Solved Excess hard disk activity - another take

I see that various people have also been experiencing excessive hard disk activity extending for several minutes after bootup and loading of all startup programs has completed. I have just transferred my software setup from Win XP Pro to Vista Home Premium 32-bit, and this disk activity is just the same every time Vista has started, whether it's from cold or from a reboot. Also I notice similar excessive activity for a good minute or two when I've installed a new program - even a very small one.

I tried the obvious things - turning off search indexing, automatic defragmentation and Windows Defender (the latter needed to be off anyway because it would be liable to clash with the anti-spyware facilities of Outpost Pro firewall and Avira Antivir antivirus which I have running on my system) - but this made no obvious difference to the disk activity. I haven't yet tried turning off prefetching because I have another indication that I want to focus on.

One of my system-tray utilities is PC Lighthouse. This is useless for me at the moment for displaying network activity of individual programs, because Antivir's Webguard acts as a proxy server and confuses PCL as to which programs are accessing the Net - but it is still useful in showing disk activity for each running program or process. What I find consistently is that the major proportion of disk activity each time when I don't want it is Antivir's on-demand scanner - and I've checked that Antivir is not configured to do any automatic disk scanning like that, and nothing like that was happening with the same security software in XP.

So, I'm wondering if anyone knows whether it is actually Vista calling the antivirus scanner - for that seems to be the inescapable conclusion. I want to stop this unnecessary scanning, because a great deal of such activity every day is bound to shorten the life of the hard disk seek mechanism. My computer is not at high risk of infection, seeing that I have several levels of defence including simply not going surfing dodgy sites, so such scans several times a day are completely redundant.

It isn't my Outpost firewall doing it. To avoid clashes with Antivir's Webguard, Outpost's realtime spyware protection is turned off, but I am aware when it does an auto-quick-scan after updating its spyware database, and that scan really is quick and is not part of the issue that I'm posting about.

So, nice people, any informed ideas? There might well be a registry entry which could be tweaked to prevent the antivirus scanner from being called...

Kind regards,

Hi Philip,

I tend to agree with what you say. Just this morning after boot, my system was off, as you say, bashing the hard disk to death, while absolutely nothing was started yet exceptbut the usual standard background tasks.

So I started TaskInfo to see who it was and of course its one of the many SVCHOST.EXE tasks running, making it next to impossible to figure out what's really going on.

Does anyone know if, when you spot an SVCHOST task doing this, if it is possible to identify what THAT PARTICULAR task is actually doing? It might help narrow this idiocy down.

George

Have a look at Process monitor from Sysinternals that should give you all the info you need in fact it's well worth getting the whole suite :D while its still free ( microsoft has recently aquired the company )

OK, Today I ran Process explorer while the system was 'busy' doing the disk activity.

Basically it shows SVCHOST.EXE scanning through the C: drive directories and examining each file. I've attached a JPG of part of the output showing the same sequence of activity repeated over and over for each file.

This is all very nice, but WHAT is this activity in aid of? I don't see us being any closer to that answer.

Obviously SVCHOST.EXE performs many, many functions since there are always so many copies of it executing. How do we identify what one particular instance of it that's doing all this I/O is actually accomplishing?

George

Thanks very much for the tip. I've downloaded the suite, and clearly it contains some tools which could be very useful on the odd occasion.

As far as concerns what Process Monitor shows, this leaves me extremely confused as to what is really going on. It is showing the main activity during all the unwanted disk thrashing being from our sweet little 'friend' scvhost and not Antivir at all, whereas PC Lighthouse shows it as being the Antivir on-demand scanner, though with several Windows processes also showing some activity. Indeed, as Process Monitor shows it, scvhost appears to be doing some sort of scan at that time, looking at various entries in the C:\program files folder and in my e-mail data folder (which isn't on the c: drive) and appdata folder.

That does look consistent with some sort of malware quick-scan, but I don't know where to look for the means to stop that behaviour.

Incidentally, I've thought more about the commonly held notion that the prefetch function is the culprit, and I've ruled it out. The point is, if prefetch required so much disk activity, that would surely be only after the first bootup of the particular Windows installation, whereas the excessive disk activity has not reduced at all over quite a lot of bootups over several days now. Also, I understand that XP also has prefetch, and I never had such excess disk activity in my XP Pro installation.

Hi george,

What you need to do with process explorer is doubleclick on the srvhost entry that you are interested in and check the process tab which will indicate the actual process that svchost is calling. this will allow you to investigate the actual process online to see if thare are known issues or possible cures for the activity or the processes' parent application. Unfortunately this is not a one click fix solution. you can filter the process explorer output to show you only svchost write activity. if you have a look on the Sysinternals site under support for process monitor you should find examples there.

phillip, the prefetch should not be a problem after the initial post install frenzy of activity has completed also goes for things like search indexing unless you add a lot of files or applications at one time (that's the theory anyway )

Thanks barman,

I'm not used to Process explorer, I've used TaskInfo for years, but then TaskInfo doesn't provide the sort of transaction trapping that Process Explorer does. I'll have to do a bit of 'practicing' of exactly what steps to make, since on my system, this disc bashing only lasts a few minutes after waking from overnight sleep mode.

