Hard Drive at 100% usage

Topic

New Reply

Hi.

I’m very good around computers but lately I’m very stumbled with the new computers that are being sold. I have a couple of computers that are always at 100% usage for at least 10 minutes after boot up. I went through most of the things that I can think of, like checking antivirus, malware (not present), Search service, start up items, etc. The thing is there are other computes that are exactly the same don’t have the same issue. They are all set up exactly the same. All have the latest drivers, Windows Updates, etc. This happens on computers from Dell and HP. Some are with SSD and some are with HDD. All drives are good and healthy. I verified SMART attributes as well as ran some disk drive benchmark tests.

I went through every possible solution documented on the web, which is mostly documented in the following links:

https://www.drivereasy.com/knowledge/100-disk-usage-windows-10-fixed/?__c=1

https://www.technology.org/2019/07/07/how-to-fix-100-disk-usage-in-windows-10/

https://www.makeuseof.com/tips-fix-100-disk-usage-improve-windows-performance/

I don’t have physical access to most of the devices. I access them through either LogmeIn or TeamViewer. You’d assume that they are causing the issues but the users are experiencing the same issues even if I don’t connect remotely.  This weekend I was able to get a Dell laptop from my neighbor that has the same issue.

I went through all the setting a number of times based on suggestions. I’ve verified everything. I also disconnected from internet just to be on a safe side. Last step I tried was going into the safe mode. Based on my experience is seems it’s still slow for about the first 10 minutes. It appears that the Disk tab of the Task Manager is NOT showing. Based on google search it appears to be due to laptop having Intel Rapid Storage technology. Don’t know how to proceed or what else to try.

I’m not sure if this is global issue with new computers being produced in the past year or so, if there’s something fundamentally wrong with Windows. I’ve never experienced this issue before.

1 user thanked author for this post.

johnf

Reply | Quote

Replies

Do you have OS version information, that may help?

Reply | Quote

Maybe this will help. I don’t have any experience with Win 10, but I had a similar problem on a couple of Dells running Win 7. Dell puts a LOT of junkware on their computers, much of which doesn’t at first glance seem associated with Dell. On Win 7 go to the control panel —> system and security —> services. Under services look for something called “softsmart” I’m not sure that’s the correct name, but it’s something quite similar, if not. (Sorry, I don’t have a Win 7 computer handy at the moment.) On the offending computers, it was a service that started automatically on startup. I was able to stop it or disable it and by doing so, I found it stopped some Dell junk from running. Helped a lot.

Maybe something similar will help on your Dells. I had an old Vista HP laptop that was crammed with HP junk; never did figure out how to stop that

Reply | Quote

This is a Windows 10 devices. None have bloatware. Happens even with clean boot, where I disable everything possible from msconfig and more

Reply | Quote

Between computer manufacturers useless ‘junk’ programs they load on your computer along with all the bloatware from Microsoft that automatically starts up (Xbox, for starters), there’s a LOT of useless garbage sucking up your CPU and running the C: drive to the max.

I’ve helped a number of friends with Win 10 computers that take ‘forever’ to ‘settle down’ and be useful.

First and foremost is getting rid of the Windows bloatware.  Going through ‘settings’ and ‘apps’ and remove the garbage you have no use for.  Also click the ‘startup’ option on the ‘apps’ screen and turn off what you don’t need as well.  Should you later use one of those programs, in most cases, it will ‘figure out’ what’s needed and start up whatever is needed.  If not, then go back and turn it back on again.

High on my list of other startup cpu-sucking products is Windows itself as well as your internet security software.  If your computers are running older Win 10 versions such as 1903 or 1909, Windows will spend some time up front searching for and applying updates to bring your computer gradually to newer versions such as 20H1 or 20H2.  All these updates have to be installed in a specific order to ‘progress’ your computer to the newer versions.

If you rarely turn on your computer, as in once per week or less, then your internet security software will also grind away for a while at boot time getting all of its updates downloaded and installed.

Another favorite target of mine is various cloud software products.  I had a friend with 4 different cloud services installed on his computer and his dual processor laptop computer spent 10 minutes ‘up front’ to synchronize each of the clouds with his laptop.  Each cloud service would scan his hard drive and match them to files in the cloud and then move data whichever way was needed to get both sides to the most recent versions.  Bandwidth on his home network became a bottleneck as well.

