Massive Resources being taken....How??

Thank you Shane and Chaotic. I'll look at that Proc Hacker for logging in a few mins and a big thanks on Perfmon.

It's been ages (or a windows version or two) since I'd been in to see or play with that..and ..umm.. wow.. That's a staggering selection of things to monitor which I wasn't aware I could on that fine of detail...one factor at a time.

It doesn't fix it..but it'll let me FIND it..and I'll kill it after that. Whatever it turns out to be.

** Question!

Search Indexer was present in my process list (I could have sworn I'd killed that way back..but 8.1 upgrades may have turned it back on). That may have been the culprit, too..I don't know. I know it's capable of generating that load...but does it do it while the system is in use, then crash down when a process view is raised to see it? Kinda weird on that aspect of this....

I *AM* disabling everything related to Win Search and Search Indexer and hopefully, it stays that way this time. What alternatives are others using with success? I already have TreeSize pro for sorting and organizing my archive drives but that doesn't do it for a quick box to type a search into and see what is out there for a file. TS takes time, every time, in the warm up scans and sorts...?

I am looking at a free program here called UltraSearch but it also states it accesses the MFT directly, each time... Call me old school, but that makes me a little nervous..?

reply to post by ChaoticOrder


Thats a great starting point, but smart virus, rootkits and the likes use known triggers such as opening taskmanager to hide.

These things are great at hiding. You need non MS software to find these little buggers. Standard windows system software wont cut it.



Not to be a know it all or anything. Just my experience has taught me a few things.

I know the frustrations of the windows operating systems all too wall.
The most used OS on the planet, also has the most exploits written for it.

Wrabbit2000

Search Indexer was present in my process list (I could have sworn I'd killed that way back..but 8.1 upgrades may have turned it back on). That may have been the culprit, too..I don't know. I know it's capable of generating that load...but does it do it while the system is in use, then crash down when a process view is raised to see it? Kinda weird on that aspect of this....

The windows indexer is fine. In fact on your ssd setup you shouldn't even notice it in action. Worry not about the indexer.

I am looking at a free program here called UltraSearch but it also states it accesses the MFT directly, each time... Call me old school, but that makes me a little nervous..?

I wouldnt use freeware or anything like that to index your disks.
It could send your contents to third parties.

There are things like Mozilla crash handler that even send your open files to Mozilla during the error reporting.
Many software's have this feature. I disable ALWAYS.

reply to post by shaneslaughta

Thats a great starting point, but smart virus, rootkits and the likes use known triggers such as opening taskmanager to hide.

These things are great at hiding. You need non MS software to find these little buggers. Standard windows system software wont cut it.

I realize that, but it's a good place to start instead of downloading extra software. If it doesn't work then he can try 3rd party software.

reply to post by ChaoticOrder


Was not trying to belittle your assistance. Your right on the button as far as procedure.

I just realized something, you shouldn't even need to have indexing enabled if you're using a solid state drive:

Indexing your drive usually speeds up searching and makes your life a little easier. However, indexing is actually more trouble than it's worth on an SSD. Because it's constantly maintaining a database of the files on your system and their properties, it causes a lot of small writes, at which SSDs do not excel. Thankfully, SSDs do excel at reading, and thus your drive will be able to seek pretty quickly anyway, even without an index.

How to Take Full Advantage of Your Solid-State Drive

Wrabbit, i forgot to mention process hacker has a search feature in the right click.

Opens a google search on the process you click. Just to give you an idea of what your looking at.

reply to post by ChaoticOrder


Indexing does not write to a drive, it simply makes a list of known file locations.
(unless you move or add more files regularly)
You however should not de-fragment a SSD or have it auto run.
That will copy and write files to the drive in a new location.

That will kill your drive in short order.

There is a lot of bad info on the internet.

reply to post by Wrabbit2000


Performance monitor is ok but its not designed for real time diagnostics, its more of a performance average over time kind of thing.

You really don't need to download an 3rd part process explorers as Windows 7 has a built in Resource Monitor. It was designed to be a replacement for the task manger but most users don't know its there and just use the task manager instead. Its very detailed, very powerful.

To get to it just
- Open up task manager
- Choose the performance tab.
- Click resource monitor.

Well, for what it's worth...Indexer isn't the issue, although I did kill it this time. Permanently I hope.

FYI on my set up... I have an SSD Boot drive/working drive ..and then I have a second smaller SSD used for nothing but Cache files in programs like Adobe and the Windows swap file (doesn't seem to matter how much memory we have..it still uses one a lot). In addition to that, I have roughly 2.5 terra between 2 drives for storage and archive. Obviously not SSD on those. So search is critical for me....just not Windows search.

