Ask a new question

PID 4 - High disk activity - What and why?

Windows 7 - SP1

Over the last few days, I've noticed the hard disk light blinking away furiously. I checked the resource monitor tons of read/write activity: Image/System; PID/4. The apparently involved files are many and varied.

What's up with this? Sometimes it appears to slow the computer down...

Many thanks.

Ken

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Hi Ken,

 

Thank you for posting your question in the Microsoft community.

 

From the description I understand that you are noticing that there is lot activity happening in the background on your computer. Let me know if this incorrect.

 

Method 1:

Visit the link provided and run the troubleshooter.

Open the Performance troubleshooter

http://windows.microsoft.com/en-US/windows7/Open-the-Performance-troubleshooter

 

Method 2:

You can optimize the performance of Windows, try the methods mentioned in the article by visiting the link:

Optimize Windows 7 for better performance

http://windows.microsoft.com/en-us/windows7/Optimize-Windows-7-for-better-performance

Let us know if you need further assistance.

 

 

Vinod Archak
Forum Moderator

3 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I have exactly the same problem and still could not fix it. I tried the solutions but nothing changed.

Any other ideas?.

Thank you.

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I have the same problem also now, it's been happening for about 3 months. My computer configuration (except for automatic updates from MS) hasn't changed in about 3 years. Windows 7 w/SP1.

In Resource Monitor PID 4 (System) is constantly reading 1000's and 1000's of files, most of which are from my media directory which has literally 10's of thousands of files in nested directories (which I think is not so relevant).

There is very little write activity but the disk queue is constantly >0 and, because the files are on a RAID array it's REALLY loud.

Process explorer tells me nothing useful about the activity.

I initially thought it was MS Security Essentials because when it first occurred I could "turn it off" by disabling real time file protection. This was a 1:1 result - if I turned off real time scanning the activity stopped, as soon as I turned on real time scanning the activity returned. The *abnormal* thing about this was that the entire directory being access was *excluded* from Security Essentials.

So I removed Security Essentials, replaced it with Avast and things went back to normal for over a month.

Now the reading is back again. I let it do it's thing last night and 10 hours later it's still going, repeatedly reading *exactly* the same files, again and again and again. Security Essentials is no longer installed in my computer.

I have explicitly *denied* "SYSTEM" access to this path (and all child folders and files) using NTFS security permissions and the access still persists (how is this possible?).

If I change the drive letter assignment from D: to say E: the activity stops immediately and does not resume. The *instant* I change it back to D: the activity resumes. If the activity is dependent on a drive letter assignment it can't be a very low level activity - i.e. it *should* be easy to diagnose.

Windows Search is disabled at the system level (via Add/Remove Windows Components) and all Indexing services are stopped.

Windows Media Player has all of it's libraries pointed to an empty folder so it's not scanning or sharing anything.

I've scanned for all sorts of infection using multiple tools (including MS tools) and can find none.

Questions:

1. How do I establish *precisely* what "SYSTEM" activity is causing this and more importantly *why*? The "why" part is the most essential here. There should be a very simple tool in Windows to allow me to do this.

2. It's undesirable activity, it's unsolicited activity and by all logical reasoning it's unnecessary activity. How do I stop it?

3. Why, if I *explicitly* deny access to a folder and files using NTFS security permissions is "SYSTEM" still able to access those files? Should this not be impossible?

Please under no circumstances recommend an upgrade to Windows 8.

Thanks in eager anticipation.




72 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Anyone found the fix for this?

I tried disabling Windows Updates from Automatic Installation and also the Antivirus, yet the issue persists.

Someone mentioned at ServerFault.com that disabling IE's feature to automatically update fixes the issue but this option is on IE 10 only and my system has IE 9.0

Eagerly waiting for fix. 

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Anyone found the fix for this?

I tried disabling Windows Updates from Automatic Installation and also the Antivirus, yet the issue persists.

Someone mentioned at ServerFault.com that disabling IE's feature to automatically update fixes the issue but this option is on IE 10 only and my system has IE 9.0

Eagerly waiting for fix. 

I am DM991 but have no idea what account I used for my last post so had to create another one.

Short answer: No fix

I stripped my system down entirely to MS software only, I removed everything including purging all non-MS entries from the registry, I rebuilt/replaced all MS system files to original and downloaded all required updates directly from MS and MS only.

The problem persisted and it's 100% a Microsoft process (or MS approved driver) that is causing it.

I have "fixed" it by reinstalling Windows from scratch... but of course I assume it will eventually return.

It may have something to do with the e/SATA drivers in use - are other victims using SATA or eSATA disks? Mine is an eSATA RAID array (MS drivers). 

Microsoft should either account for this or provide us with tools to diagnose it. Their product support is rubbish.

Edit: I removed IE and the problem remained.


9 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi,

I know you wrote "Process explorer tells me nothing useful about the activity.", though...:
What I'd try is using process explorer again by double-clicking on the "System" process and opening the "Threads" tab. Often, threads with high disk activity also have higher CPU activity, so find such a thread by looking at the "CPU" column. Post the "start address" column of the suspicious thread(s). This is not an unambiguous hint but maybe a start.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hopefully somebody can do this (I'm not experiencing the problem at the moment).

I did try but a dll complained about the symbol server and pointed me to a (Windows 8) SDK page which is a suggestion beyond my willingness to investigate.

If MS can't provide a "what's (over)using my disk right now" tool for their own software then they shouldn't be publishing operating systems.

Yes I'm grumpy. This should be a trivial matter to diagnose.

Thanks for the suggestion nevertheless, if it works I hope it gets ranked up.

3 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

It might be Windows Media Player Network Sharing Service that you can disable from services.msc The file that is running should be wmpnetwk.exe

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I know this is old.  I was just having this issue and saw something about windows update settings.  Went through my Action Center and cleared up all the issues listed there about error reporting and windows update and the disk thrashing immediately stopped.

Hopefully this helps someone.

4 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I had this recently too and it turned out that it was McAfee on access scanner service that was the problem. Terminated the process and the activity stopped at which point the process automatically restarted but without the constant disk thrashing previously experience.

Unfortunately I'm on a domain computer that is locked down so I can't play with the setting to find the precise cause but if anyone else can might be useful.

We're running:

  
McAfee Agent 
Version number: 4.5.0.1852 
 
McAfee VirusScan Enterprise + AntiSpyware Enterprise 
Version number: 8.8.0 (8.8.0.975)
Build date: 14/08/2012
Scan engine version (32-bit): 5600.1067

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info

Last updated March 13, 2024 Views 71,758 Applies to: