In Windows 10 on Surface Pro 4, performance is mostly pretty quick. But the first time opening Downloads folder after a restart it was very slow, taking 11 seconds just to display 114 files and 35 directories.
To confirm issue was repeatable I tried rebooting system 3 times and each time the issue occurred when browsing Downloads folder.
Using Process Monitor I took a trace with filter
- Path Includes Downloads
From this I noticed a very high number of ReadFile events coming from Explorer.exe
Most files in the directory had no ReadFile events related to them. They looked like this:
However some files had hundreds of ReadFile events:
Right clicking a single ReadFile event and viewing Properties we can view stack whicfh may give us some clues us to what is causing this.
Interestingly this ReadFile operation, although taking some time, was only occurring on a few files, some DOCX, PPTX, and EXE file.
However this didn’t happen for all files of those type in the Downloads folder.
With a ProcMon filter set to
- Process Name is Explorer.exe
- Operation is ReadFile
I found the six files this operation occurred on
I removed those files from the folder
Restarted the machine. Downloads folder opened instantly.
Restarted the machine again, Downloads folder opened instantly again.
So I copied back the “bad files” into the Downloads folder…
The issue could no longer be reproduced…
I took my original ProcMon file from when Issue was occurring, and selected a top ReadFile event from affected machine
I then reset the filter to show all events, and could see that Windows Antimalware (MsMpEng.exe) had scanned the file just before these ReadFile events
After I had moved the files, Explorer behaved differently.
When I filtered on
- Process Name is MsMpEng.exe
- Path Contains Downloads
Now when I clicked Downloads folder in Explorer, these files were no longer being scanned