100% disk activity, but very little disk transfer

[Yousuf Khan]

I've often noticed that sometimes my boot hard disk goes crazy, disk
activity light flickers constantly, system becomes unresponsive, but
there's no particular process hogging the processor cores. I managed to
watch one such incident while Hard Disk Sentinel was present in memory,
and when I looked at the boot disk in the Performance tab, it showed
100% activity, but data transfer was down near zero. Obviously, I had to
reboot the computer to get it back to normal.

I'm talking about Windows 7 Ultimate 64-bit in this case, but I've seen
similar things happen under Windows XP Pro 32-bit in the past too.
Another thing I noticed is that during this time, the System's own
SVCHOST.EXE program is using up a lot of memory too, over 300MB by itself!

What could be happening here?

Yousuf Khan

 

[Rod Speed]

I've often noticed that sometimes my boot hard disk goes crazy, disk
activity light flickers constantly, system becomes unresponsive, but
there's no particular process hogging the processor cores. I managed
to watch one such incident while Hard Disk Sentinel was present in
memory, and when I looked at the boot disk in the Performance tab, it
showed 100% activity, but data transfer was down near zero.
Obviously, I had to reboot the computer to get it back to normal.

I'm talking about Windows 7 Ultimate 64-bit in this case, but I've seen similar things happen under Windows XP Pro
32-bit in the past too.

That can be just the drive retrying on marginal sectors.

Post the Everest SMART report on that drive.

Another thing I noticed is that during this time, the System's own SVCHOST.EXE program is using up a lot of memory
too, over 300MB by itself!

Are you saying that it doesnt when that isnt happening with the drive ?

 

[LouB]

I've often noticed that sometimes my boot hard disk goes crazy, disk
activity light flickers constantly, system becomes unresponsive, but
there's no particular process hogging the processor cores. I managed to
watch one such incident while Hard Disk Sentinel was present in memory,
and when I looked at the boot disk in the Performance tab, it showed
100% activity, but data transfer was down near zero. Obviously, I had to
reboot the computer to get it back to normal.

I'm talking about Windows 7 Ultimate 64-bit in this case, but I've seen
similar things happen under Windows XP Pro 32-bit in the past too.
Another thing I noticed is that during this time, the System's own
SVCHOST.EXE program is using up a lot of memory too, over 300MB by itself!

What could be happening here?

Yousuf Khan

Check with the 'puter maker? May be a scan or diagnostics. HP does
this on my machine. I usually just kill it.

 

[Big Steel]

I've often noticed that sometimes my boot hard disk goes crazy, disk
activity light flickers constantly, system becomes unresponsive, but
there's no particular process hogging the processor cores. I managed to
watch one such incident while Hard Disk Sentinel was present in memory,
and when I looked at the boot disk in the Performance tab, it showed
100% activity, but data transfer was down near zero. Obviously, I had to
reboot the computer to get it back to normal.

I'm talking about Windows 7 Ultimate 64-bit in this case, but I've seen
similar things happen under Windows XP Pro 32-bit in the past too.
Another thing I noticed is that during this time, the System's own
SVCHOST.EXE program is using up a lot of memory too, over 300MB by itself!


What could be happening here?

If svchost.exe is not running out of the windows.system32 folder,
then it could be malware that it is running. You should check what
svchost.exe is hosting by using Process Explorer. PE is free to use,
and you can use Bing or Google to find out how to use PE to look at a
running process, see what it is hosting and see what directory a
process/program is located when it is running.

 

[Ed Cryer]

I've often noticed that sometimes my boot hard disk goes crazy, disk
activity light flickers constantly, system becomes unresponsive, but
there's no particular process hogging the processor cores. I managed to
watch one such incident while Hard Disk Sentinel was present in memory,
and when I looked at the boot disk in the Performance tab, it showed
100% activity, but data transfer was down near zero. Obviously, I had to
reboot the computer to get it back to normal.

I'm talking about Windows 7 Ultimate 64-bit in this case, but I've seen
similar things happen under Windows XP Pro 32-bit in the past too.
Another thing I noticed is that during this time, the System's own
SVCHOST.EXE program is using up a lot of memory too, over 300MB by itself!

