5

Over the past month (possibly more), I have noticed that my laptop (running Windows 10) frequently becomes almost unusably slow, especially after many days of not having turned it on.

I notice that the disk usage in the task manager is at 100% for long periods of time, however this is ridiculous because even the sum of all the processes [that I can see...] could only approach about 5-10% in the generous case.

This is a development machine with 8GB RAM, i7 processor, plenty of space. There are almost no startup programs other than MS default programs (and even there I culled most of the non-essentials out of the startup list). I have also gone through and progressively disabled services such as BITS, Superfetch etc. to no observable effect.

What makes this more suspicious is the pattern in which it occurs - the issue is worst at startup after many days of the computer being physically disconnected and turned off. The startup time is around 3-5 minutes (!) after which the disk runs at 100% usage for a few minutes and then for no explicable reason, suddenly drops down to around 1-5%. All this without showing any processes near full disk usage.

After around a month of investigating this, I am beginning to suspect the involvement of malware, particularly because of the discrepancy in the task manager but also because of how the issue suddenly corrects itself. I should also note that the computer runs AVG Free edition and scans of the computer and anti-rootkit are coming up clean. That being said, I want to pursue the possibility that this could be malware connecting and updating itself, or even worse, exfiltrating data [or even worse, chewing my disk to encrypt my files while telling me everything is OK]?

Currently I do not observe an irregular amount of network traffic which would support the exfiltration theory, however it is also possible to hide this from the task manager / wireshark using a rogue driver.

I have a number of questions:

  1. Does this pattern of behavior fit any known malware / APT threats?
  2. Supposing I were to continue this into the forensics direction, what further steps could be taken to investigate and validate the drivers on the machine?
  3. What steps beyond task manager can I take in order to monitor and identify the process which is actually responsible for the 100% disk usage?
  4. Are there any legitimate / Windows reasons this might be occurring and if so, how can I narrow down and isolate the problematic components?
Improve this question
7
  • 1
    disk usage or CPU usage is 100%?
    – schroeder
    Dec 31, 2015 at 17:25
  • Disk usage, CPU is fine
    – ose
    Dec 31, 2015 at 17:26
  • sounds like typical anti-malware behaviour - a scan is being triggered
    – schroeder
    Dec 31, 2015 at 17:31
  • 1
    My boss asked me to check out their computer for the same thing this week. I ran Process Hacker 2, windirstat and ccleaner on his machine. Through windirstat I discovered he had large generating log files. Process Hacker in detailed show me what services were keeping his harddisk busy. Through those details I was able to identify and disable legitimate but problematic programs. Ccleaner helped remove a bunch of additional unneeded logs and temp files. These three steps freed up nearly 50 gigs in 5 minutes as well as alleviate his HD traffic.
    – Bacon Brad
    Dec 31, 2015 at 18:20
  • 1
    The drive may be failing. If it goes to 100% with no or little actual reads/writes then that is most likely the issue.
    – Jonathan Gray
    Jan 1, 2016 at 0:51

1 Answer 1

Reset to default
4

Do not rely on task manager as it will only show you what is running in Windows. You need to be looking at Resource and Performance Monitor (perfmon.exe) which will give you a better idea of exactly what is using resources. Hyper-v for instance will not show in Task Manager but will show in Resource Monitor.

When you see 100% usage, sort by write. If you done see anything huge, check read.

How old is your HDD and what is the model of it?

Improve this answer
7
  • 1
    To whoever downvoted: What steps beyond task manager can I take in order to monitor and identify the process which is actually responsible for the 100% disk usage? That question I have answered.
    – Some Dude
    Dec 31, 2015 at 18:16
  • 3
    This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. - From Review
    – Vilican
    Dec 31, 2015 at 18:39
  • This does answer question #3 (and likely will point the OP to the true answer). Unfortunately, #3 is the non-security portion of the question. I'll let the community decide (I'm a mod), but I hope that this answer survives.
    – schroeder
    Dec 31, 2015 at 19:42
  • Ahh. I missed the Resource Monitor reference despite multiple readings. It's sort of subtle. Good catch @schroeder.
    – Neil Smithline
    Dec 31, 2015 at 20:47
  • 1
    Tim, perhaps adding a resmon link would make the answer stronger.
    – Neil Smithline
    Dec 31, 2015 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .