Windows Search: with no disks enabled for indexing, what is it indexing?

[Jeremy Nicoll - news posts]

(XP Pro, SP3 and recent fixes installed)

I recently installed Windows Search by accident, on two separate PCs. I
haven't quite decided whether to keep it or uninstall it.


None of my disks have indexing enabled on them.

I don't use Outlook Express.


On either machine, if I display "Indexing Options" there are no listed
included locations. If I click the Modify button, a tree structure shows

+ Local disk C:\
Microsoft Outlook Express

with neither item ticked. If I expand the Local Disk part of the tree it
DOES show subsidiary folders ticked, but when the mouse hovers over a ticked
folder tells me I can't modify the setting without first enabling indexing
on the folder(s) concerned.


Yet, every time I look at "Indexing Options" it shows a non-zero number of
items indexed. The number is increasing, and the same display also says
that "indexing speed is reduced because of user activity".

What's being indexed? Is there some very general search I can perform that
will match whatever is in the index, or some diagnostic tool that will dump
out index contents to give me a clue?

 

[Twayne]

(XP Pro, SP3 and recent fixes installed)

I recently installed Windows Search by accident, on two separate PCs.
I haven't quite decided whether to keep it or uninstall it.


None of my disks have indexing enabled on them.

I don't use Outlook Express.


On either machine, if I display "Indexing Options" there are no listed
included locations. If I click the Modify button, a tree structure
shows

+ Local disk C:\
Microsoft Outlook Express

with neither item ticked. If I expand the Local Disk part of the
tree it DOES show subsidiary folders ticked, but when the mouse
hovers over a ticked folder tells me I can't modify the setting
without first enabling indexing on the folder(s) concerned.


Yet, every time I look at "Indexing Options" it shows a non-zero
number of items indexed. The number is increasing, and the same
display also says that "indexing speed is reduced because of user
activity".

What's being indexed? Is there some very general search I can
perform that will match whatever is in the index, or some diagnostic
tool that will dump out index contents to give me a clue?

I imagine someone will be along shortly with more detail, but briefly:

It's basic purpose is finding files faster whether you are searching for
them in Explorer, or starting a program, etc.

Indexing is just what it sounds like. The files on your computer are
being indexed, and that index can be used to make it faster to find
files when you search for them. Like the index in the back of a book.

Indexing takes a very long time the first time it's run. The index it
is compiling has to include a LOT of entries and it often takes days
for an indexing to complete. That's why you see the number keep
increasing; the indexing is still going on; typical behavior.

Indexing is designed to be a background task and to not get in the way
of using the computer. So, whenever you do anything on the computer,
the indexing simply slows way down or even stops temporarily so you have
all possible resources available to you and indexing isn't slowing your
machine down. That's why it says speed is reduced; you're using
resources even in looking at it, so it makes sure it's no in the way.
Indexing has about the lowest priority of anything on your computer, so
even other background tasks can slow it down. AFAIK it's not practical
to see particular details about it.

I'm curious myself as to where the index lives and whether there is any
way to physically look at it. Perhaps someone will explain for us.

I've tried it both ways, with indexing on and off, but with the
exception of Explorer working a tad faster, I haven't noticed any great
shakes about its power and use. I do feel like programs start faster
too, but those are not measured results; strictly a "feeling" not very
scientific or accurate<g>

And there are two camps on indexing. One says it's useful and the other
says it doesn't really noticeably help anything. I've no idea who's
right; perhaps further posts will get us more info.

HTH,

Twayne

 

[Jeremy Nicoll - news posts]

I imagine someone will be along shortly with more detail, but briefly:

Thanks for taking the time to write such a thorough reply...

However my question was not "what is indexing for?", but instead "why with
no disks enabled for indexing and no use of OE, is anything being indexed at
all?".

Or, if the indexer /IS/ indexing something, why is it ignoring the flags
which dsisable indexing on each disk?

Indexing is designed to be a background task... AFAIK it's not practical
to see particular details about it.

Except that being able to see what it thinks it is indexing might provide a
clue about why it's seeminly ignoring the "don't index" flags?

I'm curious myself as to where the index lives and whether there is any
way to physically look at it. Perhaps someone will explain for us.

In a way I wouldn't be surprised if there's no easy way, because I note that
one can index encrypted files. If people could easily see index terms
extracted from such files, they'd no longer be secure.

I've tried it both ways, with indexing on and off...

I have many files I'd have no interest in having indexed, eg backups of data
from other machines/OSes, which are only held on these disks 9as well as on
their native machines) for safety. I'd not want to earch within them. I
dare say it's possible to have indexing on for some folders and off for
others, but setting the initial criteria for that and maintaining it sounds
like a nuisance, especially if the only way to do so is through the tiny
'expanding tree' structure within the 'search options' dialog. I'd far
rather be able to edit an external include/exclude parameter file, or
something.

 

[Jeremy Nicoll - news posts]

Or, if the indexer /IS/ indexing something, why is it ignoring the flags
which dsisable indexing on each disk?