What could be happening here?

Yousuf Khan

That used to happen a lot on systems with insufficient memory, swapping
program segments in and out from the page file.
I guess it could also happen where the page file was either not used or
too small an allocation.

Ed

 

[Yousuf Khan]

That can be just the drive retrying on marginal sectors.

Post the Everest SMART report on that drive.

Here it is:

***report start***

[ Hitachi HDT721010SLA360 (STF604MH0UR52B) ]

01 Raw Read Error Rate 16 99 99 65537 OK: Value is normal
02 Throughput Performance 54 132 132 113 OK: Value is normal
03 Spin Up Time 24 146 146 25756040 OK: Value is normal
04 Start/Stop Count 0 100 100 408 OK: Always passing
05 Reallocated Sector Count 5 100 100 0 OK: Value is normal
07 Seek Error Rate 67 100 100 0 OK: Value is normal
08 Seek Time Performance 20 125 125 33 OK: Value is normal
09 Power-On Time Count 0 99 99 12906 OK: Always passing
0A Spin Retry Count 60 100 100 0 OK: Value is normal
0C Power Cycle Count 0 100 100 368 OK: Always passing
C0 Power-Off Retract Count 0 100 100 409 OK: Always passing
C1 Load/Unload Cycle Count 0 100 100 409 OK: Always passing
C2 Temperature 0 166 166 22, 36 OK: Always passing
C4 Reallocation Event Count 0 100 100 0 OK: Always passing
C5 Current Pending Sector Count 0 100 100 0 OK: Always passing
C6 Off-Line Uncorrectable Sector Count 0 100 100 0 OK: Always passing
C7 Ultra ATA CRC Error Rate 0 200 200 0 OK: Always passing

***report end***

Are you saying that it doesnt when that isnt happening with the drive ?

Well, I don't normally check out the size of this program, but when I
have done so, it's usually 30-50% of that size, i.e. between 100MB to 150MB.

Yousuf Khan

 

[Yousuf Khan]

Check with the 'puter maker? May be a scan or diagnostics. HP does this
on my machine. I usually just kill it.

I'm the 'puter maker.

Yousuf Khan

 

[Yousuf Khan]

If svchost.exe is not running out of the windows.system32 folder, then
it could be malware that it is running. You should check what
svchost.exe is hosting by using Process Explorer. PE is free to use, and
you can use Bing or Google to find out how to use PE to look at a
running process, see what it is hosting and see what directory a
process/program is located when it is running.

Yes, I know about ProcExplorer, that is what I was using to report this
size.

Yousuf Khan

 

[Yousuf Khan]

That used to happen a lot on systems with insufficient memory, swapping
program segments in and out from the page file.
I guess it could also happen where the page file was either not used or
too small an allocation.

Ed

Yeah, that was my usual gut-reaction initial guess too. But I have 8GB
of memory on a 64-bit system, and taskman was showing that I was only
using about 4.9GB out of the 8GB. That's still quite a lot being used
up, but still not saturated. During normal operations, the memory being
used up ranges between 2.5 to 3.0GB.

Yousuf Khan

 

[LouB]

I'm the 'puter maker.

Yousuf Khan

Thought that might be.
How about the drive maker?
Pls report back when you find the cause.

 

[Big Steel]

Yes, I know about ProcExplorer, that is what I was using to report this
size.

But do you know how to use it to determine what svchost.exe is
hosting and what process in svchost.exe is sucking up the CPU?
Svchost.exe does nothing on its own. It only host processes.

 

[Rod Speed]

Rod Speed wrote

Here it is:

***report start***

[ Hitachi HDT721010SLA360 (STF604MH0UR52B) ]

