How To Diagnose a Suddenly Slow Windows Computer? 835
Ensign Taco writes "I'm sure nearly every one of us has had it happen. All of a sudden your Windows PC slows to a crawl for no apparent reason. Yeah, we all like Linux because it doesn't do annoying things like this, but the Windows desktop still reigns supreme in most managed LAN work environments. I'm running XP with 4G of RAM and a decent CPU, and everything was fine, until one day — it wasn't. I've run spybot, antivirus, and looked at proc explorer — no luck. There is no one offending, obvious process. It seems every process decides to spike at once at random intervals. So I'm wondering if there's a few wizards out there that know what to look at. Could this be a very clever virus that doesn't run as a process? Or could this just be some random application error that's causing bad behavior? I've encountered this a few times with Windows PCs, but the solution has always been to just add more hardware. Has anyone ever successfully diagnosed this kind of issue?" And whether such a problem is related to malware or not, what steps would you take next?
Check the HDD (Score:5, Informative)
Very commonly this happens when a hard drive reverts to PIO mode after Windows decides it has seen a few errors from the drive. You can verify this by looking at the properties of the IDE Controller to which the drive is connected in device manager. (IDE ATA/ATAPI Controllers/Primary IDE Channel/Advanced Settings tab, for example)
There is a VBScript [winhlp.com] that resets the drive back to DMA mode, and is effective if that is indeed the case.
This could also be an early sign of hard drive failure. I've seen plenty of drives that passed diagnostics but were very, very slow. Try checking the SMART data with something like HDTune [hdtune.com].
Re:Check the HDD (Score:4, Funny)
But the best way is still to download Windows Optimizer 2009. It removes all performance limitations Microsoft has put in their products and makes your Windows work as fast as your hardware allows.
Re:Check the HDD (Score:5, Funny)
But the best way is still to download Windows Optimizer 2009. It removes all performance limitations Microsoft has put in their products and makes your Windows work as fast as your hardware allows.
That's a lie. I just installed Antivirus 2009 and it says that Windows Optimizer 2009 is spyware!!!
Re:Check the HDD (Score:5, Informative)
Lol, that's pretty funny seeing as both are malware. Yeah, I know you know. Others might not.
Re: (Score:3, Funny)
Re:Check the HDD (Score:5, Funny)
My computer does this all the time. The culprit is usually that my kid has hit the Turbo button off.
Turbo button... (Score:3, Funny)
I still have a PC that has a turbo button.
And Yeah, it changes the clock from 4.77Mhz to 10MHz.
It even has a 10MHz coprocessor, lol, with a whopping 4MB of memory.
Re:Turbo button... (Score:5, Funny)
Even my computer with the Turbo button switched between 8MHz and 25MHz. (Later, 8MHz and 33MHz.) And that was a scant 16 years ago...
Your computer is probably of legal drinking age by now!
Re:Turbo button... (Score:4, Funny)
Yeah, but I'll bet it's real slow running Vista.
How would you tell?
Second on the drive thing (Score:5, Informative)
But rather than just checking SMART, get the manufacturer's test program. All the HD makers have one, just get the one appropriate for yours. It's the sort of thing you boot from CD and let run for a few hours, but it is the way to go. SMART can report ok even when a drive is dying but it is extremely rare (though possible) that the manufacturer's diags give it a pass when it is dying.
Check that, since a dying drive often makes things really slow (in part because it starts remapping lots of bad sectors).
Re:Second on the drive thing (Score:5, Informative)
Re:Second on the drive thing (Score:5, Informative)
Checks SMART, can perform all SMART test (e.g. offline), gives loads of information on the drives internals and it can scan the disk surface using the disk-controller chip only (e.g no data transfer over the cable). The latter is really useful to test the surface and speed of a USB-HD.
Re:Second on the drive thing (Score:5, Informative)
But rather than just checking SMART, get the manufacturer's test program. All the HD makers have one, just get the one appropriate for yours.
Careful, some manufactures have utilities that just check SMART and don't actually do a test.
Re:Second on the drive thing (Score:5, Informative)
I've had a Linux box slow to a crawl for the same reason, so definitely good advice if you're experiencing random slowness regardless of what OS you're running. When I ran top I could see the "iowait" percentage was near 100% frequently and also saw many drive-related error messages in the system log.
