Hard Disk activity monitor?

I've been using Windows 7 x64 Home Premium for about four years
and haven't had any problems with it or the PC it's running on.
I did have trouble with Java a couple of years ago so I uninstalled
it. I keep everything that needs to be up to date, including MSE,
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
way to back it up before doing this). I just installed Sandboxie and
I'll use that from now on to test unfamiliar programs and for browsing
the Internet.

I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
the hard disk is reading, writing, or otherwise accessing, whenever the
light is on or blinking? I've recently completely disabled the Windows
indexing to see if that would reduce the time the hard disk tends to
get busy after connecting to the Internet, but about twice per day when
I reconnect to the Internet, the hard disk light runs almost constantly
for about ten to fifteen minutes before it settles down. I realize
that the daily MSE definition updates will do this in part, but there
must be something else going on, but AFAICT I have no way of figuring
out what's causing it. I've always had the Windows updates set to
prompt before downloading, so I know it can't be that. I'm running an
old version of TCPView to monitor connections and see if anything is
"phoning home" that I don't know about, but a newer and more versatile
program might be more useful. But it's the excessive hard disk activity
that's got me mystified because it didn't start happening until about
only six months ago.

--
Bub

"Bubba" Bub@ba wrote in message ...

I've been using Windows 7 x64 Home Premium for about four years
and haven't had any problems with it or the PC it's running on.
I did have trouble with Java a couple of years ago so I uninstalled
it. I keep everything that needs to be up to date, including MSE,
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
way to back it up before doing this). I just installed Sandboxie and
I'll use that from now on to test unfamiliar programs and for browsing
the Internet.

I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
the hard disk is reading, writing, or otherwise accessing, whenever the
light is on or blinking? I've recently completely disabled the Windows
indexing to see if that would reduce the time the hard disk tends to
get busy after connecting to the Internet, but about twice per day when
I reconnect to the Internet, the hard disk light runs almost constantly
for about ten to fifteen minutes before it settles down. I realize
that the daily MSE definition updates will do this in part, but there
must be something else going on, but AFAICT I have no way of figuring
out what's causing it. I've always had the Windows updates set to
prompt before downloading, so I know it can't be that. I'm running an
old version of TCPView to monitor connections and see if anything is
"phoning home" that I don't know about, but a newer and more versatile
program might be more useful. But it's the excessive hard disk activity
that's got me mystified because it didn't start happening until about
only six months ago.



Try Task Manager Performance tab Resource Monitor Disk tab - disk activity.

On Wed, 4 Mar 2015, "Dave-UK" wrote:


"Bubba" Bub@ba wrote in message ...

I've been using Windows 7 x64 Home Premium for about four years
and haven't had any problems with it or the PC it's running on.
I did have trouble with Java a couple of years ago so I uninstalled
it. I keep everything that needs to be up to date, including MSE,
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
way to back it up before doing this). I just installed Sandboxie and
I'll use that from now on to test unfamiliar programs and for browsing
the Internet.

I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
the hard disk is reading, writing, or otherwise accessing, whenever the
light is on or blinking? I've recently completely disabled the Windows
indexing to see if that would reduce the time the hard disk tends to
get busy after connecting to the Internet, but about twice per day when
I reconnect to the Internet, the hard disk light runs almost constantly
for about ten to fifteen minutes before it settles down. I realize
that the daily MSE definition updates will do this in part, but there
must be something else going on, but AFAICT I have no way of figuring
out what's causing it. I've always had the Windows updates set to
prompt before downloading, so I know it can't be that. I'm running an
old version of TCPView to monitor connections and see if anything is
"phoning home" that I don't know about, but a newer and more versatile
program might be more useful. But it's the excessive hard disk activity
that's got me mystified because it didn't start happening until about
only six months ago.



Try Task Manager Performance tab Resource Monitor Disk tab - disk activity.