Perhaps one of the biggest startup ‘slowdowns’ is the result of having a physical hard drive as your drive C:.  Solid State Drives (SSD) are at least 10 times faster than the hard drives on all ‘store bought’ computers.  If you don’t have an SSD installed, you’ll be forever kicking yourself every time you boot up.

Computer hardware limitations is another big slowdown cause.  These days, I wouldn’t consider ANYTHING less than a quad processor with 8GB of RAM.  Between the hundreds of Windows startup tasks all concurrently demanding CPU and RAM, too little RAM will result it extensive use of the page file (thrashing, to us oldsters), and a CPU lacking ‘horsepower’ will make things go even slower.  Windows 10 recognizes multi-CPU processors and at startup will use every one as not only Windows processes but startup tasks of installed software products all have to ‘get their time’ at startup.

And don’t think that software you’ve downloaded and/or paid for is free from being a contributing ‘guilty party’ at startup.  In my opinion, Adobe Photoshop and Lightroom are among the worst! (I have the $10/month plan).  5 or more separate startup tasks plus 1 for Adobe Acrobat happen during every bootup!  And should one start either one or both, there will be 5 MORE tasks in the ‘start & suspend’ category.  Even though they only ‘come alive’ for a small number of cycles every now and then, it’s still overhead for Windows 10 to ‘keep track’ of all those needless tasks and processes.

For what it’s worth, I currently have about 150 Windows ‘services’ and other startup/resident tasks disabled on my Win 10 Pro 20H2 computer.  I make it a point to do additional tweaking to see if I can add to that list.  Of course, I am well backed up when I do.

 

Reply | Quote

Although 4 years old, this 5 Ways to Find What Programs are Accessing Your Hard Disk Drive article still has very good advice about how to check disk usage.

Post back if you need more info about using Sysinternals/TechNet’s Process Monitor. It’s a *great* utility… but has a bit of a learning curve, especially about filtering captures.

Hope this helps…

Reply | Quote

New Dells also do backups through their support assist program. Not sure where they store the files but many complaints from what I’ve seen.

Reply | Quote

I know you said that you’ve already looked at several things involving the disks themselves, but sometimes we can overlook the basics in trying to go for the jugular of the problem.

So, first things first with one of the basics…exactly how much RAM do these machines have? And, have you tried the built-in utility that allows you to test the installed RAM?

I’ve seen Windows 10 machines with only 4 gigs of installed RAM exhibit this behavior (very high disk usage/constant disk usage) due to the rather large amount of space Windows 10 requires for virtual memory due to only having access to 4 gigs of actual memory. Note that this is on machines that had 64 bit installations of Windows 10. Adding another 4 gigs helped, but putting in another 12 gigs would have been better. I asked one of the techs why they were only adding 4 gigs and he said it was because 8 gigs is all the motherboard could handle! These machines were also HP machines.

My personal machines don’t exhibit any of the behavior you’ve mentioned, partly due to the fact that they have 16 gigs of installed memory, and partly because they’re not from any particular mass name brand, but from a small mom and pop shop where I know the owners.

It appears that the Disk tab of the Task Manager is NOT showing.

On my personal machines with Windows 10 Pro 64 bit version 2004, I don’t have a Disk tab in Task Manager either, and I ‘m not sure if there is a way to add another tab. However, there is a column labeled “Disk” that is within the “Processes” tab. Could this be what you were thinking of?

If the column labeled “Disk” is missing in the “Processes” tab, simply right click on one of the other columns’ titles (such as “Network, for example) and then click on the item that says “Disk”, which will put a check mark next to it and the “Disk” column will now show up in the “Processes” tab.

As you may have guessed or know anyway, the “Disk” column will show you just what the processes are that are consuming so much of the hard drive’s time and effort. The biggest offenders will be boldly highlighted in color, in my case a shade of yellow/orange. The more prominent the color, the more of the resource they’re using. Once you use this to see what the things are that are consuming the disk’s time, you can then see just what can be done (if anything…some just can’t be tamed due to the way they operate) to rein them in or perhaps even uninstall them from the computer(s).