Re:Second on the drive thing (Score:4, Insightful)
>> Yeah, we all like Linux because it doesn't do annoying things like this
That part of the original submission is misleading/stupid (why editors didn't cut it?.) My Ubuntu 7.10 box used to crawl (well, Compiz/Nautilus/Gnome/The-UI) after several hours of continued opening/closing windows. I never did investigate the issue (because laziness) and it was fixed just with a graphical logout/login (thus, I think restarting X.)
Remember also that a lot of Linux boxes crawl when the updatedb is executed via Cron (this is the nearest thing to Windows' antiviruses in behavior.) As the parent writes, this have to do with I/O use, despite the assigned and irrelevant "nice" priorities.
Re:Second on the drive thing (Score:4, Insightful)
The parent is correct. The difference between Linux and Windows is not that Linux doesn't slow to a crawl on occasion. No, I've seen both Linux and Windows do this. The difference (as you've demonstrated) is that when Linux slows to a crawl, you've got at least some chance at finding and fixing the cause of the slowdown.
Re:Second on the drive thing (Score:4, Funny)
Oh please AC... The parent is wrong, because he didn't say what you're saying. Now:
1) Like in the Linux case, some people indeed can analyze and find the cause of the slowdown (yes, there are some Windows experts)
2) Would Linux users install the same background trash like Win users (and if Linux developers would provide it) you'd have a really difficult time in the Linux investigation.
Of course you will be modded high here because someway you managed to defend the mighty Linux OS...
Still... (Score:5, Interesting)
Actually, while I do somehow sped more time at home on my Windows gaming box than under Linux (so this isn't a blanket Windows bashing,) my superficial and uninformed impression was that, all else being equal, any Windows box I've seen seems harder hit by IO than any Linux/Unix box I've ever seen.
Yes, you can get a Linux box to crawl too, if the hard drive is stuffed and it can't swap for example. Or if the chipset isn't supported well by the drivers. (Rarer these days, but certainly possible.) Or whatever.
But Windows... seems a bit special. I mean try to copy a directory between two hard drives, or better yet from a DVD to HDD, and Windows seems to me basically stuffed. Even notepad can get about as responsive as a narcoleptic snail. And you can just about forget about, say, playing a game while that happens.
And that's before you even add such brakes as an anti-virus.
I've seen that behaviour in any Windows, from 3.0 to Vista, including a detour through NT 4.0. In fact in Vista let's just say there's a reason why so many people were pissed off at the indexer kicking in all the time.
My subjective impression is that I've yet to see Linux get anywhere near that unresponsive, in a similar scenario. Again, assuming that you don't have a nearly dead HDD and the chipset is supported in DMA mode.
But heck, even in PIO mode, I've used Linux in PIO mode and I've used, say, NT in PIO mode. (Thanks to a retarded IT department which installed the wrong IDE drivers.) Linux did obviously have poor file IO performance, but NT just freaking _froze_ for a second or two, for example, when minimizing or maximizing a window. (Presumably due to aggressive memory management which swapped more of a process out when minimized.)
Now admittedly I haven't actually programmed an OS at any point, so I'm probably talking out the arse, but I see no reason why that should happen at all. Any common source of IOWait has an interrupt. Even in PIO mode you don't have to poll until it's done. And DMA, now that was invented for the precise reason and purpose of transferring some data while the CPU services another process. It's why it's there. So there's no freaking reason for the whole OS to just twiddle its thumbs and wait. Even if one process is waiting for _paging_, you can still yield to another process while waiting for the HDD.
Re:Second on the drive thing (Score:5, Informative)
What the manufacturer's test programs do is *precisely* run the SMART diagnostic test, so save yourself a CD-R. All they do is run the long self test. All SMART-friendly HDDs support the short (1 to 2 minutes) and long (1 to 2 hours) diagnostic tests, the latter doing an exhaustive sector scan. Boot a Linux live CD and type "sudo smartctl -t long /dev/sda", and voila.
A damaged disk cannot pass that test, not unless something is utterly borked with the firmware (*cough* seagate *cough*).
Re:Second on the drive thing (Score:5, Informative)
Wrong. Some do extended surface read-write-scans and offer options like disk erase etc. Like this here [samsung.com] for example.