Also... UltraSearch is a dream come true for speed and accuracy.. I'll run more backups for awhile until I get more comfy with it accessing my MFT directly like that...but by doing so, it's hitting on hidden and access restricted areas I can't even get back into to do something with at the moment. (Old windows installs in archive and file permissions get weird between Win versions). Anyway.. It's made by the same people I bought TreeSize pro from, but it's free and extremely fast. So.. That solves my search.

The problem is..within a few minutes of reboot with indexer disabled? Same thing, same place. Heavy load until Task manager opening (early on, this time) and then vanish after opening to look. I hadn't had a chance to set up anything else yet. That was strictly the clean boot with Indexer dead. So.. Scratch that possibility.

Manual searching folders did have me stumble across Scorpion Saver (ARG!!!) and MBAM doesn't see it, despite it being right IN Programs Installed for windows to see. So... I'm off to Bleeping Computer to play with the big tools and get some cleaning done.

..I hate it when it does this! Anyway.. I'll update in a few hours when all the scanning, cleaning and re-scanning is done to see if it does it again with all that having been accomplished. (Writing destructive or malicious code to release into the wild should carry a jail sentence!!)

Wrabbit2000
(Writing destructive or malicious code to release into the wild should carry a jail sentence!!)

I agree. It leads to a loss or destruction of personal data. IMHO Data should be considered real property.

You would go to jail if you destroyed Microsoft or Macs business data.

reply to post by shaneslaughta

There is a lot of bad info on the internet.

Well it's a lifehacker article so I wouldn't expect it to be too far from the mark. There are many activities which can add new data to your drive. Even just browsing the internet requires one to download new files with every new page. It seems like every time I stop using my pc for a few minutes the indexing service kicks in and starts doing something even if it seems like I haven't added any new files to my drive for quite a while. In any case if he's using a SSD it's recommended practice to disable the indexing service because it wont speed up the search functionality by any measurable degree.

reply to post by PhoenixOD


Virus know how to hide from Microsoft services and features.
When you open task man or perf mon certain malicious code, virus or root kits know it.

Which is exactly the problem Wrabbit is having.

reply to post by shaneslaughta


Resource monitor is not task monitor or prefmon its separate.

Yes there are certain virus programs that are clever enough to evade some MS software (though not so much sys internals) but at this stage its not certain what is causing the problem.

Resource monitor should be the first tool to use to look for the problem seeing as the problem was where are the resources going?

reply to post by ChaoticOrder


You got it for the most part. But the search indexer, when configured properly shouldn't index temp folders from ie or ff.
That shouldn't be an issue.

How wont it improve performance?

A hard disk is like a giant filing cabinet. The index is a list and order where files are stored.
Without indexer, the system has to literally search for each file individually then read it.

Can you find a specific file in a cabinet without it being labeled and sorted properly?


While the SSD are faster at reading, it still adding unnecessary delays to the system without the indexer.

Especially when your talking about multiple disks and umpteen thousands of files.

I'm not trying to be a jerk or know it all. Its just people believe so much bunk that the interwebs says, so it must be true.

reply to post by PhoenixOD


The default system tools windozzze comes with are junk.
The premise is correct. But not the tool.

Any virus or the like that has made it on to your system can see the system calls.

Since these programs are integrated into the OS, its pointless to use them on an infected system.

The infection was clever enough to get passed AV and MS defender and all the other stop gap measures of the OS.


I'm not the greatest at explaining things. And i get frustrated when people aren't on my level. (cant fault anyone for that)

But ill do my best to keep trying to explain till they understand.

reply to post by shaneslaughta

While the SSD are faster at reading, it still adding unnecessary delays to the system without the indexer.

But having the indexer enabled can its self degrade the performance of the drive over time.

Why disable Windows indexing on SSDs?

Read the post by karndog.

ChaoticOrder

But having the indexer enabled can its self degrade the performance of the drive over time.

Why disable Windows indexing on SSDs?

Read the post by karndog.

Your correct. But that is the fault of the hardware design. Its inherent flaw is that of UBS flash drives. (limited write cycles)

Can you fault you fault your car for skidding off the road in the snow when your driving with bald tires?

I guess what I'm getting at is, if you want the throughput of a raid array but in a more user friendly design.

You need to take the good with the bad.

You get higher read speeds but your limited write cycle life.

You should use SSD for the OS drive.

Good old fashioned spinning disks for the working directory, where you install your programs and store your files.

I would even recommend two plain drives. That way you can limit the collateral damage should one go bad.

(Sometimes the best solution is a combination of things)

Wrabbit, i would leave the indexer enabled. But its your system, do as you please.

I am sure you have tried thus but check the forums for anyone else with similar problems.
I had an issue with windows xp where it was running at 100% all the time, convinced it was a trojan or virus. Turned out to be a microsoft upgrade that could only be stopped by switching off the automatic update.
Taught me the lesson that MS upgrades are not always to be trusted