HDD constantly churning

[Jeff]

Windows 7 64 bit, 8 GB ram. Windows is controlling virtual memory.

The HDD is constantly churning.even when I am doing nothing. Indexing is
turned off. Antivirus and malware scans show no problems.

The task manager shows CPU Usage 2%, Physical memory 30% but is not
telling me to much more my uneducated eyes.

How do I find out what is causing the HDD to churn continuously and in
spurts?

Thanks, Jeff

 

[Andy Burns]

The HDD is constantly churning. How do I find out what is causing the
HDD to churn continuously and in spurts?

Resource Monitor (one way to launch is from performance tab of task
manager).

Disk tab, in the top pane, sort by total byte/sec column.

Greedy process(es) should be at the top, tick the checkbox of the greedy
image to show only files being accessed by this process in the bottom pane.

 

[Ed Cryer]

Windows 7 64 bit, 8 GB ram. Windows is controlling virtual memory.

The HDD is constantly churning.even when I am doing nothing. Indexing is
turned off. Antivirus and malware scans show no problems.

The task manager shows CPU Usage 2%, Physical memory 30% but is not
telling me to much more my uneducated eyes.

How do I find out what is causing the HDD to churn continuously and in
spurts?

Thanks, Jeff

Do a proper check of Task Manager; look at the CPU usage of individual
processes under Processes tab. Stick with it for a while to try and see
if you can catch some program keep jumping in. System Idle Process
should have about 98% usage on it.

If that doesn't pin down any culprit, then it might be internal
housekeeping; and if that's what it is then there'll be a good reason,
something like lots of bad sectors marked on the disk.
Run a full scan of the disk, checking the two extra options. And then it
will demand exclusive access to the disk; restarting and doing its stuff
without Windows running. The report should be examined carefully to see
what it says.

Ed

 

[Andrew Rossmann]

Windows 7 64 bit, 8 GB ram. Windows is controlling virtual memory.

The HDD is constantly churning.even when I am doing nothing. Indexing is
turned off. Antivirus and malware scans show no problems.

The task manager shows CPU Usage 2%, Physical memory 30% but is not
telling me to much more my uneducated eyes.

How do I find out what is causing the HDD to churn continuously and in
spurts?

Disk defragmentation running in the background? There could also be
System Restore snapshots, etc...

 

[Zaidy036]

Disk defragmentation running in the background? There could also be
System Restore snapshots, etc...

Recommended by Fred Langa at Windows Secrets:
http://www.itsth.com/en/produkte/Whats-my-computer-doing.php

 

[Jeff]

Resource Monitor (one way to launch is from performance tab of task
manager).

Disk tab, in the top pane, sort by total byte/sec column.

Greedy process(es) should be at the top, tick the checkbox of the greedy
image to show only files being accessed by this process in the bottom pane.

Very interesting. Thank you.
Of course, today, it is no longer churning and all is quiet .....
Like going to the doctor. It got scared!

But good to know about. Thank you.

 

[Jeff]

Do a proper check of Task Manager; look at the CPU usage of individual
processes under Processes tab. Stick with it for a while to try and see
if you can catch some program keep jumping in. System Idle Process
should have about 98% usage on it.

If that doesn't pin down any culprit, then it might be internal
housekeeping; and if that's what it is then there'll be a good reason,
something like lots of bad sectors marked on the disk.
Run a full scan of the disk, checking the two extra options. And then it
will demand exclusive access to the disk; restarting and doing its stuff
without Windows running. The report should be examined carefully to see
what it says.

Ed

Thank you.

 

[Jeff]

Recommended by Fred Langa at Windows Secrets:
http://www.itsth.com/en/produkte/Whats-my-computer-doing.php

Is that safe, or malware?

 

[Bruce Hagen]

Windows 7 64 bit, 8 GB ram. Windows is controlling virtual memory.

The HDD is constantly churning.even when I am doing nothing. Indexing is
turned off. Antivirus and malware scans show no problems.

The task manager shows CPU Usage 2%, Physical memory 30% but is not
telling me to much more my uneducated eyes.

How do I find out what is causing the HDD to churn continuously and in
spurts?

Thanks, Jeff

Is this a desktop or laptop? If your fans are loaded with dust it can
cause a noise that seems like it is coming from your HDD.

 

[Zaidy036]

Is that safe, or malware?

NOT malwware

 

[Big Steel]

Is that safe, or malware?