It's now stopped indexing, saying that it has 8040 items indexed and
indexing is complete.

The "do not index anything" flags are still set on my C:\ drive, so my
question remains - how do I find out what it has wasted time indexing?

Or, if nobody here knows, where might I ask to find out?

 

[Twayne]

It's now stopped indexing, saying that it has 8040 items indexed and
indexing is complete.

Perhaps the flags couldn't be read until the process completed; wouldn't
be unusual that once started cannot be stopped by any normal means.
Has it restarted? I suspect it will not but hope you let is know if
it does.

The "do not index anything" flags are still set on my C:\ drive, so my
question remains - how do I find out what it has wasted time indexing?

All the files on your disk/s by the sound of it. Check the KBs at
Microsoft - there are several about indexing but I don't have any
recorded.
IMO you're making a mountain out of a molehill unless it keeps on
running when you have it shut off, which would indicate file corruption
somewhere.

Or, if nobody here knows, where might I ask to find out?

Tech Republic, MS Knowledge Base, etc..

Have you even bothered to look anywhere but here? Help & Support says,
amongst other things:
Indexing Service
You can use Indexing Service to index documents and document properties
on your disks and store the information in a catalog. You can also use
Indexing Service to search for documents, either through Search on the
Start menu or through a Web browser.

To start using Indexing Service, do any of the following:

a.. Open Indexing Service.
b.. Open Indexing Service Help.
Or perhaps,
Administering Indexing Service
This section covers:

a.. Administering Indexing Service through Computer Management
b.. Creating catalogs
c.. Setting the property size
d.. Manually starting a scan
e.. Monitoring performance
f.. Adjusting Indexing Service performance


HTH

Twayne

 

[Jeremy Nicoll - news posts]

Perhaps the flags couldn't be read until the process completed; wouldn't
be unusual that once started cannot be stopped by any normal means.

Hmm, I suppose it's possible, but the flags have always been unset, so even
at the point that the indexing process first started it should have seen
that there was nothing to do.

Has it restarted? I suspect it will not but hope you let is know if
it does.

It hasn't restarted.

All the files on your disk/s by the sound of it. Check the KBs at
Microsoft - there are several about indexing but I don't have any
recorded.

I did search (some) KB stuff, but tended to find either very basic info or
stuff eg from MSDN that was way too complex.

IMO you're making a mountain out of a molehill unless it keeps on
running when you have it shut off, which would indicate file corruption
somewhere.

Well I'm glad it stopped relatively quickly. But I had no reason to believe
it was going to stop.

Tech Republic, MS Knowledge Base, etc..

Searching the MS KB seems very imprecise to me - is there any way to define
search criteria tightly, with eg phrases in quotes and booleans in the
search criteria?

Have you even bothered to look anywhere but here?

Yes. I'm a programmer and mainframe systems programmer. But I don't know
enough about Windows internals to understand most of what I might read.

I've read quite a lot of the Windows Search website, too.

Help & Support says, amongst other things:

Indexing Service
You can use Indexing Service to index documents and document properties
on your disks and store the information in a catalog. You can also use
Indexing Service to search for documents, either through Search on the
Start menu or through a Web browser.

To start using Indexing Service, do any of the following:

a.. Open Indexing Service.
b.. Open Indexing Service Help.

Nothing I read on my own machine explained why a configured-off search
utility was busy indexing anything at all.

Or perhaps,
Administering Indexing Service
This section covers:

a.. Administering Indexing Service through Computer Management
b.. Creating catalogs
c.. Setting the property size
d.. Manually starting a scan
e.. Monitoring performance
f.. Adjusting Indexing Service performance

To me, these look like things that, well, matter if the indexing is on, and
you want to affect/measure how it is doing. My problem is that I had
indexing disabled and it was still doing it/something.

 

[Twayne]

....

It hasn't restarted.

Well, that's good anyway except it shouldn't have started in the first
place from the sound of it. Unfortunately anything more than I've said
already is beyond me; I'm no expert by any means.

Finding the answer to that question might be a lot more work than is
useful IMO. From the length of time it took I just guessed that it was
a complete index of the entire drive/s.
You might get some things from google by searching for
xp indexing details or perhaps
xp indexing definition
and similar phrases, but ... IMO it's of little value unless you're into
learning the mechanics of the functions.

I did search (some) KB stuff, but tended to find either very basic
info or stuff eg from MSDN that was way too complex.
....


Searching the MS KB seems very imprecise to me - is there any way to
define search criteria tightly, with eg phrases in quotes and
booleans in the search criteria?

Not AFAIK. I've had some luck by studying the keywords at the end of
the articles and try to mimic the attitudes used to determine them for
new searches.
Actually, wikipedia.com probably has the best indexing 101 writeup on
the subject and often I get useful links from there.

....



Nothing I read on my own machine explained why a configured-off search
utility was busy indexing anything at all.

