"Monitor [all] file and program activity on your computer" considered harmful
August 15th, 2010I have struggled for months to find an explanation for a random unresponsiveness that I experienced with one of my computers running Windows. The issue seems to be in relation to the hard drive rather than the CPU and is apparent mostly after creating or editing very large files (hundreds of MB). My tentative conclusion is that a race condition occurs between, on the one hand, the built-in Defragmenter or some file compression utility or the Superfetch service or the indexing/search service and, on the other hand, the anti-malware service. The resulting unresponsiveness can last for hours, during which the hard-disk drive works... hard. Rebooting the computer may take 30 minutes or more and after reboot the problem persists making logging in a very slow process.
The workaround I found includes all three steps listed below:
- Schedule the Defragmenter to run at night only (although it is unclear what other conditions/events could trigger this utility).
- Disable the Superfetch service. Microsoft do not recommend it but I think here the benefit is worth the potential drawbacks.
- Disable the indexing/search service or, at a minimum, disable indexing in folders where large/many files are stored, especially if they are edited frequently.
- Disable the anti-malware component that monitors all file activity on the machine, but leave the component that scans Internet downloads enabled.
The third item is particularly important. The issue does not seem to be related to a particular anti-malware as it can be reproduced with MSSE, AVG, Avast, Avira. Sometimes only completely disabling the anti-malware service and manually terminating active scan engines restores the responsiveness of Windows Explorer. Reboot your computer to restart the anti-malware service as soon as possible.
 |
A better option may be to replace the "upon access" non-executable file scan with an ongoing hard drive scan that runs with the lowest CPU and I/O priorities whenever the computer is idle. While most modern computers feature multicore CPUs, the hard drive design remains a bottleneck to performance.
