Slashdot Mirror
How To Diagnose a Suddenly Slow Windows Computer?
Ensign Taco writes "I'm sure nearly every one of us has had it happen. All of a sudden your Windows PC slows to a crawl for no apparent reason. Yeah, we all like Linux because it doesn't do annoying things like this, but the Windows desktop still reigns supreme in most managed LAN work environments. I'm running XP with 4G of RAM and a decent CPU, and everything was fine, until one day — it wasn't. I've run spybot, antivirus, and looked at proc explorer — no luck. There is no one offending, obvious process. It seems every process decides to spike at once at random intervals. So I'm wondering if there's a few wizards out there that know what to look at. Could this be a very clever virus that doesn't run as a process? Or could this just be some random application error that's causing bad behavior? I've encountered this a few times with Windows PCs, but the solution has always been to just add more hardware. Has anyone ever successfully diagnosed this kind of issue?" And whether such a problem is related to malware or not, what steps would you take next?
Very commonly this happens when a hard drive reverts to PIO mode after Windows decides it has seen a few errors from the drive. You can verify this by looking at the properties of the IDE Controller to which the drive is connected in device manager. (IDE ATA/ATAPI Controllers/Primary IDE Channel/Advanced Settings tab, for example)
There is a VBScript that resets the drive back to DMA mode, and is effective if that is indeed the case.
This could also be an early sign of hard drive failure. I've seen plenty of drives that passed diagnostics but were very, very slow. Try checking the SMART data with something like HDTune.
Sorry about that. I slowed it down for my own amusement. I'm a bastard that way.
-God
Run performance counters against the computer to see what might be spiking. (Hard drive usage, memory pages /sec etc...)
The greatest revenge in life is massive success.
Unplug the network cable in the back and see if the problem persists. The network is a common cause of this problem.
I'll be the first of many to suggest:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Watch porn in a virtual machine.
GeekSquad diagnosis:
Vista installed. Remove immediately.
Not a lot to go on, though as a freebie, XP doesn't do jack with that extra gig of RAM...You could put in 100gigs and it won't use any more than 3 (less you're using the 64 bit version, iirc).
Rootkits can run "under the radar". Might want to try software like RootKitRevealer, or Blacklight. A crappy one might grab a ton of cycles for a minute, but most of them are less intrusive.
Everything spiking at once sounds like that stupid "System Restore" process, or maybe a big swap dump (which is weird with that much RAM, but you know, it's windows.) Stupid programs like Norton can grab a huge chunk of resources every now and then for no discernable reason. Maybe some peripheral is crapping out?
Barring malware, I'd start writing down what's running when it spikes, and see if that tells you anything. Lot of programs can cause momentary spikes, but background processes usually don't. You could try testing some of the hardware but without anything specific to look for, you're going to have a hell of a time finding something.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Actually, the first thing you should do is close Firefox. I find that once you aren't using 10 GB of RAM to keep your 25 tabs open, the computer magically stops swapping.
But rather than just checking SMART, get the manufacturer's test program. All the HD makers have one, just get the one appropriate for yours. It's the sort of thing you boot from CD and let run for a few hours, but it is the way to go. SMART can report ok even when a drive is dying but it is extremely rare (though possible) that the manufacturer's diags give it a pass when it is dying.
Check that, since a dying drive often makes things really slow (in part because it starts remapping lots of bad sectors).
Run for a while in safe mode and see if the problem persist. If it doesn't, then its probably a service gone haywire. Most likely candidates are printer services, anti virus services, scanner services.
9.8 m/s^2 Sorry, it just flip out.
"Well, I think you know the answer to that."
Between DiskMon, FileMon and Process Explorer - there should be nothing that you cannot see. The new generation of viruses that steal thread handlers from other processes are nasty, but very very hard to detect.
Add in wireshark, as the cause of many a slow computer has been a ISP provided DNS server that has suddenly decided to take it's sweet ass time about answering queries for A and PTR records. Usually a by-product of being under some external load that you know nothing about (it could be backing up, etc).
DiskMon in particular will show you any files that are being sought by any process, an incredibly valuable resource.
Every workstation in our company has the SysInternals complete suite installed in the C: drive. The help desk has been trained to use it. It solves alot of problems.
Mark Russinovich has an enlightening blog entry called The Case of the Slow System that might serve as an example of how, if you are are one of the planet's top 10 Windows experts, you can, with persistence, luck, and the proper tools, solve one of the obscure problems that are slowing down your wife's computer. This particular case pertains to Vista, but the general techniques are applicable to XP as well.
Some systems will slow down the CPU if it gets too hot. Check the fans and the temp in the CMOS if it can report it.
Keep the Classic Slashdot.
slashdot: Individual personalized tech support?
wtf kind of article is this?
fucking take it to a shop if you cant handle reinstalling windows
As a potential lottery winner, I totally support tax cuts for the wealthy
From: http://www.kessels.com/Jkdefrag/
How do I disable the Windows built-in defragger?
Windows 2000 & 2003:
The built-in defragger is not started automatically.
Windows XP:
1. Download the free * Tweak UI utility from Micorosft.
2. Click on 'General' and untick the 'Optimise hard disk when idle' box.
Windows Vista:
1. Start -> All Programs -> Accessories -> System Tools -> Disk Defragmenter
2. Untick the "Run on a schedule (recommended)" box.
A glitch a day keeps the bugs away.
and somebody marked it troll??? Come on, folks, get real.
Perhaps the hard drive is using an Infinitely Improbable File System.