I’m  in complete agreement with @DrBonzo ‘s statement above…that part of the problem is due to the excessive junk that major PC makers tend to put on all of their machines straight from the factory.

I hope this helps you out on the journey to reduce the hard drives’/SSDs’ abuse that seems to be going on.

 

Reply | Quote

[dmitriy1980]

Thank you all for your comments. None of the computers have any bloatware as I’ve already removed it. There are no issues with RAM. Most devices have 8+GB. All have the latest Windows patches. None of the devices use cloud solutions and none use process-intensive software like Adobe Photoshop. As mentioned issue occurs whether connected online or not.

As for the missing Disk tab, there’s no tab and there are no options to add a column named Disk.

I’ve removed EVERYTHING possible from startup. I’ve shutdown as many services as possible as well.

Attached is a screenshot of the disk from Task manager not in safe mode.

• This reply was modified 4 years, 4 months ago by dmitriy1980.

Reply | Quote

I have neither OneDrive nor YourPhone. What happens if you disable those two operations and reboot?

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

Unfortunately, Task Manager does not show the disk activity of Windows 10’s multiple hidden processes, for example the the uploading of telemetry compiled by the DiagTrack service and downloading of UWP updates and ‘Spotlight’ images, even though network traces show the externally connected endpoints in use (mostly Content Delivery Networks working on behalf of Microsoft).

Nor does it show the file I/O activity of internal WMI queries, pagefile swaps or constant maintenance of the hidden application, security and system log files. Most importantly in terms of initial high disk usage, Task Manager‘s Disk tab does not accurately show $LogFile and $Mft file activity caused by antimalware scans and Explorer processes.

In other words, if you add up all the identified disk activity processes it rarely, if ever, comes to 100% even when the Disk tab shows activity maxed out. IMO Task Manager just gives an overall view which isn’t particularly granular nor especially accurate.

It’s for this reason that I almost always replace Windows’ built-in Task Manager with the freeware utility Process Hacker (and set it to be used instead of Task Manager).

As the screenshot shows, Process Hacker shows not only more information about the processes involved but, usefully, which files are being accessed.

Perhaps even more useful, if you click on the System information tab then on the I/O graph itself the display will show you patterns of rhythmic activity… your filesystem’s ‘heartbeat’. This is invaluable for tracking file activity spikes because you can hover your mouse’s cursor over a spike to see the process causing it:

If you are adverse to using third-party utilities then use Windows’ built-in Resource Monitor (found under Start > Windows Administrative Tools). IMO its Disk tab is much better at showing file I/O activity than Task Manager and its graphs are useful for monitoring spikes (although they don’t provide the same functionality as Process Hacker‘s ‘System information’ graphs):

Hope this helps…

2 users thanked author for this post.

rexr, satrow

Reply | Quote

Thank you. I will check Process Hacker. I already used built-in Resource Monitor and it wasn’t useful to determine the issue.

DiagTrack telemetry has already been disabled.

Reply | Quote

I forgot to add… Windows’ built-in Resource Monitor can also be started from Task Manager. Just click on the Resource Monitor button at the bottom of the Performance tab.

For more information about using Resource Monitor, have a look at these two articles:

A detailed Windows Resource Monitor guide (ghacks.net)

Monitoring Your PC with Resource Monitor and Task Manager (howtogeek.com)

This latter article shows a useful trick of saving Resource Monitor’s configuration as a shortcut directly to – for example – the Disk tab.

Hope this helps…

Reply | Quote

I downloaded Process Hacker and attaching a couple of screenshots.

Reply | Quote

dmitriy1980 wrote:

I downloaded Process Hacker and attaching a couple of screenshots.

The thing I noticed immediately was the screenshot showing the System information output (image 2). This showed CPU, I/O, Disk and Network activity all spiking at almost exactly the same time, suggesting strongly that the activities are related to one another. Did you hover your mouse over the spikes to see if the same process(es) was/were responsible?

Image 3 shows the processes appear to be Windows Defender carrying out scans (which is normal) and Chrome’s Software Reporter Tool. Have a read of these two articles about this tool:

What is Software_Reporter_Tool.exe Causing High CPU Usage? (AskVG)

How to block the Chrome Software Reporter Tool (ghacks.net)

You might consider temporarily (or permanently) blocking the tool to see what effect it has on performance.