Dude, thanks! I'll post a follow-up to this thread after the next
time my hard disk light goes on constantly after connecting to the
Internet. If I can determine what's causing it, I'll google the
culprit and see if I can find out if it's normal or something more
akin to malware. That reminds me, I haven't set my PC to run a
check disk on the next restart in quite a long time. Could be the
disk because I've used this computer every single day for hours at
a time ever since I bought new.

--
Bub

Bubba wrote:
I've been using Windows 7 x64 Home Premium for about four years
and haven't had any problems with it or the PC it's running on.
I did have trouble with Java a couple of years ago so I uninstalled
it. I keep everything that needs to be up to date, including MSE,
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
way to back it up before doing this). I just installed Sandboxie and
I'll use that from now on to test unfamiliar programs and for browsing
the Internet.

I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
the hard disk is reading, writing, or otherwise accessing, whenever the
light is on or blinking? I've recently completely disabled the Windows
indexing to see if that would reduce the time the hard disk tends to
get busy after connecting to the Internet, but about twice per day when
I reconnect to the Internet, the hard disk light runs almost constantly
for about ten to fifteen minutes before it settles down. I realize
that the daily MSE definition updates will do this in part, but there
must be something else going on, but AFAICT I have no way of figuring
out what's causing it. I've always had the Windows updates set to
prompt before downloading, so I know it can't be that. I'm running an
old version of TCPView to monitor connections and see if anything is
"phoning home" that I don't know about, but a newer and more versatile
program might be more useful. But it's the excessive hard disk activity
that's got me mystified because it didn't start happening until about
only six months ago.


You can try Process Monitor from Sysinternals.

https://technet.microsoft.com/en-us/...rnals/bb896645

*******

Only start that running, when the disk activity is heavy,
as the monitor collects events for as long as it is
running, and leaving it run all day isn't a good option.
It's intended for short traces, like maybe ten minutes
worth. I've used it to trace an entire Windows Backup
run in Windows 7, but the trace log was 9GB in size, and
mostly useless (too big to read).

Don't try setting a filter on your first run. Without
any filter defined, it should be showing you everything.
Then, look for File Read or File Write activities.

There's a good chance the offender will be "svchost",
and then you're kinda screwed. Using Process Explorer,
you might be able to figure out the PID of which
of several svchosts is doing it. But the guilty svchost
has fifteen services running inside it (usually only
one of the svchosts is the bad guy). For example,
it might even be the Windows Update service doing
a scan (wuauserv?).

As an experiment, you can even try opening the
Windows Update control panel, when the heavy disk
activity starts. If the heavy disk activity
stops, then you might get some idea that it
was some Windows Update background stuff. I've
noticed on one occasion, that some activity related
to Windows Update or the scanning of packages,
stops if you access the Windows Update panel.

Nothing on Windows is absolute. I've done some things
on Windows, which won't show in monitoring tools, and my
experience is, there are some activities which are
"below the radar". Let's hope your case isn't one
of them. For example, Performance Monitor doesn't
show all disk activity, and sometimes I've had a flat
trace in PerfMon while the disk light is flickering.
So don't treat any of these tools as an absolute.
ProcMon uses ETW ("Event Tracing for Windows"), which
really should catch everything, but I don't know if
the permissions model of the operating system, prevents
ProcMon from seeing all of it or not.

*******

ETW is available early at startup, as well as at shutdown.
Tools like XPerf can collect traces at startup and shutdown.
This has nothing to do with your problem, but shows the
extent to which ETW was intended to "catch all of it". But
when some Microsoft tools seem to miss stuff, I tend
to distrust all of them as a consequence. Maybe ETW
is really good stuff, but it's sure hard to prove it.

https://web.archive.org/web/20120102.../cc825801.aspx

Paul

On Wed, 04 Mar 2015 13:48:15 -0500, Paul wrote:

You can try Process Monitor from Sysinternals.

https://technet.microsoft.com/en-us/...rnals/bb896645

*******

Only start that running, when the disk activity is heavy,
as the monitor collects events for as long as it is
running, and leaving it run all day isn't a good option.
It's intended for short traces, like maybe ten minutes
worth. I've used it to trace an entire Windows Backup
run in Windows 7, but the trace log was 9GB in size, and
mostly useless (too big to read).

Don't try setting a filter on your first run. Without
any filter defined, it should be showing you everything.
Then, look for File Read or File Write activities.

There's a good chance the offender will be "svchost",
and then you're kinda screwed. Using Process Explorer,
you might be able to figure out the PID of which
of several svchosts is doing it. But the guilty svchost
has fifteen services running inside it (usually only
one of the svchosts is the bad guy). For example,
it might even be the Windows Update service doing
a scan (wuauserv?).

To an extent, you can kind of see what's running under an instance of
svchost by following some of these tips.

http://www.bleepingcomputer.com/tuto...stexe-process/


--

Char Jackson

Char Jackson wrote:
On Wed, 04 Mar 2015 13:48:15 -0500, Paul wrote:

You can try Process Monitor from Sysinternals.

https://technet.microsoft.com/en-us/...rnals/bb896645

*******

Only start that running, when the disk activity is heavy,
as the monitor collects events for as long as it is
running, and leaving it run all day isn't a good option.
It's intended for short traces, like maybe ten minutes
worth. I've used it to trace an entire Windows Backup
run in Windows 7, but the trace log was 9GB in size, and
mostly useless (too big to read).

Don't try setting a filter on your first run. Without
any filter defined, it should be showing you everything.
Then, look for File Read or File Write activities.

There's a good chance the offender will be "svchost",
and then you're kinda screwed. Using Process Explorer,
you might be able to figure out the PID of which
of several svchosts is doing it. But the guilty svchost
has fifteen services running inside it (usually only
one of the svchosts is the bad guy). For example,
it might even be the Windows Update service doing
a scan (wuauserv?).

To an extent, you can kind of see what's running under an instance of
svchost by following some of these tips.

http://www.bleepingcomputer.com/tuto...stexe-process/



Agreed, Process Explorer can identify the services inside
a Svchost. But notice in that article, that no I/O rate
information is available. I tried to get that info while
I was running Process Explorer one day, and was quite
frustrated by the experience.

You can only guess at who is doing it, and that
the damn wuauserv is at it again...

There is a technique for partially solving that,
namely using "sc" to move each service into
its own svchost.

http://blogs.msdn.com/b/spatdsg/arch...-services.aspx

You can split it out into its own service by running:

sc config service type= own

And revert it via

sc config service type= share

where you would substitute "wuauserv" for "service" if
you thought that was the one. Then, when one svchost
starts doing I/O, if it only has the one service
in it, you've got it nailed.

If you have no clues as to which service is involved,
you might have to issue fifteen "type= own" commands
to string a trap on the things... And keep each one
in its own "jail cell".

Paul

On Wed, 4 Mar 2015 19:18:03 +0100 (CET), Bubba Bub@ba wrote:

Try Task Manager Performance tab Resource Monitor Disk tab - disk activity.


Dude, thanks! I'll post a follow-up to this thread after the next
time my hard disk light goes on constantly after connecting to the
Internet. If I can determine what's causing it, I'll google the
culprit and see if I can find out if it's normal or something more
akin to malware. That reminds me, I haven't set my PC to run a
check disk on the next restart in quite a long time. Could be the
disk because I've used this computer every single day for hours at
a time ever since I bought new.

I have the same problem in Windows XP, and Task Manager is of no help
in finding out what is causing the disk to churn like that.

When it starts doing it, depending on what I'm doing, it is quicker to
switch off at the wall and reboot than to try to continue working
while nothing else can access the disk.

So if you can find out what causes it, I'd love to hear.


