Troubleshooting heavy disk activity

[SailingNut]

Hi all,

I'm seeing some pretty heavy disk activity on my machine and I'm wondering what methods others out there use to troubleshoot a situation like this.

I've tried using task manager and adding the IO stats so that I can sort based on that, but that does not seem to work very well.

TIA!

 

[OldMX]

Process Explorer and Process Monitor...both freeware from microsoft.com

 

[MadHacker]

Ctrl+Shift+Esc > click the performance tab > click on resource monitor. in the disk section you will get detailed information on which files are being read/written to.

 

[Hopalong X]

Type Resource Manager in Start Search bar click it to open. Click on disk tab.
Now you can see what is running.
Click memory tab and see what resources are being used there also.
Mike

 

[SailingNut]

Thanks for the suggestions!

Now for what I consider to be really odd. The process doing all of the disk activity is Explorer.exe! I'm not copying any files or anything. I do have an explorer window open, but would not expect it to be hammering the drive just sitting there.

Any suggestions?

 

[Hopalong X]

It is probably indexing but not sure. It should be done by now.

Download and install Malwarebytes

You may have a Trojan or other bug in the system.

Downnload, install, use the update tab and run a full scan.
Delete anything found when prompted.

When it is done a log will pop open in Notepad. Save to desktop and upload with your next post.
http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Mike

 

[SailingNut]

Hi, I didn't bother attaching the file since it's small. It says nothing found, so that would not seem to be the problem. Find the results below:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5507
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
1/12/2011 1:47:16 PM
mbam-log-2011-01-12 (13-47-16).txt
Scan type: Full scan (C:\|)
Objects scanned: 341859
Time elapsed: 48 minute(s), 27 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

 

[SailingNut]

UPDATE: I used resource monitor like hopalong x suggested and now I see that system seems to be a big "user" of disk I/O. It's writing quite a bit of information.

 

[Golden]

Mmmm....in Resource Monitor, place a tick in System, then expand the list as shown in the image. Scroll through the files shown.....do any appear suspicious to you? Can you list the files, and perhaps a trained eye could spot potential problems.........

 

[MadHacker]

If you have recently installed windows, the disk activity you're seeing is probably normal and will decrease after indexing, pagefile allocation, and updates are complete.

 

[Hopalong X]

Sailing Nut

Glad to see malwarebytes clear.
Good idea to eliminate this possiblity at least.

Mike

 

[SailingNut]

If you have recently installed windows, the disk activity you're seeing is probably normal and will decrease after indexing, pagefile allocation, and updates are complete.

How long is "recent?" I did just install this machine right before the 1st of the year, but I would hope it's done with all of that stuff by now. It stays on 24x7 so it's had plenty of time to "settle down"

I did see a couple of oddball things in the system list for files so, I'm doing a full McAfee scan now to double check on the Malwarebytes result.

 

[MadHacker]

Depending on your hardware, the programs you've installed and how much media you have on your HDD(s) it can sometimes take a couple of weeks for the system to settle down, especially on an upgrade install but even on a system with a clean, bare install of windows, it sometimes takes a few days after the first series of updates before everything is normalized. I wouldn't rule out malware yet, but malwarebytes is one of the best products out there. McAfee probably won't find anything either. Is the HDD activity constant or mainly when you're not doing anything with the system? If it's mainly when your system is idle, I wouldn't worry too much, because it will settle down.

 

[cluberti]

At this point, using tools like xperf (from the Windows Performance Toolkit) to trace the system for slow I/O might be useful. If we know it's disk I/O, xperf can be used to trace (while the problem is happening) and then analyze the resulting ETL file.

 

[logicearth]

I noticed you said you are using McAfee...