Hope this helps…

Reply | Quote

Hi.

I’m not sure why this thread is not sorted in the chronological order. Anyway, Even though CPU, Disk, Network are showing spiking up, only Disk is showing at 100% in Task Manager. Secondly, there’s no internet on the current laptop, so it might be spiking on Network activity, there’s actually nothing to process.

As far as Software Reporter Tool, I wouldn’t look at it as a culprit. It was only running because I connected online to download Process Hacker and left the browser open. Meanwhile, I did disable it now and attaching 2 additional screenshots after restart.

Reply | Quote

Do you have 2 real-time anti-virus (Defender and 3rd party app) running at the same time ?

Reply | Quote

had Norton. I uninstalled it. It was happening even before I installed it. I disabled Defender as well, it appears the issue still persists.

1 user thanked author for this post.

Alex5723

Reply | Quote

dmitriy1980 wrote:

Even though CPU, Disk, Network are showing spiking up, only Disk is showing at 100% in Task Manager.

Both new screenshots show system files appended with ‘WofCompressedData‘.

Can you open an elevated command prompt (or PowerShell prompt then type cmd and press ‘Enter’) then enter the following command:

compact /compactos:query

Please post the result… ‘cos it looks like the system is using compressed files.

How much RAM and how much disk space (original capacity and remaining free space) does the device have that you’re capturing screenshots from?

Hope this helps…

1 user thanked author for this post.

satrow

Reply | Quote

After running this command I get the following:

The system is in the Compact state. It will remain in this state unless an administrator changes it.

This specific laptop has 386GB free of 930 GB, so 1 TB drive. 8GB RAM

Reply | Quote

The thing is any screenshot I post, it would have a different file listed. It just happened to be that in this specific screenshot it was “WofCompressedData”. If I post 10 screenshots, they all will have different entries.

Reply | Quote

[johnf]

Dimitry’s link is a good one (Lol on Solution #7 !)

I fixed a similar problem on a Dell using Solution #6 (Fix your StorAHCI.sys driver with a regedit). Dell also posts the same solution on one of their tech notes:

Windows 10 – Task Manager Reports 100% Disk Utilization with MSI Mode Enabled

Not sure why Dell hasn’t fixed this issue, though. The computer I worked on with the problem was at least 3 years old.

• This reply was modified 4 years, 4 months ago by johnf.
• This reply was modified 4 years, 4 months ago by johnf.

Reply | Quote

This specific laptop doesn’t use this driver. But again, I’m having same issues with HPs.

Reply | Quote

Dell also had a “work around” on the same tech note, if the regedit didn’t work:

“If the steps above do not resolve the issue, the following steps may provide a workaround:

1. Navigate to Control Panel
2. Select System and Security
3. Select System
4. Select Advanced System Setting
5. Under Performance, Select Setting 
6. Select the Advanced Tab
7. Select Change
8. Set the minimum to the amount of System Ram installed
9. Set the Maximum to double the amount of System Ram installed
10. Select Apply
11. Select OK
12. Restart the system

This process increases the size of the Pagefile that Windows uses to ensure enough storage space is allocated to the Operating System.”

Reply | Quote

This is how it was set. I set it to no pagefile and had the same issues. I just changed it back to your recommendation, still the same issue.

Reply | Quote

This specific laptop has 386GB free of 930 GB, so 1 TB drive. 8GB RAM

Wow, there’s a lot of stuff on the drive!! What else is on there besides just the Windows installation??

Because of the “lack” of disk space, maybe that’s why Windows is running in its “Compact” mode.

My machines have 500 gig SSD’s and the installation of Windows 10 Pro x64 only takes up about 25 gigs or so, leaving a LOT of room for other items such as a suite of office productivity applications, media files, etc. That’s why I’m wondering what other types of programs are on the computer aside from Windows?

Reply | Quote

[dmitriy1980]

Here’s an attachment with report of what’s on the drive. This is the one I have physical access. Most of the ones that I can access remotely have like 700GB free out 1TB.

• This reply was modified 4 years, 4 months ago by dmitriy1980.

Reply | Quote

Is there also a D: partition on that disk occupying the remaining 512GB?