Comment removed based on user account deletion
Comment removed based on user account deletion
check in this order: virus (look both for viruses and malware and bad scanners... I've seen antivirus scanner updates hose systems... use more than one virus scanner and more than one malware scanner but NOT AT THE SAME TIME!), drivers (might be badly written ,corrupt, or for wrong hardware), rogue processes (startup, services, etc), hardware (run chkdsk /f and defrag, check bios settings and make sure smart hd is enabled if possible and run a memory test), replace cables such as IDE that tend to corrode and cause errors, then start checking components (graphics, memory slots - use just one stick - if it improves use the same stick in another slot until there is a problem or you get to a stick that is causing problems) pci, dongles and adapters) If that fails run linux like you should have done in the first place. ;-)
Get a web developer
FYI DiskMon and FileMon have been superseded by ProcMon. I used it the other day because there were pinned items on my Start Menu I couldn't delete, so a simple filter for RegWriteValue when I pinned or unpinned something and I was able to find where the list lived and wiped it.
The general procedure I use is:
1) Get and install Debugging Tools for Windows for your platform.
2) Run kernrate.exe from the resource kit tools to determine if the problem is an I/O or CPU limit. (See here for how to get symbolic usage information.) If you do not see anything hogging the CPU, it's an I/O problem and you should go to step 5.
3) It's a CPU problem, so use the information from kernrate to figure out who's bogarting the CPU. If the process is services.exe, rundll32.exe, or System, you need to use something like Process Explorer to determine which file actually contains the code which is executing.
4) If that doesn't work, it may really be an I/O problem or a rootkit. If you suspect a rootkit, your main options are reinstallation or forensic analysis using something like a boot CD, TSK, and the NIST hash database to audit your machine for bad files.
5) Run Process Monitor and see who's responsible for all the I/O.
6) If that doesn't reveal anything, it might be a driver problem. Use Process Explorer to see if you have excessive DPCs (the Windows equivalent of a top half interrupt handler). Use kernrate to zoom in and see which driver is causing them.
Open a command prompt and type "OPTIMIZE" and hit the Enter or Return key (doesn't matter which).
If you get an error, type "OVERRIDE" or "SECURITY OVERRIDE" and then try the optimize command again.
Make sure you type these in all-caps (it's best just to leave the caps lock key on all the time, really).
After the optimization sequence is complete, reboot your computer. The best way to do this is to simply pull the power plug on the back of the machine and then plug it back in. Do this a few times just to make sure it's rebooted everything correctly.
If this doesn't work, go online from another computer and buy a Mac or something from Dell.
If you've got everything backed up, that should be the quickest option. (Versus spending a weekend or so digging and digging to find the problem.)
It's Windows, not Ubuntu. Last time I had a "reinstall windows" problem, it took me 2 weeks to get all the software installed and configured again. I can't just tick off what I want and hit Apply.
Support my political activism on Patreon.
System Idle Process cannot make system crawl by definition - it's not even a process, it's just the line that shows how much of your CPU is not being utilized at all.
Thing is, when the system is crawling, it needs not be CPU. Random HDD reads/writes by one process can also kill performance for the entire system very fast, and yet the process will still show up as using 1-2% CPU time in Task Manager. You can change it to show the columns for I/O though and look there.
Actually, while I do somehow sped more time at home on my Windows gaming box than under Linux (so this isn't a blanket Windows bashing,) my superficial and uninformed impression was that, all else being equal, any Windows box I've seen seems harder hit by IO than any Linux/Unix box I've ever seen.
Yes, you can get a Linux box to crawl too, if the hard drive is stuffed and it can't swap for example. Or if the chipset isn't supported well by the drivers. (Rarer these days, but certainly possible.) Or whatever.
But Windows... seems a bit special. I mean try to copy a directory between two hard drives, or better yet from a DVD to HDD, and Windows seems to me basically stuffed. Even notepad can get about as responsive as a narcoleptic snail. And you can just about forget about, say, playing a game while that happens.
And that's before you even add such brakes as an anti-virus.
I've seen that behaviour in any Windows, from 3.0 to Vista, including a detour through NT 4.0. In fact in Vista let's just say there's a reason why so many people were pissed off at the indexer kicking in all the time.
My subjective impression is that I've yet to see Linux get anywhere near that unresponsive, in a similar scenario. Again, assuming that you don't have a nearly dead HDD and the chipset is supported in DMA mode.
But heck, even in PIO mode, I've used Linux in PIO mode and I've used, say, NT in PIO mode. (Thanks to a retarded IT department which installed the wrong IDE drivers.) Linux did obviously have poor file IO performance, but NT just freaking _froze_ for a second or two, for example, when minimizing or maximizing a window. (Presumably due to aggressive memory management which swapped more of a process out when minimized.)
Now admittedly I haven't actually programmed an OS at any point, so I'm probably talking out the arse, but I see no reason why that should happen at all. Any common source of IOWait has an interrupt. Even in PIO mode you don't have to poll until it's done. And DMA, now that was invented for the precise reason and purpose of transferring some data while the CPU services another process. It's why it's there. So there's no freaking reason for the whole OS to just twiddle its thumbs and wait. Even if one process is waiting for _paging_, you can still yield to another process while waiting for the HDD.
A polar bear is a cartesian bear after a coordinate transform.
Even my computer with the Turbo button switched between 8MHz and 25MHz. (Later, 8MHz and 33MHz.) And that was a scant 16 years ago...
Your computer is probably of legal drinking age by now!
Program Intellivision!