Re:Second on the drive thing (Score:5, Informative)
SMART provides a lot of data, some of which is crap :-) but some of which is very useful. In particular, the error log:
# smartctl -l error /dev/sg0
Any disk with a non-empty error log you should consider replacing. Also, always run the short diagnostic tests:
# smartctl -t short /dev/sg0
/dev/sg0
# [wait 2 minutes]
# smartctl -l selftest
Re:Check the HDD (Score:5, Funny)
It is special.
This was the funniest thing on Slashdot today (Score:4, Insightful)
Re:This was the funniest thing on Slashdot today (Score:5, Funny)
Re: (Score:3, Funny)
My Windows is NOT slow.
It is special.
Maybe they should name the next release Windows Short Bus Edition?
Re:Check the HDD (Score:5, Funny)
"My Windows is NOT slow. It is special."
It's speed challenged.
Re:Check the HDD (Score:5, Informative)
Re: (Score:3, Informative)
Clearing the prefetch does not improve performance. It generally will decrease performance for a time.
http://lifehacker.com/5033518/debunking-common-windows-performance-tweaking-myths
Re:Check the HDD (Score:5, Informative)
Since we're trying to diagnose a cause of sudden sluggishness, clearing the prefetch won't really do anything unless the HDD is full. A quick review of the prefetch directory, however, is a good indicator of which programs have been running. I usually take a look to see if I can spot anything out of the ordinary.
Other helpful ideas:
- Disable system restore before you do anything...irritating spyware and virii can hide here and restore themselves
- Download and run X-Ray PC [x-raypc.com] (freeware) and run an online analysis of your processes...will give you a good/bad/unknown triage for some processes and allow you to kill them.
- Start>Run> msconfig.exe and check your startup processes...do a quick google search for anything you don't recognize and if it is not a necessary startup process, kill it. Having a shitload of processes running at startup can bring your system to its knees. Usually, for a desktop XP machine, between 28 and 35 processes is ideal on a fresh boot. For a laptop it can be up to 50...depends on what utilities are required to make your touchpad/buttons/wireless/etc work.
- Start>Run> msconfig.exe and check your services. Check 'hide all Microsoft services' and do a quick scan to make sure no extra junk services are hiding here. If you lose functionality to something on startup that you want, you can either just turn it back on or, if necessary, boot into safe mode and turn it on.
- Download Crap Cleaner [filehippo.com] and run the registry scan to see how many junk items you have in your registry. Review the causes and fixes to all the issues you find...you're usually okay doing a fix all but I check them just in case (this is your registry after all...never hurts to back it up either.)
- Add/remove any programs that you don't recognize or don't use. All this extra junk does nothing to help you. Additionally, if you can pinpoint one or two programs that were installed around the time your computer started having issues, definitely uninstall them and check your performance after (probably run ccleaner again to ensure they are completely gone).
- Restart your machine and check msconfig and xraypc again to ensure that nothing you killed came back...if it did, you've got a virus or spyware.
- If you still have issues, try running one of many drive fitness test tools to determine whether or not you have bad sectors or possibly a bad HDD altogether. Some tools will even allow you to repair the bad sectors but usually if you've got bad sectors you should start looking at a new HDD soon.
- If you have the option, pull the HDD and hook it up to a test rig and run a Housecall [trendmicro.com] scan on the drive.
- Run Rootkit Revealer [microsoft.com] to determine whether or not you have a rootkit installed on your machine. Rootkits are nasty as hell but you can usually find additional info via a google search on how to rid yourself of them.
- When all else fails, a clean install is usually the best way to get your system back up to snuff. It is a pain in the fucking ass and no one likes to do it until you remember what it is like having a clean install. Just make a list of your programs, do a backup of your data, and format that sucker.
Hope some of that is helpful...a lot of the other comments I see here are great things to check as well (right below me I see gad zuki! mention netstat -a to check your active connections...also very useful) so bookmark this page and try everything. If nothing else, you'll learn some new tricks.
Re:Check the HDD (Score:5, Interesting)
Better yet, do the aforementioned "Reformat and reinstall clean software", then, and ONLY then, make a restore point.
THEN disable "System Restore".
At that point, the .exe can no longer be used to corrupt your restore points, but YOU can always go back and turn the service back on to access that KNOWN good system/software install if the shit hits the fan again.
MUCH easier to use a restore point then reformat.
Re:Check the HDD (Score:5, Informative)
Its also worth mentioning that you'll see disk errors in the event log. The source will be 'disk.' Is the disk working hard. Use filemon to see whats going on.
The asker should also look in the event log for any warnings or errors that started at the time of the slowness.
He should also do a netstat -a to see what active internet connections are working. If youre seeing lots of connects to port 25 someplace then you are running a mass mailing trojan. Investigate any suspicious connections. You can use tcpview for more info.
He should also boot up with a linux live disc or a PE disc like UBCD4WIN. If the slowness is still there then its most likely a hardware issue. UBCD4win also has a bunch of utilities with easy to use GUIs like HDTune. He can run an antivirus or spybot from the PE environment too for a second opinion.
Lastly, when you fix the issue you should remove your wife from the administrators group and just make her a user or power user. When she needs to install software or whatever just have her log in as admin.
Re:Check the HDD (Score:5, Funny)
Tim,
A reference article I thought might be useful:
http://en.wikipedia.org/wiki/Humor [wikipedia.org]
Yours truly,
The internet
Re: (Score:3, Insightful)
However..... Even if SMART checks out and the vendor-test program says the HD is ok, some drives might just be taking seconds to minutes to "recover" the right data.
If this is the case, your monitor programs would not show much disk activity, but the HD light will be continuously on during the stalls.
Re:macintosh (Score:4, Funny)
Sorry (Score:5, Funny)
Sorry about that. I slowed it down for my own amusement. I'm a bastard that way.
-God
Re:Sorry (Score:5, Funny)
Re:Sorry (Score:5, Informative)
Congratulations, you just invented a new word [google.com]!
PerfLogs (Score:5, Insightful)
Try this (Score:5, Interesting)
Unplug the network cable in the back and see if the problem persists. The network is a common cause of this problem.
Re:Try this (Score:5, Funny)
If that doesn't work, try cleaning the gunk out of the mouse.
Re:Try this (Score:5, Funny)
Process Explorer (Score:5, Informative)
I'll be the first of many to suggest:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Re: (Score:3, Interesting)
There are a slew of other sysinternals tools as well, many of them would probably be perfect for troubleshooting system bottlenecks.
Virtual Machine (Score:5, Insightful)
Re:Virtual Machine (Score:5, Funny)
Watch porn in a virtual machine.
Best. Diagnosing. Tool. Ever.
Thank you. :)
Re:Virtual Machine (Score:5, Funny)
That's always good advice!
What, watching porn, or the virtual machine?
Re:Virtual Machine (Score:5, Funny)
Simplest answer (Score:4, Interesting)
Bottom line, if your system has a sudden dramatic change in behavior for no visible reason, wipe your drive and reinstall windows. There are nasty things now that don't show up as a process, mearly using the windows kernel to spawn another thread to do whatever it wants.
Backup your data and do the safest thing. I usually run windows inside VirtualPC which means only using it for the programs that *require* windows, not for general browsing and stuff.
Re: (Score:3, Insightful)
It's not a bad plan, but I'd shorten the reinstall time even further by setting up a backup image of the OS+programs after a reinstall, and park it on the RAID. Then, your time spent is limited to the transfer rate between the two drives.
Remember your offline backups of the RAID as well though - otherwise you may simply end up with a well-preserved virus refuge.
Re:Simplest answer (Score:5, Insightful)
If you've got everything backed up, that should be the quickest option. (Versus spending a weekend or so digging and digging to find the problem.)
It's Windows, not Ubuntu. Last time I had a "reinstall windows" problem, it took me 2 weeks to get all the software installed and configured again. I can't just tick off what I want and hit Apply.
Several steps to fix the problem (Score:4, Funny)
Re: (Score:3, Funny)
Obligatory (Score:5, Funny)
Vista installed. Remove immediately.
Hmmmm. (Score:5, Informative)
Not a lot to go on, though as a freebie, XP doesn't do jack with that extra gig of RAM...You could put in 100gigs and it won't use any more than 3 (less you're using the 64 bit version, iirc).
Rootkits can run "under the radar". Might want to try software like RootKitRevealer, or Blacklight. A crappy one might grab a ton of cycles for a minute, but most of them are less intrusive.
Everything spiking at once sounds like that stupid "System Restore" process, or maybe a big swap dump (which is weird with that much RAM, but you know, it's windows.) Stupid programs like Norton can grab a huge chunk of resources every now and then for no discernable reason. Maybe some peripheral is crapping out?
Barring malware, I'd start writing down what's running when it spikes, and see if that tells you anything. Lot of programs can cause momentary spikes, but background processes usually don't. You could try testing some of the hardware but without anything specific to look for, you're going to have a hell of a time finding something.
Re:Hmmmm. (Score:5, Informative)
Just FYI, the reason for this is because with 32 bits, you're system is limited to 2^32 bits of address space = 4GB of memory in total, which has to include both RAM and the memory on your graphics card.
So in many cases, users with 4GB of RAM will only see 3GB becuase they have a 1GB graphics card. It follows that if a user only have a 512MB graphics card, then they will see (and XP will use) 3.5GB RAM.
This is not a design flaw for XP, it's a limitation if the 32 bit architecture. Switching to 64 bits solves this because then your total address space increases to 2^64 = 16EB. Which ought to be enough for anyone
Re:Hmmmm. (Score:5, Informative)
Accurate but oversimplified - video cards aren't the only drivers that are mapped into memory space, just (usually) the biggest thing.
If your drivers support it (many don't, which is why it's disabled by default - a driver which lacks support will cause crashes with this option) you can add /pae
to the boot.ini file to enable Physical Address Extension in the kernel. PAE uses an extra 4 bits for internal memory addressing, resulting in up to 64GB of RAM being addressable. Individual processes will still run with only 4GB memory spaces. However, Windows will map some of its physical memory above the 4GB mark, allowing drivers their accustomed memory mapping (assuming the driver developer didn't make assumptions that PAE violates, like that the address space stops hard at 0xFFFFFFFF).
Re: (Score:3, Informative)
Firefox (Score:5, Funny)
Actually, the first thing you should do is close Firefox. I find that once you aren't using 10 GB of RAM to keep your 25 tabs open, the computer magically stops swapping.
Comment removed (Score:5, Informative)
safe mode (Score:4, Informative)
The best way to accelerate a slow Windows. (Score:5, Funny)
Answer: (Score:5, Funny)
"Well, I think you know the answer to that."
Re:Answer: (Score:5, Funny)
From story [slashdot.org] to meme in under four hours? That's got to be a slashdot record!
My check list (Score:4, Informative)
My usual check list for this is:
1) Check the hard drive, SMART, or manufacturer diagnostics
2) Get the manufacturer diagnostics, and run a full hardware validation
3) If all is clean, check for things recently updated - a bad update may be clogging things
4) Check your anti-virus/anti-spyware software. Sometimes they can switch into extra-paranoid mode and slow things down horribly.
The Case of the Slow System (Score:5, Informative)
Mark Russinovich has an enlightening blog entry called The Case of the Slow System [technet.com] that might serve as an example of how, if you are are one of the planet's top 10 Windows experts, you can, with persistence, luck, and the proper tools, solve one of the obscure problems that are slowing down your wife's computer. This particular case pertains to Vista, but the general techniques are applicable to XP as well.
Re:The Case of the Slow System (Score:5, Funny)
Has Mark Russinovich's wife tried turning it off and on again?
Updates (Score:3, Insightful)
bad fan? (Score:5, Informative)
Some systems will slow down the CPU if it gets too hot. Check the fans and the temp in the CMOS if it can report it.
Turn off indexing (Score:3, Informative)
Indexing really slows things down. Also, check you AV and Spyware settings and think about turning off any real-time file monitoring. Indexing plus real time file monitoring equals slowness. Finally, run 'msconfig' and check what is starting up at runtime. If you don't know what it is, get rid of it. You can always add it back.
I once looked at a coworkers system and he had processes starting up at runtime that were called, I kid you not, A, B and blank (no name at all). Removing those restored his system.
Check heatsinks and fans (Score:3, Informative)
WTF: a new low for slashdot? (Score:4, Insightful)
slashdot: Individual personalized tech support?
wtf kind of article is this?
fucking take it to a shop if you cant handle reinstalling windows
Re: (Score:3, Insightful)
Ignoring your blatant troll, I think most of us who use Windows, whether by choice or at work, have experienced exactly what the FP author describes.