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

On 05/03/2015 03:48, Steve Hayes wrote:
On Wed, 4 Mar 2015 19:18:03 +0100 (CET), Bubba Bub@ba wrote:

Try Task Manager Performance tab Resource Monitor Disk tab - disk activity.


Dude, thanks! I'll post a follow-up to this thread after the next
time my hard disk light goes on constantly after connecting to the
Internet. If I can determine what's causing it, I'll google the
culprit and see if I can find out if it's normal or something more
akin to malware. That reminds me, I haven't set my PC to run a
check disk on the next restart in quite a long time. Could be the
disk because I've used this computer every single day for hours at
a time ever since I bought new.

I have the same problem in Windows XP, and Task Manager is of no help
in finding out what is causing the disk to churn like that.

When it starts doing it, depending on what I'm doing, it is quicker to
switch off at the wall and reboot than to try to continue working
while nothing else can access the disk.

So if you can find out what causes it, I'd love to hear.


I had a PC that ran the HDD constntly. It got worse and worse until
performance became impossibly sluggish, unuseable, then wouldn't even
boot then wouldn't accept a clean re-install beause of disk errors. So
it can be that the HDD is about to die terminally - a wise time for
backups of data.

Tim W

On Thu, 05 Mar 2015 05:48:07 +0200, Steve Hayes
wrote:

On Wed, 4 Mar 2015 19:18:03 +0100 (CET), Bubba Bub@ba wrote:

Try Task Manager Performance tab Resource Monitor Disk tab - disk activity.


Dude, thanks! I'll post a follow-up to this thread after the next
time my hard disk light goes on constantly after connecting to the
Internet. If I can determine what's causing it, I'll google the
culprit and see if I can find out if it's normal or something more
akin to malware. That reminds me, I haven't set my PC to run a
check disk on the next restart in quite a long time. Could be the
disk because I've used this computer every single day for hours at
a time ever since I bought new.

I have the same problem in Windows XP, and Task Manager is of no help
in finding out what is causing the disk to churn like that.

When it starts doing it, depending on what I'm doing, it is quicker to
switch off at the wall and reboot than to try to continue working
while nothing else can access the disk.

So if you can find out what causes it, I'd love to hear.

In the old days, constant disk churning was sometimes a sign that RAM was
near it's limits and virtual memory was being used heavily. If that's what
you're seeing, Task Manager will mostly show it. The cure was to install
more memory, but switching to an SSD would also help some.

--

Char Jackson

On Wed, 04 Mar 2015 16:46:28 -0500, Paul wrote:

Char Jackson wrote:
On Wed, 04 Mar 2015 13:48:15 -0500, Paul wrote:

You can try Process Monitor from Sysinternals.

https://technet.microsoft.com/en-us/...rnals/bb896645

*******

Only start that running, when the disk activity is heavy,
as the monitor collects events for as long as it is
running, and leaving it run all day isn't a good option.
It's intended for short traces, like maybe ten minutes
worth. I've used it to trace an entire Windows Backup
run in Windows 7, but the trace log was 9GB in size, and
mostly useless (too big to read).

Don't try setting a filter on your first run. Without
any filter defined, it should be showing you everything.
Then, look for File Read or File Write activities.

There's a good chance the offender will be "svchost",
and then you're kinda screwed. Using Process Explorer,
you might be able to figure out the PID of which
of several svchosts is doing it. But the guilty svchost
has fifteen services running inside it (usually only
one of the svchosts is the bad guy). For example,
it might even be the Windows Update service doing
a scan (wuauserv?).

To an extent, you can kind of see what's running under an instance of
svchost by following some of these tips.

http://www.bleepingcomputer.com/tuto...stexe-process/



Agreed, Process Explorer can identify the services inside
a Svchost. But notice in that article, that no I/O rate
information is available. I tried to get that info while
I was running Process Explorer one day, and was quite
frustrated by the experience.

