From: nospam@needed.invalid   
      
   On Sun, 2/22/2026 12:08 PM, Chris wrote:   
   > Mr. Man-wai Chang  wrote:   
   >> On 2/20/2026 12:34 AM, micky wrote:   
   >>>   
   >>> I should have thought of those, but...   
   >>>   
   >>>> A virus scan?   
   >>>   
   >>> Been happeing now for 3.5 hours, and maybe last night too.  No scan   
   >>> takes that long.   
   >>>   
   >>>> Automatic defrag?   
   >>>   
   >>> Just wrote the files yesterday to a blank flashdrive, 3GB into a 16GB   
   >>> drive.  No fragmenting to defrag. ---  But in general, do I have   
   >>> automatic defragging?  How would I know?   
   >>   
   >> Just my wild guesses. I am also curious about the constantly flashing HD   
   >> LED as well, not just the USB ports!!   
   >>   
   >> Back in the MS-DOS single-user, no-networking days, everything was more   
   >> certain. The floppy diskette drive never ever made a sound suddenly. :)   
   >   
   > Oh yes, it did. Especially in MS Word. It would often randomly seek to all   
   > physical drives when doing other actions. It was some deep-seated   
   > assumption that everything would be stored on a removable disk and it   
   > needed to check that it was still there before doing anything.   
   >   
      
   If you watch with Process Monitor, you will see some pretty   
   unbelievable scanning sequences in there. They are logically   
   unrelated to anything! But what would be the point of me   
   telling people this. And no, it's not malware.   
      
   The system can have eight or more ETW collectors running at the   
   same time, but there is no reason for those to generate probes   
   or scans resulting in a disk cascade in the trace. So while Process Monitor   
   is an ETW client, the OS has its own collection of traces running   
   for its own purposes. Sleep Studies or whatever.   
      
   I was hoping Micky would comment on the PID or the Process Name   
   of the thing probing E: as a hint. The disk has more than one   
   level of access, and accessing as E: is only one of the levels.   
   There is no guarantee that everything is mapped -- ETW has   
   more event types, than Process Monitor has parsers. A recent   
   addition, was the ability to record network packets in   
   Process Monitor. And the developer, Bruce maybe, would   
   have picked that out of the source of the Microsoft   
   version of Wireshark.   
      
      Paul   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)