Does clicking on the “90 Errors” at the bottom reveal anything useful?

Reply | Quote

I doubt there’s another partition with that kind of allocation, this software majors on used space, started as Admin on W7 I see the actual drive size in the Status bar:

Reply | Quote

There’s no D: partition. It seems software by default is excluding some folders like c:\System Volume Information, recycle bin and others. Those are the ones shown under “error” link

Reply | Quote

Do you ‘lose’ the errors when you start TreesizeFree as Admin?

Reply | Quote

Should you decide to take Windows out of its “Compact” mode, here’s a link to a Tenforums post on just how to do that:

https://www.tenforums.com/tutorials/22088-compress-uncompress-windows-10-compact-os.html

Taking it out of Compact mode may very well reduce the amount of intensive use of the disk you’re seeing, but you will obviously lose some disk space. As the article I linked to says, it may take some time for Windows to “un-compact” itself, so be patient.

@Rick-Corbett , do you have any other thoughts since you’re the one who found this fact of Windows possibly running in its Compact mode?

Reply | Quote

Are you talking about compact /compactos:never command?

Reply | Quote

Ran this command. Took about 30 minutes to complete. No difference in disk performance.

Reply | Quote

Bob99 wrote:

@Rick-Corbett , do you have any other thoughts since you’re the one who found this fact of Windows possibly running in its Compact mode?

Only that AV scanning (e.g. Windows Defender) and remediation checks (i.e. WaaSMedic) of compacted system files adds an additional file I/O overhead that shows as high disk usage. These checks (together with AV definition downloads and uploads of queued telemetry) typically complete within 10 mins, after which time both CPU and disk usage drop to a ‘normal’ level. The initial high disk usage can take longer though, for many additional reasons.

If attempts are made by users to stop/disable or otherwise amend the default Windows Update then this could take longer as the WaaSMedic service attempts to ‘fix’ the state and logs what it’s found and what it did. If the default-enabled Connected User Experiences and Telemetry service (DiagTrack) isn’t disabled then this WaaSMedic data is added to telemetry uploaded to Microsoft, hence the additional Networking spike. (If an internet connection is not found then Windows begins its multiple ‘IsConnected’ tests which, in turn, leads to additional CPU, Networking and Disk usage.)

In this case I think it’s a bug… because Windows is only supposed to automatically compact its system files when the hard disk isn’t very big. In this example case, a 1TB drive with ~390GB free space should not have resulted in automatic system file compaction.

Hope this helps…

Reply | Quote

Any interest to do remote session to see what I’m experiencing on the computer, which was described in this thread? I can facilitate that. Thanks in advance.

Reply | Quote

Interest or not, that’s something that’s frowned upon and usually verboten on every forum I’ve been a member of.

If you can’t walk to their home, don’t allow them access.

1 user thanked author for this post.

Kirsty

Reply | Quote

Understood. Thanks

1 user thanked author for this post.

satrow

Reply | Quote

What drive type and speed on this machine? Exact CPU model?

Reply | Quote

This specific system is Dell Inspiron 5559. Intel Core i5-6200U CPU @ 2.30 GHz. 8GB RAM. 1TB drive.

1 user thanked author for this post.

satrow

Reply | Quote

A 15w Skylake mobile i5 U-suffix CPU is going to be pretty weak, maybe roughly comparable to the slowest i3 desktop but hampered by less cache, lower RAM speed potential and probably slower iGPU throughput. I assume the 1TB drive is an hdd and probably 5,400 rpm, that’s going to contribute to the % disk usage too.

How long are your Windows sessions, have you tried letting it ‘rest’ for a few hours to see if the disk usage eventually drops?

Where do the driver updates originate from, MS, OEMs, 3rd party app/software?

How about any common 3rd party software factors, what about security software?

Reply | Quote

Correct on most points. Disk usage drops after about 10 minutes and just sits idle for hours until I open a shortcut or a program, at which points it takes 6-7 seconds to open up, even just a regular Window Explorer. The issue occurs with or without Norton 360. All the drivers that were available for update, I got from Dell Update/SupportAssistant.

Reply | Quote

[Bob99]

@dmitriy1980 –

Is there a way for you to add another 8 gigs of RAM to the machine you have physical access to? If so, you may want to add memory and then see what happens.

