Something causes 100% HDD load, system temporarily very sluggish

[Snick]

@torchwood

 

[UserXP]

Well, the only Adobe product I still have installed is Flash Player because I have a dictionary which requires it in order to run and other stuff I need for my work. It came with the installation, I think it is a rather old version of Flash player.

OK, I am uploading the BSOD and Farbar log files. I also attached a snapshot of what the Task Scheduler window looks like.

 

[file3456]

Launch Autorusn again and under the Everything tab enter bitcomet in the search box. Uncheck it. Now reboot. See what happens.

If still disk thrashing go under the Everything tab again and search for diskkeeper and uncheck that. Reboot.

In process Explorer click the CPU column to organize form highest to lowest CPU usage and post a screen shot.

 

[UserXP]

Thanks for your time.
OK, here is the update:

Disabled the BitComet service. Rebooted. but it made no difference.
That process loads only while BitComet is running, and I did not set BitComet to autostart with windows because I rarely use it.

Disabled two Diskeeper processes Autoruns found. Rebooted, but also made no difference.

Should I turn these disabled processes back on now?

Now, I have attached the Process Explorer snapshot with the CPU highest to lowest order. It was completely static while disk was thrashing because it almoste froze it, which makes it next to impossible to monitor anything in real time. Here is the snapshot:

 

[file3456]

Yes, you can reenable those entries again.

Run LatencyMon and take a screen shot. Resplendence Software - LatencyMon: suitability checker for real-time audio and other tasks

 

[file3456]

Did you notice if this problem occurred right after you installed some software or hardware?

 

[UserXP]

Well, I can't really remember, but I didn't make any changes since I bought the computer and installed Windows. My mother has a laptop with the same Windows build and it works perfectly, many of the programs I am using are also on her computer. By brother also has very similar hardware to mine and the same Windows version, also no problems.
This issue has lasted for several months now. It actually was worse before, but then I read on AIDA64 forum that the Convenient Update (the so-called "SP2" for Windows 7) might solve the issue. So I followed the instructions and downloaded three packages for it and installed. The problem was not solved, but after the update the thrashing became shorter, before it was 5 to 7 minutes, now it lasts 3 to 4, but its still there.
Also, when I installed that SURT64 update, upon first reboot the issue was gone. I immediately ran something I know will invoke the issue and it didn't happen. But after the next restart, it came back. It is as if there was that moment or a specific setting which made Windows work as it should and then got screwed up again upon next boot.

The drivers are also all from the manufacturers' website and were not changed as everything works OK, nothing I can pinpoint. I generally tend to not change a driver if it is working fine, so I can't pinpoint a specific installation that might have messed something up.
The thrashing happens once per after-boot and cannot be repeated until next boot. So it has to be something software-based. If it were a driver or hardware issue, it would have been happening the whole time Windows is on. I have never had a single BSOD on this computer so far. Everything works fine except for those 4 minutes when everything freezes, becomes sluggish and the HD sounds like a mini-grinder.

OK, here are some of the screenshots. I took one of each fab.

 

[torchwood]

Hi

Those reports were rather informative

you only have 13 updates on that comp - i suggest you update a bit
Diskkeeper looks to be initiating a prog that cannot be found icobios2
You keep getting a low registry space pop-up, would have been handy to know about
Your group policy settings are somewhat compromised.
Im not a security expert but i'm concerned about your hosts file.

Before i give any other advice i would like to see the ouput from this tool

https://go.microsoft.com/fwlink/?LinkID=52012


Roy

 

[UserXP]

Thanks, Roy.

Well, yes, I did not use Windows Update very often, but have rather installed those cummulative and rollup updates. Maybe that's why there are only so little of them listed.

OK, I ran the tool that you suggested, and I also attached the hosts file. It is full with addresses containing something related to or mentioning Microsoft sites, looks like something blocked telemetry and data collection (maybe some privacy protection was at play).

When it comes to group policies, I don't know much about it. But I do remember that I installed a Google group policy so I could disable Chrome's automatic update as it was causing misinstallations or sometimes it would mess up my Chrome settings altogether. But if a remember correctly, the disk thrashing was already impacting the computer before that installation.

After searching both the registry and the hard drive for ICOSBIO2 entry, there were no hits.
I am not sure what do you mean by "low registry space", no such message ever popped up. I generally do not see any errors on this machine, the computer works rather stable when the thrashing isn't happening. But when it does, it's like a 486 computer runing an intensive application of Windows 95.
If you have any possible suspect(s) with the current logs, please instruct me on what to disable or modify to see if it would make a difference. I will do my best to assist.

 

[torchwood]

Hi

please rerun the tool its only showing part of the data
(hit the copy button) and paste it into you next reply.


Roy

 

[UserXP]

I have an update. Today I decided to update the graphics card driver. I entered the Safe Mode to use the DDU tool to clean uninstall the previous driver. After the program finished, New Hardware Found tray popup immediately appeared and it took some time, while the HD was thrashing even though it was in Safe Mode. It wasn't as long as it is in normal mode, but obviously something related to drivers-checkup triggers the thrashing. Windows seems to have developed some trouble when anything attempts to touch the installed drivers or hardware. I presume that's why programs like AIDA64, CPU-Z and alike also trigger the thrashing as they too inspect every aspect of the system.
What could have caused this behaviour and why it lasts only once per boot is a mystery.

 

[file3456]

Nothing in LatencyMon suggests any issues. Your hosts file suggested something manipulated it to block telemetry for Microsoft, etc. You should always mark a hosts file as read only unless you edit it then mark it read only again.

 

[file3456]

Type in services in the search under the start orb. Now right click services and chose Send to the desktop as a shortcut. Now reboot your computer. As soon as the computer boots into Windows launch services and click the status tab at the top to organize all services by their current status.

Do you see any that are taking forever to initiate?

 

[UserXP]

Hi, and thanks for your time.

Well, I tried a similar approach before. I turned on the computer and as soon as the Desktop appeared I clicked on the Services shortcut (it was pinned in the start menu). As soon as it opened, I sorted out the services by status and took a snapshot. Then I invoked the thrashing, waited for it to complete and then refreshed the Services window and took a snapshot again. Upon comparing the two images, everything remained the same.

Then, I rebooted again and I started activating service by service to see which one will invoke the thrashing. I found several of them, for instance:

Microsoft .NET Framework (all instances thereof)
PnP-X IP Bus Enumerator
Remote Procedure Call (RPC) (all instances thereof)
Smart Card
Tablet PC Input Service
Volume Shadow Copy

There were a couple more but I forgot (I did this over the weekend, trying to isolate the potential cause).

But all these are already set to Manual and therefore their initial status is Stopped. Their status does not change even after the thrashing completes, they still remain stopped. I too was thinking that there must be some sort of service causing the issue, but am at a loss.
Plus, while the thrashing lasts, the Services window also freezes so trying to refresh it does not work, I can't see in real time if a service has started and stopped.

 

[UserXP]

But, I retried your method. The results are almost the same.

I managed to export the list before the thrashing, while thrashing (only once, and even then I had to wait for the Services window to unfreeze) and after the thrashing. Then I compared the three Excel tables that were created. I noticed that before the thrashing, a service named Software Protection was running. While thrashing, its status changed to Stopping, and when the thrashing finished its status changed to Stopped.
I can't be sure how many other services may have started and stopped in the interim because they cannot be traced in real time.

All the other services remained the same per status. So for the sake of certainty, I set the Software Protection service to Disabled and restarted the PC... and the thrashing is still there. :-(

 

[torchwood]

Hi Xpuser,

Your installation is non-genuine.

You have an ASUS OEM factory installed product key on a Retail motherboard, an activation exploit is in use.

the Software Protection service you mentioned is part of the Activation process and runs everytime you boot and as the report states it is NOT registered, and is trying to verify the OS status

Forum rules dictate that no further assistance can be provided until you purchase a genuine licence.


Roy