Windows 7 - Need help determining which app(s) causing disk access

Hi there everyone,

I've got a Win 7 Pro(64 bit) install(fully patched) that I use only for gaming. When I'm not playing a game on it, it's turned off. I run Panda Cloud Antivirus on it as well as checking periodically with SB S&D and Adaware. Everything to date has been clean.

Over the last week or so, I've begun to notice long periods(over 15 minutes) of constant HD access, sometimes when I start up, but not always. Sometimes it will begin any time while it's turned on. For instance, it has been constantly accessing the drive for the last ten minutes. Shutting down the computer and restarting it didn't stop it. It simply resumed the disk access immediately upon coming back to the desktop.

Even if an app with such a poor management of resources didn't bother me, the fact that during these periods of disk access, attempts to use the computer are futile force me to find out what's going on. Starting up a game, it may take 3-5 minutes to get to the splash screen.

I would really like to find out what app is causing this access. I suspect Panda, but would really like to be able to see what's causing the problem without arbitrarily shutting down processes, hoping that it doesn't just happen to stop this problem while on any particular process. Is there a way I can do this? I would greatly appreciate any help or suggestions anyone might have.

thanks,
json

First run an antivirus scan
Download and run malwarebytes

Then do a clean boot to find the cause
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

Hi there Richard and thanks very much for the reply.

I will download run mwb, but during that time, I still wonder if there's a way to determine which app is causing the disk read? If I perform a clean boot, it's not really going to help me resolve the issue, simply because the issue doesn't happen often and can happen at any time(and inversely of course, not be happening at any time). By shutting down half of my processes, I will be aware that the problem is not occurring during that time, but will have no idea if it's just because it's not time for it to happen or whether one of the processes cut out of the boot cycle was the cause.

thanks,
json

If you open the task manager and check the View menu you can add extra columns to the display. there are entries for I/O writes and reads. If you monitor these additional columns during an event you should be able to see the culprit. Make sure you show processes from all users to show any system processes.

there is also the more detailed resource monitor available from the performance tab

In the Resource Monitor (available by clicking Start, typing "Resource Monitor" and pressing ENTER), you can view disk access by process.

In the Performance Monitor you can run the System Performance System Data Collector Set and then view Hot Files.

Either method will be very insightful in your scenario.

Tom Carpenter

Hi there barman and Tom and thanks so much for your replies!

I enabled the additional tabs and at first still couldn't see the culprit, but after enabling "view all users processes", I saw that Panda was indeed causing the problem. Uninstalling it, I've not had the problem return over the course of the next day.

I'll find an a/v solution that can manage it's resource footprint

thanks,
json

Microsoft Security Essentials
http://www.microsoft.com/Security_Essentials/
Windows Firewall
Malwarebytes.
http://www.malwarebytes.org/mbam.php

Free, made for Windows, small footprint and recommened by most of the members, here.

That is all you need.

In the future, you can use process monitor to watch file and registry access (and other things, of course).

hi there everyone,

I installed mwb and Security Essentials(firewall is already enabled), scanned everything and things are going swimmingly. I very much appreciate everyone's help in the matter. This is definitely the most helpful MS-centric forum I've come across to date. rep-cookies have been passed out to all involved.

thanks,
json

TY for the rep. All that have participated are truly glad that we helped solve your problem.