.

The whole OS is simply saying “I’m here and ready, I was ready ten minutes ago, what would you like me to do now.” :) Thank you for that. 

Please let me know if you like me to upload that log or run any others or do anything else at all to rid the Dell XPS of this evil. 

Link to post
Share on other sites

Nice, well at least we improved the laptop's performance (hopefully that might help a bit with your heat issues too).

Did you try disabling Malwarebytes yet?  If not, please do so now and test to see if it has any impact on the drive issue in case it is some kind of problem with the latest Malwarebytes release and your system.

One more thing to look at would be the laptop's power settings, particularly the USB suspend feature.  Instructions on doing so can be found here.

Link to post
Share on other sites

USB Suspend:
I went through this one myself and ensured it was enabled during my troubleshooting. I’ve just checked and it’s still enabled.

Intel Driver and Support System:
My apologies. Human error on my part, I didn’t pick up that we were uninstalling this one and I simply disabled the service in Autoruns. I checked it again in Autoruns this morning and there were two instances (one checked and one unchecked). I have now completely uninstalled it.

Evoluent Mouse Listener
My apologies again. Similar human error to above, I disabled the Manager first time around after your instructions and not the listener. Both are now confirmed disabled.

I performed a fresh boot after the above changes this morning and problem perists.
Behaviour to note: PC spin’s drive when booting (as it recognises them all) then they spin down for approximately 2 mins, before going in to their usual cycle of spinning up again approx. every 7-8 mins (for a period of around 2-3 mins) with the same calls we’ve been witnessing visible within the Process Monitor application.

Thermal feedback:
Fans still rev like normal when performing basic tasks like simply opening Windows Power settings as the only thing I am asking the PC to do. Though not revving at maximum, still displaying non optimum behaviour as they always have while the CPU Temp is sitting between a very non worrisome range of 52 and 56 degrees celsius. But lets continue to leave this issue for now as its separate. I just didn’t want you to wonder and wanted to give you feedback because you mentioned it in your reply.

Despite having made an exception in Malwarebytes for each of the 5 drives. I now want to disable Malwarebytes as you recommended but am unsure where best to do this.
Strangely I can’t see the service under Logon tab of the Autoruns application where we disable everything else.
Should I go to Windows 10 Task Manager and disable all Malwarebytes reference I can see in there from loading during startup or should I use the Malwarebytes GUI? (I don’t think it allows you to do it through the Malwarebytes GUI).

Link to post
Share on other sites

Use the Malwarebytes GUI.  Go to settings by clicking the small gear in the upper right, then select the Security tab and disable the option under Windows startup and then restart your system and Malwarebytes should not launch when you restart your system.  Once you're done testing you can reinstate Malwarebytes by toggling the same setting back on and restarting your system.

Link to post
Share on other sites

Sorry Exile this is long...

HI Exile. I disabled Malwarebytes as you suggested and rebooted.
Unfortunately the problem persisted.

It was then that I commenced troubleshooting the USB hub itself. Although convinced the cause of the problem is software related it’s just human nature to start questioning and testing everything when you can’t find the source of a problem. I tried flash drives with it and tested its power supply was working correctly, which it is.
The hub appears perfectly fine.

I then accessed all of the five the drive’s contents to look for anything unusual.

Sure enough I found something on I:\Drive (Volume name ‘WRETCH’)
Screengrabs attached of it and the subfolder within.

Whether it’s related to the problem or not, it’s appearance within the root folder of one of the drives was VERY surprising. This is because the root folder always only contains two folders ‘VLC media players’ and ‘TV Series’ with all the contents of the drive within these two folders. The contents of the two folders are only ever video files and different versions of VLC media player.

I access the drive regularly enough to know I have never had one of these folders appear and furthermore it appeared within the last week which is the period the problem surfaced and you and I have been troubleshooting this issue.
Strangely it was not written to any of the other four drives.

I looked up what it could be and why it has been written to one of the drives but my limited knowledge is not enough to establish if it was threatening or even related to the problem.
Based on what I read it appears to be a standardised Windows write that caused it but it’s creation amidst the timing of this drive spinning problem has me wondering why it was written and if it’s related.

Cautious of what it might have been before I even looked it up, I took screen grabs and then used ‘Eraser’ do demolish it. It’s now gone. I hope that was not detrimental to troubleshooting. If it was I’ll have to apologise and wear that. The folder was Zero Kb in size before removal.

After writing this I plugged in the drives for another test before posting this to you. As I sit here now, strangely I noted only two of the drives were spinning during this test. I have been testing them all by putting my palm to each and feeling for vibration during every test.

This time, 3 out of the 5 were free of vibration and remained spun down. So I immediately opened the properties of both of these drives to hunt for inconsistencies with the others under any of the settings. To my horror (due to potential embarrassment) I found that indexing was turned on for both of them. D:\ ‘RED SUN’ and I:\ ‘WRETCH’. I have no explanation for this other than the obvious one likely human error on my part because I cannot think of any other way it happened. I must have simply applied it to three out of the four during my panic driven, erratic troubleshooting before you commenced assisting me.

