Recently my laptop started to become sluggish and the ventilators was constantly on. In task manager it was clear the system process (pid 4) ate 1 cpu core.
Process explorer did not bring any interesting results.
Then I started an investigation using xperf.exe, a Windows Performance Toolkit utility. It is very similar to the profilers you might use for .NET, so I encourage my developer mates to use it when you have a native code performance problem.

Here is what I saw:

Process Explorer did not show more than the ExpWorkerThread level. Ok, I did not configure debug symbols for it, it might have shown stacks correctly, but it is just a snapshot, a sample of the state of the threads in opposite to xperf which profile processes in sampling mode.

However, xperf clearly shows us that volsnap.sys constantly uses the disk. I suppose it stuck into some infinite loop or some.
Volsnap is the volume snapshot service, which supports backup and recovery. So, at first I stopped Volume Shadow Copy service. It did not help.
Then, I deleted system restore points for my drives.
It took several minutes to finish deleting old restore points. After a reset system process is now behave correctly.
System restore points are very important for certain scenarios, so be careful to turn it off. This is just a workaround, to clean up bogus system restore points.
After deletion and restart you should have to reenable it!
I re-enabled it, and the problem did not manifest again. So, I think deleting and recreating restore points solve this kind of weird problem.

Could you hire me? Contact me if you like what I’ve done in this article and think I can create value for your company with my skills.