You might want to try SystemInternals which is under MS now. I remember
there was a utility that showed what programs where accessing the HD
when idle. It turned out to be the 3rd party firewall program that was
doing it. All the utilities at the SI site are free. You may also want
to look at Process Explorer. You can right-click a running task and go
to properties, and I believe you see disk IO activity for a program
there too.

 

[Jeff]

You might want to try SystemInternals which is under MS now. I remember
there was a utility that showed what programs where accessing the HD
when idle. It turned out to be the 3rd party firewall program that was
doing it. All the utilities at the SI site are free. You may also want
to look at Process Explorer. You can right-click a running task and go
to properties, and I believe you see disk IO activity for a program
there too.

Thank you.

 

[Jeff]

Is this a desktop or laptop? If your fans are loaded with dust it can
cause a noise that seems like it is coming from your HDD.

It's a new laptop. The HDD light was also lit up, but that is a good
point to think about.

 

[Peter Jason]

You might want to try SystemInternals which is under MS now. I remember
there was a utility that showed what programs where accessing the HD
when idle. It turned out to be the 3rd party firewall program that was
doing it. All the utilities at the SI site are free. You may also want
to look at Process Explorer. You can right-click a running task and go
to properties, and I believe you see disk IO activity for a program
there too.

I believe irt's called "TCPView" and it lists all
loaded material and a red bar indicates when an
item is operating.

Peter

 

[Peter Jason]

You might want to try SystemInternals which is under MS now. I remember
there was a utility that showed what programs where accessing the HD
when idle. It turned out to be the 3rd party firewall program that was
doing it. All the utilities at the SI site are free. You may also want
to look at Process Explorer. You can right-click a running task and go
to properties, and I believe you see disk IO activity for a program
there too.

PS:

Also "Process Explorer" in the same suite.
http://technet.microsoft.com/en-us/sysinternals

 

[Paul]

PS:

Also "Process Explorer" in the same suite.
http://technet.microsoft.com/en-us/sysinternals

You could use Process Monitor (procmon) and set the filter to:

"Operation" "Is" "Readfile" "Include"
"Operation" "Is" "Writefile" "Include"

and capture all the file operations.

Only problem with that is, some software hides inside a "svchost",
and then you can't tell what's doing it.

There is a way, to move each "thing" inside a svchost, into
its own svchost. Then, when a svchost is logged doing something,
you can figure out who did it. When I tested this, I ended up with
something like 20 svchosts, instead of the usual 6 or so (and
that was likely on WinXP). So this is an example of a way
of making the things hiding in svchosts, less "anonymous".

http://blogs.msdn.com/b/spatdsg/archive/2007/09/17/debugging-services.aspx

"You can split it out into its own service by running:

sc config <service> type= own

And revert it via

sc config <service> type= share
"

HTH,
Paul

 

[Big Steel]

You could use Process Monitor (procmon) and set the filter to:

"Operation" "Is" "Readfile" "Include"
"Operation" "Is" "Writefile" "Include"

and capture all the file operations.

Only problem with that is, some software hides inside a "svchost",
and then you can't tell what's doing it.

Yes you can tell what is doing it by using Process Explorer and look at
hosted processes within a process by examining any running process with
Process Explore including an individual SVCHost.exe.

There is a way, to move each "thing" inside a svchost, into
its own svchost. Then, when a svchost is logged doing something,
you can figure out who did it. When I tested this, I ended up with
something like 20 svchosts, instead of the usual 6 or so (and
that was likely on WinXP). So this is an example of a way
of making the things hiding in svchosts, less "anonymous".

That's where Process Explorer helps as you can go inside a SVChost.exe
process and see what programs are being hosting by a SVChost.exe, where
the process within the SVCHost.exe is located on the HD, and where the
SVChost.exe is running from on the HD.

Any SVCHost.exe that is not running out the Windows.System32 directory
is malware.

There are a lot of things that can be determined when you right-click on
a running task and go to Properties in Process Explorer, like what
processs is being hosted by SVChost.exe is sucking-up cpu processing.
It's never Svchost.exe that's sucking-up cpu processing, but it is
something within any given SCVhost.exe is hosting that is doing it.

But one must have a little expertise and savvy to know what one is
looking at when searching for exploits.

<http://www.windowsecurity.com/artic...d_Rootkit_Tools_in_a_Windows_Environment.html>

 

[Peter Jason]

You could use Process Monitor (procmon) and set the filter to:

"Operation" "Is" "Readfile" "Include"
"Operation" "Is" "Writefile" "Include"

and capture all the file operations.