George

George,
just to try and aid you learning curve and assist with your situation there is an option to "Allow boot logging" on the options tab which may catch reads and writes at and straight after startup

good luck in your search :D

My x64 Ultimate SP1 bashez the HDD at startup to. Why does it keep scanning C:\ and how can i disable this file scan?

Re: Excess hard disk activity - another take - Eureka!

Eureka! Solved!

Well, I'll be b******d! The culprit was the one thing I'd not tested because the evidence seemed to be pointing away from it - Superfetch!

I've just disabled Superfetch and rebooted, and, once the startup programs were loading, the HD was just as quiet and sweetly purring as in my XP system, with no extended disk activity at all, let alone that worrying thrashing. I've checked that program loading isn't noticeably slower than with Superfetch enabled, AND in every case it is quieter, which means less HD wear.

Clearly Superfetch is altogether a big error on the part of MS, for any actual increase of program loading time is a tiny matter compared with the issue of prematurely wearing out one's hard disk, and indeed the psychological effect of working on a computer which seems to be labouring for much of the time.

One great sigh of relief!

Hey, one thought. As the disk thrashing is such a general Vista problem, could a note of this solution actually be pinned up as a 'sticky' or something, to save people not finding this thread because it's got buried?

Philip the problem with Superfetch is a well-known issue for Vista. I just disabled the service now and ill have to see if there is any performance downgrade. Thanks for the tip.

Hi phillip,

glad to hear you've solved it .
Personally I run with superfetch enabled as I don't find it a major problem. saying that, I can understand your position, and only time will tell if you see an overall improvement, assume your Mem usage has gone down anyway :D.

as for the pinning of the thread there is quite a bit on the Pros & cons of superfetch on the tutorial Here but may be one of the admins may wish to move the relevent posts to the comments on the tutorial.

anyway all the best (must go replace my keyboard before it rains )

My rig runs much better with superfetch on and no hard disk thrashing on startup or anytime else for that matter. The only time my hard disk spins up noticeably is when I more large (20gs or more) amounts of info.

Hi Philip,

Well, if turning off Superfetch does it then you've found it. But I'm going to have another try at watching it next boot with Process Monitor. I'm sure when I did it last time and was looking at the filenames it was scanning, they certainly didn't look like anything that would have to do with pre-fetching my most used programs, it looked like it was scanning the whole C: drive.

I think I'll do that just for my curiosity, and then I'll try diabling Superfetch and see how that goes.

George

Yes, George - that was part of the circumstantial evidence that made me pretty sure that Superfetch wasn't the culprit. It was only through my actually taking the plunge and disabling it, and then finding that I had no more of that unwanted disk thrashing, that I was left with the inescapable conclusion that Superfetch was the culprit.

I guess this is one reason why there are so many people out there still struggling to find out how to stop that disk thrashing - it just looks so improbable that Superfetch is doing it. One other thing that for me had been pointing squarely away from Superfetch had been that over a good week's use of Vista (3 or 4 sessions per day) the disk thrashing appeared not to have diminished at all, whereas it appears from what we're told about what Superfetch does, that if one keeps using the same small number of programs every session the excess disk activity should rapidly reduce to very little over a very few sessions.

Anyway, for me the bottom line is that I don't have to believe that Superfetch was doing it; I just know from experience that at least on my system the trouble stopped upon my disabling Superfetch. :D

I agree Philip, Superfetch should not require that kind of resource usage to do its job.

Thinking about it, you turn on your computer (or wake it up) and start your normal apps, and it takes LONGER than normal because the disk is so d**n busy with Superfetch. It takes longer than it would have taken without it. And right after you turn things on is the last time you want to be slowed down by some supposed enhancement tool.

Sure 3 hrs later things might restart faster, but that's no consolation, all you end up remembering in the long term is the slowdown.

The effect is that everything else is 'normal' but after boot things are 'slow'. So your personal mental average is ('Normal' + 'Slow') / 2 which means below average. So much for SuperFetch giving you a 'better' experience.

The analogy may be slightly flawed, but then we ARE b*tching here, so maybe it isn't.

George

Actually, that's a thought. Maybe Superfetch comes into its own for people who leave their computers on all the time. For myself the computer is turned off (completely off even at the wall switch) between sessions. Anyway, my system seems to work just fine and be as responsive as ever, without Superfetch and without unintended disk thrashing. And I wouldn't leave my system on all the time in order to get Superfetch working properly.

On the other hand, I rather doubt that that is the real issue, and, seeing that apparently some people don't experience the disk thrashing and actually claim performance enhancement from SF, I suspect that the problem arises from the way that SF interacts with particular non-universal components or aspects of particular users' systems.