Obviously, make sure it’s fully compatible with the system first. One way to do that would be to, with the system off and the battery removed, open the area containing the RAM module(s) and extract it/one of them to see what brand and exact type it is along with it’s speed. Last I knew, that info was contained on a sticker or printed on the module itself.

I was disheartened to learn that un-compacting Windows did not help the situation with the excessive disk activity.

For the benefit of those here trying to help, can you post a screenshot of the “Startup” tab of Task Manager ? I know you said that you’ve tried disabling everything you could from startup, but maybe one of the remaining tasks is a resource hog that’s helping cause the excessive disk activity.

Oh, one other thought just came to mind: Is indexing enabled on the machine(s) in question, and if so, exactly what is it indexing…what are the indexing settings on the computer? It could be that the indexing service is having a really hard time building an index of the files on the drive, thereby causing high disk activity until the index is rebuilt after every reboot.

I had it happen in Windows 7, so I disabled indexing and that solved it for me. With indexing disabled, I didn’t notice any slowdown in the speed of searches on the hard drive. Same thing holds true for me now with Windows 10..haven’t missed the lack of indexing at all with the few searches I’ve conducted on the hard drive.

• This reply was modified 4 years, 4 months ago by Bob99.

Reply | Quote

attached are startup tab and indexing off

Reply | Quote

@dmitriy1980 –

Can you please provide a screenshot of what shows when you open “This PC” ? We’re trying to figure out just why C: only shows as being 50 gigs in size, when there are still about 500 gigs of data somewhere else on the system. I do realize you’ve already said that there’s no D: partition, but we’re curious what else there is that Windows sees on that computer for data storage of any type, and that will, of course, show up in This PC.

Thanks in advance for this indulgence.

1 user thanked author for this post.

b

Reply | Quote

Thank you all for guiding me and helping me out. I will respond to the last 2 posts tomorrow. Neighbor needs the laptop back tomorrow, so i will try to review the questions and answer them sometime in the AM.

Reply | Quote

There’s nothing to figure out, TreeSizeFree shows the free space % on hover or on the Taskbar, another example from my W7 started as Admin:

Maybe you can ascertain why the Taskbar doesn’t show for the OP, it maybe a W10 and Run as Admin thing?

Reply | Quote

[Bob99]

Ok, but why does C: only show as 50 gigs in size, but yet at the bottom of the  screen TreeSize says that there are a total of 930 gigs installed, of which 378 are still available? 930-378=552. 552-50=502 still unaccounted for.

930 gigs installed-378 gigs available=552 gigs used. 552 gigs used-50 gigs listed as being used for the C: drive=502 gigs still unaccounted for.

Same thing @b is asking below.

• This reply was modified 4 years, 4 months ago by Bob99.

1 user thanked author for this post.

satrow

Reply | Quote

here you go

Reply | Quote

satrow wrote:

There’s nothing to figure out, TreeSizeFree shows the free space % on hover or on the Taskbar, another example from my W7 started as Admin:

Your folders/files size and free space size add up to the drive capacity (as does mine).

But dmitriy’s used size and free size only adds up to 46% of his drive size. Why is that?

satrow wrote:

Maybe you can ascertain why the Taskbar doesn’t show for the OP, it maybe a W10 and Run as Admin thing?

His status bar is there, showing free space and total capacity. But the figures don’t add up like ours.

1 user thanked author for this post.

satrow

Reply | Quote

b wrote:

His status bar is there, showing free space and total capacity. But the figures don’t add up like ours.

Sorry guys, I could have sworn there was no free space/total size showing on the taskbar – yet I do recall seeing the 90 failures flagged up there…

The EN FAQs aren’t translated very accurately but I can only see the lack of Admin rights as being (partially) responsible for the disparity.

Reply | Quote

Have you set W10 to show hidden files (sleep, hibernation, …

Reply | Quote

Is it even possible to hide those in TreeSize or WizTree?

Reply | Quote

b wrote:

Is it even possible to hide those in TreeSize or WizTree?

I think you can if you deselect ‘always run as administrator’.

Reply | Quote

Sorry for all the confusion. I reran TreeSize as Administrator and I’ve found where most of the drive usage is as shown in the attached screenshot.

2 users thanked author for this post.

Bob99, b

Reply | Quote

Ok, now the data makes sense, nothing’s really missing. Thank you very much for that post!

Now that the “missing data” issue has been solved, I suppose the next thing is to get a screenshot of the Resource Monitor with the “Disk” tab selected, but please read the next paragraph for exactly what screenshot to post.

Once you’ve selected the “Disk” tab, then click on the arrow on the right side of the second bar down on that page which should be labeled only as “Disk Activity”. That should expand the disk activity listing so that it shows exactly what’s going on. To make the resource hogs easier to spot, click the title area of the column labeled “Total (B/sec)”. That should put a little downward pointing arrow above the title, and you should now be seeing the item or process that’s taking up the most resources of the disk/hard drive. Take a screenshot of that and post it here so we can see just what’s taking up so much of the disk’s time and resources. that way we’ll be able to make suggestions on what to do to solve the problem.

If you’re more comfortable using Process Hacker for this then go right ahead and do so, just please post a screenshot of what it shows for the actual disk activity.

Reply | Quote

I’ve posted that already on 2 occasions in the above thread (from Process Hacker though). Are those not enough? I can post some more if needed but again every couple of seconds it shows different processes on top.

Even when everything quiets down after 10 minutes and if I click “This PC” shortcut, it would show explorer.exe as the top resource but obviously it’s a Windows file and nothing can be done about that and disk becomes at 100%.

Reply | Quote

Hi dmitriy1980,

Let’s try to narrow down the issues by allowing Windows to only load everything which is needed to boot the computer.

For the time being, make sure that the Windows Disk Defragmenter program is turned off. Disk Defragmenter can cause both high CPU and disk I/O usage.

Next, let’s make sure that Windows, on bootup, only loads stuff which is required for booting up the computer, and only loads programs which are configured to be loaded when the computer boots up. This is accomplished by disabling Prefetch and Superfetch for applications which Windows knows that users manually launch either immediately after booting their computers, or which users manually launch at roughly the same time every day.

First, we should create a regfile which allows you to quickly restore the default values for Prefetch and Superfetch. Copy and paste everything between the following two rows of asterisks into Notepad, and then save the file as: Default_Prefetch_and_Superfetch_Enabled.reg

*******************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters]
“EnablePrefetcher”=dword:00000003
“EnableSuperfetch”=dword:00000003
;
;
; The possible values for EnablePrefetcher are:
;
; 0 – Disable Prefetcher
; 1 – Application launch Prefetching enabled
; 2 – Boot Prefetching enabled
; 3 – Application launch and Boot Prefetching enabled (default value)
;
;
; The possible values for EnableSuperfetch are:
;
; 0 – Disable Superfetch
; 1 – Enable Superfetch for boot files only
; 2 – Enable Superfetch for applications only
; 3 – Enable Superfetch for both boot files and applications (default value)
;
;
*******************************

The above regfile will allow you to quickly restore the default values for Prefetch and Superfetch in Windows 7 and above by simply right-clicking on it and then choosing to merge it into the registry.

Next, we want to tell Windows to not load any programs which any user manually runs immediately after booting the computer, or which any user runs roughly at the same time every day. The idea here is to limit the number of programs and processes to only what Windows needs to boot, and to only any additional programs and processes which have been configured to run when the computer is booted up. To do this…

Copy and paste everything between the following two rows of asterisks into Notepad, and then save the file as: Only_Boot_Files_Prefetch_and_Boot_Superfetch_Enabled.reg

*******************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters]
“EnablePrefetcher”=dword:00000002
“EnableSuperfetch”=dword:00000001
;
;
; The possible values for EnablePrefetcher are:
;
; 0 – Disable Prefetcher
; 1 – Application launch Prefetching enabled
; 2 – Boot Prefetching enabled
; 3 – Application launch and Boot Prefetching enabled (default value)
;
;
; The possible values for EnableSuperfetch are:
;
; 0 – Disable Superfetch
; 1 – Enable Superfetch for boot files only
; 2 – Enable Superfetch for applications only
; 3 – Enable Superfetch for both boot files and applications (default value)
;
;
*******************************

After saving the above as a regfile, right-click on it and choose to merge it into the registry. After doing this, reboot the computer. After rebooting, only programs and utilities which are configured to run during the boot process will actually be loaded by Windows. This, in addition to Disk Defragmenter being disabled, might greatly narrow down the issue of what is causing 100% disk usage and high CPU usage on the computers at issue.

