Windows 7 svchost.exe (LocalSystemNetworkRestricted) reading/writing like crazy

Question

I'm trying to understand why my Windows 7 machine is constantly reading/writing to the HDD, making everything go slow. As you can see in the screenshot, resmon reports that there is a lot of disk activity originating from svchost.exe (pid 756). But in Process Monitor, process 756 doesn't seem to do anything at all, except the periodical profiling. How is this even possible? They seem to contradict each other?

I'm dumbstruck. How can I look further into this problem?

Solution

There are a couple of things that Windows does in the background:

• Search and install updates,
• Index documents for search,
• Prefetch frequently used files,
• Defragment the hard drive.

Installing updates is done by TrustedInstaller.exe so that is not your problem. I do see prefetch showing up so I'm going to assume that Windows is looking for frequently used files and load them in available memory. This way, most of your applications will start faster.

When you install updates you might notice a slight hiccup with your pc's performance but indexing, prefetching and defragmenting are all executed using low priority i/o which means you won't notice it. The moment you do an action that requires something from the hard drive, the low priority stuff will be halted.

Comments

[Rakesh Kumar Sharma]

I have not found a satisfactory answer to this question. Several types of IO-intensive tasks hides behind the "System" process, and I've yet to find a way to find out who is currently pulling the strings on that one. However, the cause of intensive reading/writing is most often one of these: superfetch, defragmentation, anti virus scans, and also the Windows hibernation feature. I'd just wish there was a way to easily find this out except by trial and error.

[ZippyV]

@Ash There is a difference between Superfetch and Prefetch. Prefetch loads frequently used files from the harddrive into your RAM, Superfetch uses a USB stick to extend your RAM. If Superfetch is the problem behind your performance issues than you have a hardware or driver issue.

[Rakesh Kumar Sharma]

Great, but as you can see in the screenshot, I do have Process Monitor running, and you can see the configuration also in the screenshot. Process monitor is set to show all activity from the svchost pid. Shouldn't any subprocesses running under the same pid also show up in that list?

[Moab]

Like I said PM is powerful software with many settings and filters you can use, I am no expert in using it so you will have to rely on someone else for PM expertise in how to show sub processes of svhost.

[Ash]

It's blatantly obvious that the superfetch service does severely impact the performance of other applications. I have the same problem now and then.

[Ash]

I love answers like this that tell the asker that what they are actually experiencing can't be happening, very amusing. The superfetch service IS the culprit on my PC for making Windows practically unresponsive (mouse moves but clicking has no effect) for over 5 minutes. It's simply wrong to say it's a slight hiccup, or that it will be halted on user action.