You can only guess at who is doing it, and that
the damn wuauserv is at it again...

There is a technique for partially solving that,
namely using "sc" to move each service into
its own svchost.

http://blogs.msdn.com/b/spatdsg/arch...-services.aspx

You can split it out into its own service by running:

sc config service type= own

And revert it via

sc config service type= share

where you would substitute "wuauserv" for "service" if
you thought that was the one. Then, when one svchost
starts doing I/O, if it only has the one service
in it, you've got it nailed.

If you have no clues as to which service is involved,
you might have to issue fifteen "type= own" commands
to string a trap on the things... And keep each one
in its own "jail cell".

Ironically, I was going to post the info about splitting the svchost
instances up like you described, but I thought better of it. Guess I
shouldn't have exercised such restraint.

--

Char Jackson

On Thu, 05 Mar 2015 10:11:58 -0600, Char Jackson
wrote:

On Thu, 05 Mar 2015 05:48:07 +0200, Steve Hayes
wrote:

On Wed, 4 Mar 2015 19:18:03 +0100 (CET), Bubba Bub@ba wrote:

Try Task Manager Performance tab Resource Monitor Disk tab - disk activity.


Dude, thanks! I'll post a follow-up to this thread after the next
time my hard disk light goes on constantly after connecting to the
Internet. If I can determine what's causing it, I'll google the
culprit and see if I can find out if it's normal or something more
akin to malware. That reminds me, I haven't set my PC to run a
check disk on the next restart in quite a long time. Could be the
disk because I've used this computer every single day for hours at
a time ever since I bought new.

I have the same problem in Windows XP, and Task Manager is of no help
in finding out what is causing the disk to churn like that.

When it starts doing it, depending on what I'm doing, it is quicker to
switch off at the wall and reboot than to try to continue working
while nothing else can access the disk.

So if you can find out what causes it, I'd love to hear.

In the old days, constant disk churning was sometimes a sign that RAM was
near it's limits and virtual memory was being used heavily. If that's what
you're seeing, Task Manager will mostly show it. The cure was to install
more memory, but switching to an SSD would also help some.

That's possible.

It did happen to me once before -- it was automatic updates that did
it. Each new version of each program was more bloated than the last,
and used more memory.


--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

In message om,
Dave-UK writes:

"Bubba" Bub@ba wrote in message
.. .
[]
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
[]
I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
[]
Try Task Manager Performance tab Resource Monitor Disk tab - disk
activity.


I don't know what this newsgroup is coming to. Time was, when anyone
mentioned using a registry cleaner, everyone immediately ignored any
other question he asked, in order to tell him how unwise he was to even
think about doing such things.

Now someone is admitting to having used one, and even has the temerity
to say he had no problem with it. And instead of triggering the release
of the ravening hordes, his post has actually caused several people to
make potentially useful suggestions in reply to his main question.

Things aren't like they used to be ... (-:
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Rugby is a game played by gentlemen with odd-shaped balls.

On Wed, 4 Mar 2015, Bubba Bub@ba wrote:

I've been using Windows 7 x64 Home Premium for about four years
and haven't had any problems with it or the PC it's running on.
I did have trouble with Java a couple of years ago so I uninstalled
it. I keep everything that needs to be up to date, including MSE,
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
way to back it up before doing this). I just installed Sandboxie and
I'll use that from now on to test unfamiliar programs and for browsing
the Internet.

I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
the hard disk is reading, writing, or otherwise accessing, whenever the
light is on or blinking? I've recently completely disabled the Windows
indexing to see if that would reduce the time the hard disk tends to
get busy after connecting to the Internet, but about twice per day when
I reconnect to the Internet, the hard disk light runs almost constantly
for about ten to fifteen minutes before it settles down. I realize
that the daily MSE definition updates will do this in part, but there
must be something else going on, but AFAICT I have no way of figuring
out what's causing it. I've always had the Windows updates set to
prompt before downloading, so I know it can't be that. I'm running an
old version of TCPView to monitor connections and see if anything is
"phoning home" that I don't know about, but a newer and more versatile
program might be more useful. But it's the excessive hard disk activity
that's got me mystified because it didn't start happening until about
only six months ago.