Only problem with that is, some software hides inside a "svchost",
and then you can't tell what's doing it.

There is a way, to move each "thing" inside a svchost, into
its own svchost. Then, when a svchost is logged doing something,
you can figure out who did it. When I tested this, I ended up with
something like 20 svchosts, instead of the usual 6 or so (and
that was likely on WinXP). So this is an example of a way
of making the things hiding in svchosts, less "anonymous".

http://blogs.msdn.com/b/spatdsg/archive/2007/09/17/debugging-services.aspx

"You can split it out into its own service by running:

sc config <service> type= own

And revert it via

sc config <service> type= share
"

HTH,
Paul

Thanks. I used the SysInternals in the XP days to
find & remove a virus. Though the details escape
me now.

 

[R. C. White]

Hi, Jeff.

It's a new laptop.

I suspected as much, but it took me a day to respond..and I see you said
that "it is no longer churning and all is quiet ....."

Starting with Vista, many of us noticed a lot of disk activity for the first
few days, while the Search service built its Index. There were a few other
new-system housekeeping chores, too, such as building the SuperFetch cache,
which speeds up later accesses to the apps we use most often. Most of these
activities run only in the background so that they don't interfere with what
we are working on. In the first few days with a new Win7 installation, we
are keeping it pretty busy with foreground tasks (installing apps, tweaking,
etc.) so it doesn't get much background time. I've often recommended that a
new installation be left on during lunch time or even overnight to let the
background housekeeping tasks finish. Then the disks don't churn so much
after it gets caught up.

Maybe that's what happened in your case. ;<)

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP (2002-2010)
Windows Live Mail 2012 (Build 16.4.3503.0728)) in Win8 (RTM Ent Eval)


wrote in message

Is this a desktop or laptop? If your fans are loaded with dust it can
cause a noise that seems like it is coming from your HDD.

It's a new laptop. The HDD light was also lit up, but that is a good
point to think about.

 

[Paul]

Hi, Jeff.


I suspected as much, but it took me a day to respond..and I see you said
that "it is no longer churning and all is quiet ....."

Starting with Vista, many of us noticed a lot of disk activity for the
first few days, while the Search service built its Index. There were a
few other new-system housekeeping chores, too, such as building the
SuperFetch cache, which speeds up later accesses to the apps we use most
often. Most of these activities run only in the background so that they
don't interfere with what we are working on. In the first few days with
a new Win7 installation, we are keeping it pretty busy with foreground
tasks (installing apps, tweaking, etc.) so it doesn't get much
background time. I've often recommended that a new installation be left
on during lunch time or even overnight to let the background
housekeeping tasks finish. Then the disks don't churn so much after it
gets caught up.

Maybe that's what happened in your case. ;<)

RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP (2002-2010)
Windows Live Mail 2012 (Build 16.4.3503.0728)) in Win8 (RTM Ent Eval)

You can simulate this, by using the Indexing control panel and having
the Indexer repeat its operation.

On my laptop, with 26GB C:, the indexing operation takes about 3 hours.
Normally, the indexing operates at a reduced priority, in the sense
that if the user starts to use the computer, the indexer "backs off"
automatically. I find this annoying, so I applied the change where
the back off is disabled. If you leave it set up as default, the
"backed off" mode of operation, could spread that out to way more
than the 3 hour run. I found that too annoying.

If the indexer on my machine, feels it needs to generate the index all
over again, I walk away from the machine for the 3 hours until it
completes. By bumping up the priority as much as possible, I try to
get it over with.

I tried to disable "content" indexing, and just have it index file names.
If that attempt had worked, it would only take a couple minutes to make
a file list. But even with that setting disabled, the indexing operation
still does a content based index, which is why it takes the 3 hours. In
other words, for me, it ignores a user setting. All I really want is
a file index, not content indexing.

I can't imagine how long that would take, on any decent sized partition.
Especially if you have no effective control over it.

If you disable the indexer, then searches take forever to run. If
you enable the indexer, searches become faster, but the indexing
can be annoying.

You'll find at least three processes running in Task Manager, related
to indexing. A regular "three ring circus", a celebration of excess.

On my laptop, when it was new, indexing was turned off. I turned it on,
because I couldn't stand waiting the two minutes for a search operation
to complete. As long as I don't have to watch the disk chugging for
three hours, and can walk away, then it seems like a good option.

Paul