After making sure that Disk Defragmenter is disabled and after merging the above regfile into the registry, and then rebooting and waiting 10 minutes for Windows to settle down, all disk I/O and CPU activity should be extremely low. If not, then either malware or remote backdoor access are strong possibilities.

Finally, I vaguely recall that LogmeIn and TeamViewer are based on RealVNC??? I also recall seeing various YouTube videos which show how easy it is to hack RealVNC and gain access to remote computers.

I strongly suggest that you make sure that LogmeIn and TeamViewer are updated to their latest versions. I also strongly suggest that you examine Windows Event Viewer and antivirus program logs and search for any information which indicates unauthorized remote access to the computers at issue.

Best regards,

–GTP

1 user thanked author for this post.

dmitriy1980

Reply | Quote

Removing formatting and posting again:

 

1)Windows Disk Defragmenter is off

2) Registry file executed

3) Restart #1

Time from the moment I clicked restart to the time loaded: 5min
Time from the moment Windows loaded and I was able to open Task Manager: 2min
Time from being able to open Task Manager and Disk graph stabilizing: 2.5 minutes
So, overall time from the time to restart to Windows normalizing: 9.5 minutes

 

4) I think it’s way too much time, so without doing anything else, I clicked restart again (Restart #2)

Overall time from the time to restart to Windows normalizing: 6:37 minutes (some improvement)

5) Restart #3

Overall time from the time to restart to Windows normalizing: 6:31 minutes (some marginal improvement)

NOTE: In the last 2 restarts at about 6 minute mark Task Manager went down to 0% Disk utilization and then in about 7 seconds went back to 100% for 30 seconds and 24 seconds, respectively.

This specific laptop is the one that I was able to borrow from a neighbor (as specified in posts) and not the one mentioned in the original post, however it’s having the same issues. This was needed, so that I have a physical device to play around with. I don’t have physical access to devices in the original post. This specific laptop does not have LogmeIn or TeamViewer. (I did have to install TeamViewer a couple of days ago but it’s no longer there). So, again it doesn’t have either and the issue persists. Having said that I always keep all my software up-to-date.

Windows Event Viewer is viewed and reviewed counteless times and there’s nothing that would indicate any issues. I’ve poured over Windows Defender and Norton logs and again nothing that would indicate a backdoor. Secondly, when I’m booting up, computer is not connected to internet, so it shouldn’t be connecting to outside. Even if it wanted to, it would be recorded in the logs, which it’s not. I’ve tried book up with ethernet line connected as well, same results.

Reply | Quote

Hi dmitriy1980,

These are the stages for the Windows boot process:

1. Service Boot Start
2. Service System Start
3. Service Demand Start
4. Service Disabled

See this link for information about the these stages of Windows booting:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/what-determines-when-a-driver-is-loaded

All of the above gets completed during the first five minutes of booting Windows, and is usually completed during the first three minutes. There will be high CPU and disk activity during these three minutes

After five minutes, Windows then loads all programs which have been configured to automatically run on OS startup. These programs get launched on OS startup either via the registry or via the Task Scheduler. Between five minutes to ten minutes after booting your computer, there could be high CPU and disk activity lasting up to five minutes. It depends on how many programs are installed on the computer and whether or not those programs automatically run utilities when you boot your computer. I have lots of stuff installed on my computers. As a result, the CPU and disk activity on all of my computers does not settle down until around nine minutes after booting my computers.

You can use Autoruns to see all of the stuff which is loaded by the computers which are experiencing slow boot times and high CPU and disk activity. Here is the link for Autoruns:

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

Best regards,

–GTP

 

Reply | Quote

Thank you for a response. I’m familiar with AutoRuns and use it on all of my computers. I did install it on this particular laptop as well. However, I’m not understanding the purpose of your post. Are you saying that 10 minutes is normal for boot up time? If so, I would disagree with that statement.

Reply | Quote