"trustedinstaller.exe" seemed to be the culprit, so I googled it.

http://www.drivers.com/update/pc-hea...igh-cpu-usage/

"How to resolve trustedinstaller.exe high CPU usage

A number of users have reported that trustedinstaller.exe reports high CPU usage from
time to time and, more importantly, have asked us how to resolve this issue.

Trustedinstaller.exe is an important process and its periodical high CPU usage is normal,
not an aberration or a flaw. Part of the "Windows Module Installer", trustedinstaller.exe
main purpose is to check for new Windows updates.

During an update scan, this process works in conjunction with Integrated Windows
Update service to check new updates. And precisely because of this reason during such
times the process uses a lot of CPU resources.

You may also find trustedinstaller.exe consuming a major portion of CPU resources for
some time after new updates have been downloaded. This again is normal behavior. This
process is designed to continue checking for new updates for some time after completion
of the update scan. This, in turn, helps ensure that all available new updates are
downloaded to your pc.

While trustedinstaller.exe high CPU usage cannot be totally resolved until you remove
this process, a step which is not recommended owing to the important role it plays in
keeping your computer up-to-date, you can manage the issue more effectively through
either of these two methods:

Tweak Windows Update Settings
Open Control Panel
Select System & Maintenance
Select Turn automatic update on or off
Choose one of these options: Never check for updates
Check for updates but let me choose whether to download or install them
Download updates but let me choose whether to install them

Prevent Windows Module Installer from loading automatically with Windows and
change its Startup type to manual
Run the msconfig command, and then click the Services tab in the system configuration
dialog box
Deselect the small box against Windows Module installer
Click Apply, and then click OK
Click the Restart button

Next perform these steps:
Open the Control Panel window, and then click Administrative Tools
Double-click Services
In the right pane, locate and right-click Windows Module Installer
Click General
Change the Startup Type to Manual
Save your changes by clicking Apply

Either of these steps helps you manage trustedinstaller.exe better. While exe errors
related to this file are not common, they do occur occasionally. And in most cases the
underlying cause is issues in Windows registry. So if you are receiving recurring
trustedinstaller.exe errors, it is best that you download and use a reliable and fast
registry cleaner.

Sushant Mehta"

[end quote]


That makes a lot of sense to me because Windows kept wanting me to
install the "Bing Bar" and I had previously uninstalled it and
stopped allowing it to do so, sure enough, about six months ago.

--
Bub

On Thu, 5 Mar 2015 23:08:24 +0000, J. P. Gilliver (John) wrote:

In message om,
Dave-UK writes:

"Bubba" Bub@ba wrote in message
. ..
[]
Malwarebytes, MVPS HOSTS, and all critical Windows updates. I run
CCleaner about once a week, and have used it to clean up the system
registry with no problem (I found that regedit export was the best
[]
I do have a question about the hard disk activity light. Is there a
utility in Windows or a freeware program that can monitor exactly what
[]
Try Task Manager Performance tab Resource Monitor Disk tab - disk
activity.


I don't know what this newsgroup is coming to. Time was, when anyone
mentioned using a registry cleaner, everyone immediately ignored any
other question he asked, in order to tell him how unwise he was to even
think about doing such things.

Now someone is admitting to having used one, and even has the temerity
to say he had no problem with it. And instead of triggering the release
of the ravening hordes, his post has actually caused several people to
make potentially useful suggestions in reply to his main question.

Things aren't like they used to be ... (-:

I'll be OK until someone says they like Norton or McAfee.

Note: please pretend I put :-) there.


--
Gene E. Bloch (Stumbling Bloch)