Personally, I keep Process Explorer permanently open, and have noticed times when XP will just sit there and refuse to respond despite literally nothing using up a significant amount of CPU, RAM, or I/O. And not just for a second or two of lag, but well over a minute of completely refusing to respond. The mo
background defragmenting (Score:5, Informative)
From: http://www.kessels.com/Jkdefrag/ [kessels.com]
How do I disable the Windows built-in defragger?
Windows 2000 & 2003:
The built-in defragger is not started automatically.
Windows XP:
1. Download the free * Tweak UI utility from Micorosft.
2. Click on 'General' and untick the 'Optimise hard disk when idle' box.
Windows Vista:
1. Start -> All Programs -> Accessories -> System Tools -> Disk Defragmenter
2. Untick the "Run on a schedule (recommended)" box.
Check Harddrive (Score:3, Informative)
Harddrive failure could cause mastery hangup like that. The harddrive will retry for a few times, up to a few good ten seconds, causing all the I/O requests hanged for ten or more seconds.
The harddrive LED might be lit, but might be not. Also pay attention to the access sound, it will become very weird and repetitive when that happens. (Ya harddrive is getting more quiet now and the noise might get overwhelmed by the fan noise)
I experienced this for a few tens in the past ten years or so. (last time it happened on my laptop a few months ago). Again the symptom is - mystery hang up for a few ten seconds, then it went good (either retry success) or some application crashed (I/O error and HDD give up). Smart details usually can't show anything really that usual, or may be just 1 or 2 pending reallocation count, but SMART long SelfTest will usually do the job to catch the bad sector. Use "smartctl -t" in Linux.
At any case, replace the offending harddrive ASAP (after backing up all the data), because bad sector that keep recurring means something wrong with the head or alike, not just the specific spot on the media, and the bad sectors will spread like cancer!
diagnostics (Score:5, Informative)
How I do it (Score:4, Informative)
The general procedure I use is:
1) Get and install Debugging Tools for Windows [microsoft.com] for your platform.
2) Run kernrate.exe from the resource kit tools [microsoft.com] to determine if the problem is an I/O or CPU limit. (See here [live.com] for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.
3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer [microsoft.com] to determine which file actually contains the code which is executing.
4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK [sleuthkit.org], and the NIST hash database [nist.gov] to audit your machine for bad files.
5) Run Process Monitor [microsoft.com] and see who's responsible for all the I/O.
6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.
Injected DLLs? (Score:3, Informative)
Try and figure out though how it is being "slow"... is it CPU or disk activity or memory or what? Identify what is wrong with Task Manager and you will be much closer to fixing it.
If its coming from random processes... injecteD DLLs live in all processes and thus bugs in them can appear in any random process since the DLL is present in all of them. My personal example is WindowBlinds, which has had some compatibility problems... Visual Studio soared in CPU usage while idle, the last time I used it. A while ago there was a problem where Google Desktop would eat up memory until it crashed if Windowblinds was in use on the system. Use autoruns to check for such DLLs and disable any that belong to apps you don't use, and temporarily disable apps that you are using (such as Windowblinds).
The disk check idea earlier in the page is a good idea too.
As for ideas it might be automatic defragmenting, I looked into the way defragmenting works on NT a while ago to try and figure out if having files open is still a no-no when defragmenting a drive (it's not, the clusters can still be moved, yay) and I found out Vista's defragmenting task is low-priority process and IO... meaning it can't be the cause, as it will defer to anything else on the system that needs process or IO time. You wouldn't notice it running.
Real-Time Virus Scanning (Score:3, Informative)
I went through a similar experience recently with my Windows XP machine - tore my hair out going step-by-step through every possible cause.
It happened after the out of schedule Windows update. Turns out that Microsoft, in their infinite wisdom, turned on my McAfee real-time virus scanner. I't brought my system to a crawl whenever I'd try to play World of Warcraft. I didn't show up anything on Process Explorer and my video worked great, but my latency would slowly spiral out of control until it became uplayable.
