Win7 System Process (PID 4) constantly accessing drive

Question

My hard disk drive is constantly, incessantly active so long as my computer is on. Mostly this doesn't seem to affect performance- startup only takes a minute or two before the computer is usable- but slowdowns can become very noticeable on webpages with video. I use firefox.

Looking at Resource Monitor the culprit process seems to be System (PID 4), but according to the internet there are a million services that can be hiding behind that. Most suggested solutions involve disabling Prefetch or Windows Update, and I've never had Windows Update set to auto install. There's also a "svchost(dcomlaunch)" process that accesses a lot of data when I see it and makes me nervous, but the system process is always accessing.

I tried going into regedit and disabled Prefetch already- which produced a very peculiar result: the computer was blissfully silent for about half an hour, then my internet connection hiccuped once, and when the connection came back the thrashing immediately resumed and hasn't paused since.

This prompted doing a bunch of full sweep virus and malware scans with Security Essentials and Malwarebytes, as that hadn't been done in some time, and they did find a few small things but did not stop the thrashing, which continues at this time.

I also tried 'disabling indexing', which may or may not be the same thing as Prefetch, by going into services.msc, but I couldn't find indexing anywhere on that list, so either it's part of the already disabled Prefetch or I don't know what to look for.

Any help with tracking down the root of this persistent activity would be greatly appreciated.

Answer 1

Just about anything could be hiding behing that, as the System thread is responsible for maintaining the filesystem cache.

The real culprit is some process reading/writing your disk, but the System thread is stepping in and handling the disk I/O on its behalf and passing the results to the application via the cache.

In addition to the culprits you've mentioned (prefetch, Windows Update, malware, search indexing) other possible sources are Antivirus/Antimalware scans, network file shares, etc., all the way up to more "obvious" sources such as a bittorrent client or the like.