01 Raw Read Error Rate 16 99 99 65537 OK: Value is normal
02 Throughput Performance 54 132 132 113 OK: Value is normal
03 Spin Up Time 24 146 146 25756040 OK: Value is normal
04 Start/Stop Count 0 100 100 408 OK: Always passing
05 Reallocated Sector Count 5 100 100 0 OK: Value is normal
07 Seek Error Rate 67 100 100 0 OK: Value is normal
08 Seek Time Performance 20 125 125 33 OK: Value is normal
09 Power-On Time Count 0 99 99 12906 OK: Always passing
0A Spin Retry Count 60 100 100 0 OK: Value is normal
0C Power Cycle Count 0 100 100 368 OK: Always passing
C0 Power-Off Retract Count 0 100 100 409 OK: Always passing
C1 Load/Unload Cycle Count 0 100 100 409 OK: Always passing
C2 Temperature 0 166 166 22, 36 OK: Always passing
C4 Reallocation Event Count 0 100 100 0 OK: Always passing
C5 Current Pending Sector Count 0 100 100 0 OK: Always passing
C6 Off-Line Uncorrectable Sector Count 0 100 100 0 OK: Always passing
C7 Ultra ATA CRC Error Rate 0 200 200 0 OK: Always passing

***report end***

That drive is fine, so its not that.

Well, I don't normally check out the size of this program, but when I have done so, it's usually 30-50% of that size,
i.e. between 100MB to 150MB.

Likely it is that, but since svchost.exe is used for hosting a lot of stuff, its not necessarily bad.

Have a look at svchost.exe with google and you will find its quite complex what it can be used for.

 

[Jack]

I've often noticed that sometimes my boot hard disk goes crazy, disk
activity light flickers constantly, system becomes unresponsive, but
there's no particular process hogging the processor cores. I managed to
watch one such incident while Hard Disk Sentinel was present in memory,
and when I looked at the boot disk in the Performance tab, it showed 100%
activity, but data transfer was down near zero. Obviously, I had to reboot
the computer to get it back to normal.

I'm talking about Windows 7 Ultimate 64-bit in this case, but I've seen
similar things happen under Windows XP Pro 32-bit in the past too. Another
thing I noticed is that during this time, the System's own SVCHOST.EXE
program is using up a lot of memory too, over 300MB by itself!

What could be happening here?

Disconnect from the internet for a moment and see if the activity goes back
to normal.

 

[Peter Foldes]

Start\Run\Services.msc\scroll down to Indexing right click\Properties and select Disable and then Apply. Did that stop your HD from thrashing

--
Peter
Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
This posting is provided "AS IS" with no warranties, and confers no rights.
http://www.microsoft.com/protect

 

[Big Steel]

Yeah, that was my usual gut-reaction initial guess too. But I have 8GB
of memory on a 64-bit system, and taskman was showing that I was only
using about 4.9GB out of the 8GB. That's still quite a lot being used
up, but still not saturated. During normal operations, the memory being
used up ranges between 2.5 to 3.0GB.

So you set page file size to be set by the O/S automatically as need.

You should also lookup with Bing or Google 'hidden backdoors and root
kits in Windows environment' to see other tools that can be used.

 

[Yousuf Khan]

Start\Run\Services.msc\scroll down to Indexing right click\Properties and select Disable and then Apply. Did that stop your HD from thrashing

It hasn't happened again recently, so I can't try that yet.

Yousuf Khan

 

[Yousuf Khan]

Disconnect from the internet for a moment and see if the activity goes
back to normal.

I don't think it was a rootkit or any other malware. I'm pretty sure it
was a hardware-related fault of some kind. If it was malware, then you
wouldn't see disk thrashing with no data being transferred. You'd see
disk thrashing with lots of data being transferred.

Yousuf Khan

 

[Rod Speed]

Peter Foldes wrote

It hasn't happened again recently, so I can't try that yet.

You sure its not just your antivirus doing a scan ? What are you using antivirus wise ?

 

[Yousuf Khan]

You sure its not just your antivirus doing a scan ? What are you using antivirus wise ?

Yup, I'd see processor usage with an anti-virus scan. I'm using AVG in
this case.

Yousuf Khan

 

[Ian D]

Yup, I'd see processor usage with an anti-virus scan. I'm using AVG in
this case.

Yousuf Khan

The next time it happens, use Process Monitor. PM shows
complete real time details on every disk activity, along with
all registry and process transactions. Disk-only transactions
can be displayed, or recorded for analysis, which is the best
way, as up to 10,000 events a second are intercepted. Also,
some of the lines of data can be hundreds of characters wide,
especially when the registry is involved.

PM is available here:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx