100% Disk Usage. PC crippled. Even Ctrl+Alt+Del cannot be invoked

[dean]

Multitudes of edb.log and edbtmp.log files.
I tried to trick it. Thing is, a successful reboot - even in Safe Mode - can get it on the path to recovery. While in a happy Safe Mode, I ran the new lazier SFC which was too lazy to give me a report - just leaving a "100% completed" on the screen when it reached that point.
After the reboot from Safe Mode to the regular Windows desktop environment it seemed to work for a while and I left it alone and went clean the bathroom and toilet. When I returned, it was totally crippled and thrashing my HDD again.
Unfortunately, once it's full-on cranking, and desperately trying to take down the HDD, there's nothing one can do except a hard reset - which continues the never-ending loop.
Got a few black screens as the entire Windows environment slowly undoes itself, with me getting the usual Microsoft Windows is not responding [a close leaves either a black screen with a mouse cursor or solely desktop wallpaper without a mouse cursor] and Ctrl+Alt+Delete eventually (after about ten minutes) returns a fail notification.
I okayed the fail and Windows seemed to go back to normal, with all the programs I'd clicked now visibly open.
One thing, I now have an "explorer.exe: Server execution failed" error on screen. Just what server might that be, considering I have a straightforward localised set up with only Windows Update and a time synchronising server linked to Explorer - as far as I know.

 

[dean]

I said before, XP x64 is a rock and I'm not exactly sure what you mean by "more holes", as it's got the same ports as any!?! Could you explain what you mean, which I may have overlooked?
I'm sticking with 7 and moving over to my Linux and Unix machines after gaming support finally overtakes Windows. The benefit of 7 is efficient operation. It's a shame they shagged everything else up, but I guess they learned from guys clinging to XP x86 and (the few, like me, which have) x64 and not buying their Vista junk. 8 is simply databasing spyware dressed up for Mac'tards and damage-phone suckers. The Worshipful Company of Information Technologists can f'off as far as I'm concerned. My final upgrade will have last available Gigabyte BIOS board I can fit my stuff into. After which, I'll leave this sick sick world of malicious tech' which once seemed so promising. I will not be locked down or spied upon by the industry, nor rooted by some malicious third-party through UEFI
Anyway...
I would have used SysInternals software if only the computer could run it at the time - which it couldn't.
Now, after finally receiving an "explorer.exe: Server execution failed", the computer simply started working again!!!???!!!

 

[Shintaro]

Ok, edb.log files are usually to do with MS Active Directory, unless they are in the C:\WINDOWS\system32\CatRoot2, which is the Windows update directory.

So the fix from MS is HERE for the "explorer.exe: Server execution failed".

Or simply a couple of registry entries pointing to a bad location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal

(On my pc the reg value is: %USERPROFILE%\Documents)

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal

(On my pc the reg value is: C:\Users\User\Documents)

https://support.microsoft.com/kb/2444677/en-us

However further reading found that it is often a corrupted user profile (worst case), meaning to delete the user profile then re-create it.

No, I don't mean network protocols accessing ports on a computer. I am talking about poorly written code that hacker finds a way to manipulate that weakness to gain full or partial access to your computer. Whether that is done by a flash / Java / explorer exploit or some other software that access the internet, it doesn't matter. Companies will stop updating code for XP.

But that doesn't matter now as you are on Win 7.

 

[dean]

Ok, edb.log files are usually to do with MS Active Directory, unless they are in the C:\WINDOWS\system32\CatRoot2, which is the Windows update directory.

So the fix from MS is HERE for the "explorer.exe: Server execution failed".

Or simply a couple of registry entries pointing to a bad location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal

(On my pc the reg value is: %USERPROFILE%\Documents)

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal

(On my pc the reg value is: C:\Users\User\Documents)

However further reading found that it is often a corrupted user profile (worst case), meaning to delete the user profile then re-create it.

No, I don't mean network protocols accessing ports on a computer. I am talking about poorly written code that hacker finds a way to manipulate that weakness to gain full or partial access to your computer. Whether that is done by a flash / Java / explorer exploit or some other software that access the internet, it doesn't matter. Companies will stop updating code for XP.

But that doesn't matter now as you are on Win 7.

Well, I have no worries, as all vulnerabilities in such things are locked down and not OS dependent anyway, and I've never seen a virus except those which came in fraudulent file shares and they can't run anyway. I never allow resident antivirus to run. Always disable it. The only thing antivirus ever does is flag firmware flash updaters and "scene" productions as viruses anyway. Fear of viruses only exists to sell utter crap like McAfee and Norton to fools - who then still manage to install shite on their systems through toolbars and those malicious Java/Flash game sites. A good HIPS and firewall handles all sorts of crap like that and, besides, anyone who knows anything knows that MS ActiveX crap is the biggest vulnerability in XP and, once it's switched off, the OS security is up and close to most.
Anyway, thanks for the other info.
As *I* haven't screwed up my profile, I won't be doing any fire-fighting on behalf of any MS incompetence, but I'll bear it in mind the next time shit gets weird.

 

[dean]

Just looked at the MS fix page and it looks like the moving of My Documents is a prerequisite to their instance, so that wouldn't apply to my set up. I haven't messed around with any part of the standard directory structure for a single OS install on a single drive. I do have half the drive left raw for either a PC-BSD install or SteamOS install but, as it's still raw, Windows ignores it aside from acknowledging it exists in relation to the size and position of the formatted drive which it is using.

 

[Shintaro]

Mate,

When you say that you lock down the PC, what are the changes that you make?

It would be good for people to see what you have done to protect your PC.

 

[dean]

The thrasher is back!
Sometimes you can trick the machine into logging off or shutting down but have to wait maybe 1/2 hour for that to complete.
Hard reset is no option as the thing never seems to conclude when that is done.
I thought I may have some success after getting the machine to shut down on its own last night, though, unfortunately, forgot to turn the screen on, was using this WinXP x64 (Server 2003)-based computer instead and only remembered I'd already booted it when I tuned to the thrashing over this laptop's close proximity fan.
[Without any disk activity, my Win7 machine was built to be pretty damned silent running with the tower side panel off, even though I have one Noctua fan as a safeguard on the passive CPU cooler and the Platimax PSU has a fan in it.]
The thrashing begins at the login screen. Because I'd neglected it and allowed it to get hold of the machine, it took around five minutes to get from the "logging in" message to a black screen with cursor, where it took a further five minutes for the desktop to appear.
I've just now moved to try the computer and noticed not all my Notification Area icons are loaded yet - a further ten minutes in. Okay, now the final few are coming: Razer... I spoke too soon! still no Catalyst nor firewall+HIPS
I clicked my Downloads folder quick launch and nothing happened - which means I have to wait.
I clicked the Start Menu and it opened.
I hovered the mouse over the Documents folder link and the list of contents appeared quickly, though possibly a fraction of a second slower than usual.
I hovered over the Computer link and my solitary HDD and optical disk showed immediately as a tiny, two entry, list.
I hovered over the Control Panel link and nothing happened. I clicked the button and nothing happened. All else then seemed to become unresponsive.
After around five more minutes the Documents folder opened for the previous attempt at clicking the Quick Launch icon.
Control Panel still hasn't opened and Catalyst and neither has the firewall+HIPS icon.
I tried clicking a few folders on the desktop and, surprisingly, they opened, where usually they cannot either.
So, then, I tried a few Quick Launch icons which were loaded: I found my defragmenter had begun and it looks like my drive is being trashed by whatever it is and assume the two were fighting over supremacy. Stopping the defragmenter didn't resolve the usual activity sound. I clicked the Everything search icon (because, remember kids, Windows no longer has a usable search function) and that opened okay. I clicked the Action Centre flag and - as Windows laughably does - the small notification pop-up opened to tell my I have no problems! I clicked the LAN notification and the pop-up for that opened okay, informing that I was not connected. I clicked the Speaker icon and nothing happened. I then went back to the previous two and clicked on their pop-ups in order to open Network and Sharing Centre and it took around five minutes to open. Action Centre still hasn't opened and, upon attempting again, the Speaker volume slider and access to Mixer and Audio Properties still hasn't opened.
The thrashing continues.
Ta-da! Speaker|Mixer just opened after five minutes after the second attempt at clicking it, though clicking on Mixer or the speaker Icon hasn't opened either's property page.

MS is going to wreck my HDD.

 

[dean]

Mate,

When you say that you lock down the PC, what are the changes that you make?

It would be good for people to see what you have done to protect your PC.

That was in reference to any flavour of XP and is about disabling ALL vulnerable Services; including any sharing, terminal type services or remote services (except RPC and Connection Manager), disabling ActiveX (if still present under Services - which it's not, here, on XP x64), NEVER installing anything which requires ActiveX (including no MS software/suites aside fro the OS itself), blocking vulnerable ports and utilising other little bits and pieces where necessary. Obviously, my browsers are loaded with many security-related add-ons preventing any annoyances from ever getting the opportunity, and also inform me who's trying to probe, track or access whatever while I'm browsing.
Simple stuff, but I never have security issues with XP variants and my browsers still work fine. I'll reserve more hardcore methods for when the "big boys" really get heavy with their tracking and profiling - which they are already beginning to do. There are some forums I cannot use because they're already tied into reliance on too much from Skynet [G**gl*].

 

[dean]

It's stopped thrashing and everything is now responsive again and my Notification Area is displaying normally.
It seems to want something like 2-3 hours uninterrupted thrashing with no attempted Hard Reset in order to complete whatever it does.
I really ought to get those Sysinternals suites installed because I'm pretty sure IT WILL happen again. Hopefully I'll have enough resources available to run them.
Even though I've experience a lot of 100% disk activity when this happens, it's not all the time. This time it kept fluctuating between approximately 4 and 30% every second or so but the machine was still totally unresponsive with hardly any CPU or RAM being used. I'm guessing then that whatever causes it must be set to Realtime priority in order to cripple a machine in such a way and, of course, it isn't Indexing because that's only for the non-Search function and not enabled.

 

[Shintaro]

Ok, so the only thing that I can think of doing is using Windbg. So you will need another computer connected the the faulty computer via USB/1394/serial. When the machine starts to thrash, go to the other machine and hit the breakpoint to stop the thrashing and see what is running.