I suspect that the real-time scanner was trying to process all inbound trafic before allowing it to pass on the calling process and it just couldn't keep up with the data bandwidth. Even disabling various McAfee security services didn't fix it - only uninstalling McAfee worked. Now my system runs better than ever (after having defragged a dozen times, uninstalled every unnecessary process imaginable, and cleaned the exhast fans).
Long story short - uninstall your virus software.
Sincerely,
A Chinese Hacker
Run Memtest (Score:3, Interesting)
learn from the Hackers! (Score:5, Funny)
Open a command prompt and type "OPTIMIZE" and hit the Enter or Return key (doesn't matter which).
If you get an error, type "OVERRIDE" or "SECURITY OVERRIDE" and then try the optimize command again.
Make sure you type these in all-caps (it's best just to leave the caps lock key on all the time, really).
After the optimization sequence is complete, reboot your computer. The best way to do this is to simply pull the power plug on the back of the machine and then plug it back in. Do this a few times just to make sure it's rebooted everything correctly.
If this doesn't work, go online from another computer and buy a Mac or something from Dell.
System Idle Process (Score:4, Funny)
Service pack 3? (Score:3, Insightful)
When mine did a few weeks ago, it turned out to be because it updated itself to XP Service Pack 3.
Removing XP3, and installing the "critical security updates" as per Microsoft's tech support document on the subject, fixed the problem and got everything working back the way it was originally.
MSCONFIG is your friend (Score:4, Informative)
If it isn't a virus or hardware issue, perhaps you have too many memory resident programs loaded?
At the Start menu click "Run" and then type in "msconfig" it will allow you to see what services, processes, and start up programs are in use. Naturally you want your Antivirus to load at startup but not your instant messenger programs and other useless junk that clutter up CPU cycles and system memory. Get rid of a few startup programs first and then reboot and see if the system speed improves.
It could be a corrupted registry [microsoft.com] and that link is to Microsoft's site on how to troubleshoot that.
If you cannot resolve the speed problem that way you might have a bad system file or files that went corrupt.
First make sure that you have:
#1 The original XP install CD without any service packs.
#2 The slipstreamed XP install CD [winsupersite.com] with the same service pack you are using.
Click Start and select "Run" and type in "sfc /checknow" and have those CDs ready when prompted for them.
Sfc is the system file checker and oddly enough it needs a non-service pack XP CD and an XP CD with your service pack on it. Best to make the slipstreamed version with SP2 or SP3 whatever you are using on it first. I hope you have the non-SP version of XP, if not borrow it from someone who does have it. This could be a tricky process but sometimes it works, but you need to reinstall all security patches after it runs.
Clean up your computer (Score:3, Interesting)
We all clean our computers regularly, right? I noticed this on an offloaded pc I cleaned up to pass on. The processor fan and cooling vents was heavily caked in dust and it was clocking slower so it would not heat up so much. Cleaning the dust off the processor cured the problem.
My area of expertise (Score:3, Insightful)
I have become an expert at telling people that their computer is slow because they're using twice as much RAM as their computer has, and therefore swapping badly. I usually tell them that they need 4 times as much RAM as they have.
I think this is not your problem.
That's totally easy! (Score:4, Insightful)
Nuke the site from orbit... (Score:3, Interesting)
Why bother. I keep up to date images for all my hardware and, at the first whiff of trouble, it's bye bye birdy.
There's just not a huge list of reasons to dick with this stuff any more. Yeah, you might learn the attack vector, then you might be able to manually remove the nasty little bugger that's got you slowed down and patch against future intrusion. Or, you can start from scratch and move on with your life after an hour or so. Besides, if it is hardware, it'll be pretty apparent after you've reloaded (if you can reload at all.)
I no longer care what crapware my users have managed to infest themselves with. Ghost the machine, move on to genuinely interesting problems.
What? (Score:4, Insightful)
Yeah, we all like Linux because it doesn't do annoying things like this
Speaking as someone who uses Linux at work every day, this is a flat-out lie.
Viruses running as threads and interrupt handelers (Score:3, Interesting)
This is a scary thought that might be relevant. Wired recently published an interview with a repentant spyware author who mentioned that they had figured out how to run the virus as a series of discrete threads which are not running as part of any parent process, something that Windows evidently allows. He also stated that they considered using a completely threadless model, by installing the code as an interrupt handler. Just tie it to an interrupt that regularly fires, and their code runs in an utterly transparent manner - something Windows also allows. The guy claimed that they didn't actually do the interrupt trick. But the frightening think was that it is even possible. I have no doubt that someone will do it eventually.