I immediately turned off this feature for both these drives which took a VERY long time to complete on my work drive ‘RED SUN’ as Windows 10 visibly processed all the files. I was significantly  disappointed to have to turn it off indexing on RED SUN as it’s the only drive I ever need to search for files on and it’s very helpful, but troubleshooting is far more important than the convenience of this and if this is not solved I may not have a drive to search after some time.

I then checked that the other three drives remained how I had set them (which was indexing off) and it was off for the others. I’m boggled, because if this was the root cause, my brain asks why were the other three drives spinning (all 5 have been spinning) throughout this entire week of PC problems and troubleshooting. I note the strange folder I mentioned earlier in my response was found on ‘WRETCH’ which was one of the one’s where indexing was found to be on. (In case that helps with troubleshooting).

It was at this point, while observing the drives were spun down and had been for at least ten minutes, I decided to open the Malwarebytes application for the first time since turning it off so that I could reactivate it and re-boot and see if the removal of the indexing feature (although only found as being active on two of the drives) somehow fixed the problem with all of the drives. I was just opening Malwarebytes ready to turn it on and re-boot and as soon as the Malwarebytes application executed, all the drives started spinning up and stayed spinning for about 60 seconds (much shorter than usual) before spinning down (not sure if that eludes to Malwarebytes being responsible for all this, but that’s why I mentioned it – just in case.)

I was about to re-boot with Malwarebytes activated to test the removal of indexing feature from two of the drives as a standalone protentional fix, but exhausted I fell asleep but not before ensuring I left process monitor running full screen so I could see event logs when I woke today.  Can’t hear all the drives start up over the CPU and GPU fans unless I have my ear right next to them so I left process monitor running for the reason previously mentioned and my lack of ability to distinguish the audible spinning noise.

BTW (side note) the drives spin up for about 60 seconds every time I close the Process Monitor application. Is that normal?

I woke today to find far fewer entries in the Process Monitor log, like gargantuanly less. And while sitting at the PC this morning continuing to type this which I carried on my from last night, I am observed nil startup of the drives spinning except when I closed Process Monitor Application. (Note - Malwarebytes is still turned off during this).

Before shutting it down, I tried exporting the Process Monitor log for you to see the very few times the drives appeared to have been queried throughout the night and the exporting went up to only 2% in about 45mins of waiting ☹ (no idea why), so I scrapped that idea and have attached screengrabs of the log entries I took before I went to sleep last night which were much the same as what I saw this morning.
This I note about the entries with my limited knowledge is the complete absence of Powershell.exe being present anymore. I can’t even find an entry with it. Additionally I note that a many quries now appear to be denied with a return statement of ‘File does not exist’. Though I am not sure what any of this means. Also, no matter what alternative configuration I apply with the checkboxes in the ‘Select Columns’ feature of Process Monitor I cannot seem to sort events chronologically as they appear by time. It does it for some and then a bunch which appear after a certain time with their time stamp showing they took place before the events above it.

I will now re-boot with Malwarebytes activated to hopefully determine if the problem’s cause can be isolated to Malwarebytes activation on startup. The drives are not starting up at all still as I type (much better behaviour than the last few days) indicating the problem has been eradicated temporarily but I fear it will return as soon as I activated Malwarebytes and test after this boot in a moment. We appear to have isolated the cause to either the indexing or Malwarebytes which is somewhat relieving.

I’ve just gone and opened Malwarebytes as I’m about to connect to the net to post this to you and the drives started up as soon as I excetured the application. I’d say it’s a pretty sure fire bet Malwarebytes is the cause right? I’m not sure what I can do to fix that as I’ve already made exceptions for all five drives in the Malwarebytes program itself and as you know I can’t live without protection. Quite the pickle.

As soon as I connected to the web I got the Malwarebytes alert stating a new version of Malwarebytes is available and I have just clicked download and install. Maybe they realised something was wrong in that release and have fixed it overnight? Or is that fanciful and wishful thinking?

Will still make sure Malwarebytes is activated this time and re-boot after I post this now and then monitor drives again.

Capture.PNG

Capture2.PNG

Process Monitor.PNG

Process Monitor 2.PNG

Malwarebytes.PNG

Link to post
Share on other sites

I'm convinced it's Malwarebytes.
After a re-boot with Malwarebytes activated, the drives did not spin up for 40 mins becuase I started a stop watch (except for spinning up once when Windows started).
I then wanted to see if I could get the problem to rear it's head, by performing daily tasks like locking my work station (as I do when I got to work).
After ten minutes of it being locked (and still while locked) all 5 drives drives spun up for around two minutes. This was 50 mins after boot. Much different to the problem behaviour for the last few days but still unacceptable and myserious.

