Case of the Slow Downloads Folder

In Windows 10 on Surface Pro 4, performance is mostly pretty quick. But the first time opening Downloads folder after a restart it was very slow, taking 11 seconds just to display 114 files and 35 directories.

To confirm issue was repeatable I tried rebooting system 3 times and each time the issue occurred when browsing Downloads folder.

Using Process Monitor I took a trace with filter

  • Path Includes Downloads

From this I noticed a very high number of ReadFile events coming from Explorer.exe

Most files in the directory had no ReadFile events related to them. They looked like this:

image

However some files had hundreds of ReadFile events:

image

Right clicking a single ReadFile event and viewing Properties we can view stack whicfh may give us some clues us to what is causing this.

image

Interestingly this ReadFile operation, although taking some time, was only occurring on a few files, some DOCX, PPTX, and EXE file.

However this didn’t happen for all files of those type in the Downloads folder.

With a ProcMon filter set to

  • Process Name is Explorer.exe
  • Operation is ReadFile

I found the six files this operation occurred on

I removed those files from the folder

Restarted the machine. Downloads folder opened instantly.

Restarted the machine again, Downloads folder opened instantly again.

So I copied back the “bad files” into the Downloads folder…

The issue could no longer be reproduced…

I took my original ProcMon file from when Issue was occurring, and selected a top ReadFile event from affected machine

I then reset the filter to show all events, and could see that Windows Antimalware (MsMpEng.exe) had scanned the file just before these ReadFile events

image

After I had moved the files, Explorer behaved differently.

When I filtered on

  • Process Name is MsMpEng.exe
  • Path Contains Downloads

Now when I clicked Downloads folder in Explorer, these files were no longer being scanned

image

However as I started to scroll through the directory listing they did get scanned sometimes, seemingly randomly, but without any noticeable performance impact..image

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Performance, ProcMon, Window, Windows 10 and tagged , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s