Here are the answers! (Yes, really) (Score:4, Informative)
1) Download Malwarebytes' Anti-Malware [malwarebytes.org], and run it. It was the only thing that found a virus on my computer recently, out of six packages (including two commercial ones).
2) Download HijackThis, if that doesn't work. Be careful with this package, though! You can do some serious damage to your computer by blindly following its advice. Read the forums. [majorgeeks.com]
3) How full is your hard drive? If the C: drive is full enough, fragmentation can dramatically mess up performance in a very short time. Clean and defrag. I personally find it worthwhile to use SmartDefrag [iobit.com], a much more powerful defragger than the one that's built into Windows.
4) Read your logs. Yes, Windows actually logs stuff! Go to "Control Panel-->Administrative Tools-->Computer Management" and then dig through "System Tools-->Event Viewer" TONS of useful information about what's not healthy on your system, including complete boot logs.
Good luck.
Re: (Score:3, Informative)
Somehow my link didn't appear. Hijack This! [download.com] should be able to be downloaded from http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html [download.com]
Hopefully one of those two will show up.
Re:Use process explorer (Score:5, Insightful)
Add in wireshark, as the cause of many a slow computer has been a ISP provided DNS server that has suddenly decided to take it's sweet ass time about answering queries for A and PTR records. Usually a by-product of being under some external load that you know nothing about (it could be backing up, etc).
DiskMon in particular will show you any files that are being sought by any process, an incredibly valuable resource.
Every workstation in our company has the SysInternals complete suite installed in the C: drive. The help desk has been trained to use it. It solves alot of problems.
Re:Use process explorer (Score:5, Informative)
Comment removed (Score:5, Informative)
Re: (Score:3, Funny)
"Oh, no, Mr. Bill!"
My Windows machine is infected with the System Idle Process Botnet!
Re:1. run task manager (Score:4, Informative)
And when it turns out to be svchost.exe, send a nasty email to Balmer.
I've seen systems start crawling on stupid windows background crap that only shows up in the process tab as "System Idle Process."
Compared to using ps or top, I'm not a fan of the scanty process tools in windows. The only decent one is perfmon; it's "Performance" under "Administrative Tools."
Open it up, go down to the bottom, right click on the little window under the graph and choose "add counters." Go ahead and add them all, and start the monitor.
Okay, now that your brain is bleeding, stop it, remove all the counters, and actually read the names and add only the ones you think you need.
Pretty much everything that's going on in the system is measured there, so you can get a pretty good idea of what the problem is, and that may point you in the direction of solving it.
Just as an fyi: if you're dumping to a log, make sure you have an idea of how much space it's eating up. A big perf log can eat up your whole harddrive if you leave it running.
Re:1. run task manager (Score:5, Insightful)
System Idle Process cannot make system crawl by definition - it's not even a process, it's just the line that shows how much of your CPU is not being utilized at all.
Thing is, when the system is crawling, it needs not be CPU. Random HDD reads/writes by one process can also kill performance for the entire system very fast, and yet the process will still show up as using 1-2% CPU time in Task Manager. You can change it to show the columns for I/O though and look there.
Re:Defrag? (Score:5, Funny)
Perhaps the hard drive is using an Infinitely Improbable File System.
Re: (Score:3, Interesting)
I do not see this as easy when You deal with a bunch of RAID drives or similar setup, but booting something small (COUGH deamn small linux COUGH some disk test/recovery distribution) from CD and running it straight in memory may also help a lot in diagnosing a problem.
Just last week we had a 22 out of 22 Windows in one network shutting down network processes for no apparent reason, without any errors in log, without any HDD problems. After thorough search it seems somebody infected them with some kind of r
Re: (Score:3)
I wouldn't call geek squad for anything... considering they have sent business to the shop I work at... in once cases, leaving their tools CD inside a machine. Essentially a beefed and customized WinPE. The funniest part, as we were laughing and using the CD to diagnose the computer, memtest86 on the disc revealed RAM to be their issue. We would have used one of our discs, but you had to be there. The fact that we used Geek Squads diagnostic CD to uncover the problem with a PC, on a computer they couldn