I opened process monitor and took a screen grab immediately after this spin up and this is what showed... Powershell.exe rearing it's head again.
Note: All instances of Powershell.exe. are never present in Process Monitor when Malwarebytes is disabled.

 

 

Capture.PNG

Link to post
Share on other sites

As a side fix attempt am wow installing WD Drive utilities because one forum said WD drives completely ignore Windows 10 Power Options settings to power down drives after the amount of minutes you input. The fix they said was to download this program which allows you to set the time for WD drives to spin down (Worth a shot I guess) strangely i never needed this before though.

File Size: 15.7 MB
Version: 2.0.0.76
Release Date: 08/24/2020 | Release Notes
Link to post
Share on other sites

If Malwarebytes is causing it, it's most likely the Ransomware Protection component causing it.  To test, try disabling Ransomware Protection in Malwarebytes by right-clicking the Malwarebytes tray icon and clicking where it says Ransomware Protection: On and click Yes when prompted by User Account Control.

It may be that a recent change in Windows and/or Malwarebytes is at the heart of this issue because, if something in Windows is accessing the drives, Ransomware Protection might become active to monitor the disk activity to look for ransomware behavior.  With all of that said, to be frank, while Ransomware Protection is a great feature, it is also pretty much the least proactive component in Malwarebytes' protections due to the fact that it looks for ransomware behavior that could only occur if a ransomware infection actually got into your system already and attempted to encrypt files on your drives, so disabling it shouldn't reduce your level of protection by a great degree (because the other, more proactive protection components should be capable of preventing ransomware from getting into your system, particularly since the vast majority of ransomware is distributed using exploits; something Malwarebytes is particularly proactive against thanks to one of its most proactive protection components, Exploit Protection).

If it comes down to it, if it resolves the issue, you can disable Ransomware Protection and keep it disabled.  It is up to you of course, and if you aren't comfortable disabling it then don't, but if it fixes the issue you might find it worth it to do so, and in the meantime I can report this issue to the Product team in the hopes that this is something the Developers can address.

If you do decide to keep it disabled, you'll likely want to disable alerts about it being disabled to avoid constant alerts about it.  To do so, open Malwarebytes and go to settings by clicking the small gear icon in the upper right, then select the Notifications tab and disable the option Alert me if any Real-Time protection modules are turned off.

I would also note that shortly after installing the most recent Windows Updates released this week, I noted that the indexing and Windows search functions started going kinda nuts on my own system, cranking pretty hard on the CPU (enough to cause my own fans to speed up) so I completely disabled all search and indexing components to resolve it.  I've never seen this behavior before so I suspect it was due to an update Microsoft made to search rather than just the new update files being indexed, but perhaps I'm wrong; I just know I've never seen this behavior before, even after adding many files to locations that are indexed (it's normal for indexing to index the new files, but the CPU usage was clearly higher than normal this time around).

Link to post
Share on other sites

Unfortunately the drives continue with their random spin ups. After 24hrs of this activity and associated monitoring, I’m going to unplug them all again.

All I can think of is to keep them unplugged for an extended period of time and hope that either a future Windows, or potentially Malwarebytes release gets them back to behaving how they have been for the last few years which was lying dormant and spun down unless intentionally accessed by the user (myself). 

It just appears to be a bad tech month in terms of problems.  iPhones including mine are sporadically not charging since the iOS 14.2 update. It’s plaguing users (visible here). 

https://discussions.apple.com/thread/251811831?login=true&page=2

Friends of mine and work colleagues are included in the victims of this failure with ppl having thrown out perfectly good chargers in response, all before they knew. 

Yet... not a peep from Apple so far as far as acknowledgement or a bug fix destined for this Monday’s coming release of iOS 14.3.

With multiple significant tech problems on different platforms arriving in life at once, and each causing sustained irritability... one can only laugh to stay sane :)

Any new ideas you have in the drives issue Exile I will of course receive an alert, read them and apply to test right away. Thank you for all your help to-date. I cross my fingers we don’t have to concede to defeat and some way, some how this will be solved. 

Link to post
Share on other sites

Wow, that's not good.  I hope your phone is able to charge soon.

I have another option for you to try with the drives that might be worth a try.  Now that you have them disconnected, try removing them from Windows via the info found in this MS Technet post using Nirsoft's USBDeview which can be downloaded from here.  Once that is done, each device should connect to Windows as though it were the first time (so be sure to connect them in the order you want them to be in with regards to their drive letters and ports etc. in case you want the drive letters to be the same).  If you choose to do this, you'll need to extract USBDeview and then right-click on it and select Run as administrator and click 'Yes' to the User Account Control prompt, then locate the entry for each of the drives and right-click on each and select Uninstall selected devices.

Honestly though, given the sudden onset of this issue it may just be a matter of a Windows Update causing it, in which case there probably isn't too much we can do as I would not advise removing any updates just because it could potentially compromise the system's security and stability.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.