Those were more a response to your "what was indexed" and other
questions than anything else, but likely led to other details or
references you might find useful. Or not. MS is far from being very
friendly when you're looking for something specific. They might be

To me, these look like things that, well, matter if the indexing is
on, and you want to affect/measure how it is doing. My problem is
that I had indexing disabled and it was still doing it/something.

Yeah; understood. I can see I can't help any further in that area.
That could be caused by anything from good ol' data corruption to
malware to just a plain old glitch on the power lines.
I feel pretty sure though, as long as you dont' have any malware
aboad, that you won't find any adverse effects from it. If anything it
might help a tad here & there but you shouldn't really see much
difference in my experience, at least.

This is more a sidelight sort of thing but since you didn't mention your
SP level, there is a KB out about an indexing exposure that "might" be
somethign like happened to you.
An excerpt:
----------------
Microsoft Indexing Service Vulnerability - CVE-2006-0032:

There is an information disclosure vulnerability in the Indexing Service
because of the way that it handles query validation. The vulnerability
could allow an attacker to run client-side script on behalf of a user.
The script could spoof content, disclose information, or take any action
that the user could take on the affected Web site.

--------------
From:
http://www.microsoft.com/technet/security/Bulletin/MS06-053.mspx
There are also some URLs in the article you may find useful.

Good luck, sorry I wasn't more help,

Twayne

 

[Jeremy Nicoll - news posts]

This is more a sidelight sort of thing but since you didn't mention your
SP level, there is a KB out about an indexing exposure that "might" be
somethign like happened to you.

Actually, line 1 of the first post did say SP3. The machine had been at SP2
with by no means every monthly update applied for quite a while before that,
but Windows Search itself wasn't installed until justafter SP3 was applied.

An excerpt:

From:
http://www.microsoft.com/technet/security/Bulletin/MS06-053.mspx
There are also some URLs in the article you may find useful.

I'll review it.

Good luck, sorry I wasn't more help,

Twayne

Thanks for your help.

 

[Jeremy Nicoll - news posts]

[snip]

Is there any significance in the GIFs attached to your two most recent
posts?

 

[Twayne]

[snip]

Is there any significance in the GIFs attached to your two most recent
posts?

Hmmm, NO, there is not, except that AFAIK I had nothing to do with
putting them there!
THANK YOU for alerting me to this!

I didn't even know you could attach anything in this group although I do
see it happen now & then.
My settings on newsgroups are for Plain Text, and I NEVER add an
attachment to my posts. A search of the group shows a total of 3
messages from me with attachments. on 1/12. 2/12, 2/19. and 2/20.
They appear to be links and are named "shortcutCold.gif" and some
code, FWIW:
----- munged with "X" -------------
bXeXgin 6X6X6 shXortXcutCXold.gif
M1TE&.#EA"0`)`*(``(AZA68)>\#<P+_4OH" @ ```````````"P`````"0`)
BXX```#'$@$WXXXXB+*2.ZG"E+=EEQ9=XX0OI%J:J\< (`.XPX`X`
`
end
----------------
I added the "X"s to damage it so it can't run. It's not clickable, so I
suspect it's a tracker of some sort so it doesn't appear dangerous at
all. Now I know about it, I can check further on it.

THANKS MUCH for alerting me! I will take care of it. Feel free to
notify me if you see further Gif's from me.

Twayne

 

[Jeremy Nicoll - news posts]

[snip]

Is there any significance in the GIFs attached to your two most recent
posts?

Hmmm, NO, there is not, except that AFAIK I had nothing to do with
putting them there!
THANK YOU for alerting me to this!

No problem; I'd not seen anything like these before either, and my email/
news client, while it was able to show them as attachments, would not let me
detach them... which is what really got me curious - that and the fact they
seemd to have nothing to do with the topic of the posts.

I had to export the posts and look at them in a text editor to see what was
going on.

Although detach doesn't work here, I am however able to drag the attachments
out of the posts to a temporary folder. There, Windows shows a 'preview'
image of what's in each one, and they open ok in IrfanView; I don't think
there's actually any executable code in them.

 

[Twayne]

[snip]

Is there any significance in the GIFs attached to your two most
recent posts?

Hmmm, NO, there is not, except that AFAIK I had nothing to do with
putting them there!
THANK YOU for alerting me to this!

No problem; I'd not seen anything like these before either, and my
email/ news client, while it was able to show them as attachments,
would not let me detach them... which is what really got me curious -
that and the fact they seemd to have nothing to do with the topic of
the posts.

I had to export the posts and look at them in a text editor to see
what was going on.

Although detach doesn't work here, I am however able to drag the
attachments out of the posts to a temporary folder. There, Windows
shows a 'preview' image of what's in each one, and they open ok in
IrfanView; I don't think there's actually any executable code in them.

Yeah, they appear to have been from/about bizrate.com and relate
directly to a tracking cookie Adaware found. Why it should go out
posting to a group is beyond me though; I've checked and none of my
emails had it, at least as far as I could tell by looking in Sent, but
my newsgroups had a total of 3 of them in Sent, just like I saw in the
newsgroups search. Strange.

Thanks again; I'll continue to monitor for them.

Twayne