On Mon, 26 Jun 2006 05:56:01 -0700, Grim elling
Tried turning off disk indexing - maybe minor improvement, but taskmgr still
at 2%, and explorer flicking on ond off at 1%. Nothing else apparently using
resources under Processes. Nothing running under Applications. Every now
and again CPU usage leaps to 25% or more under Performance, and disk gets
very busy for ~1 s. This happens even after long periods without any input
(keyboard, mouse etc. and as I said the net cable is unplugged.)
MS Office 2003 is installed. I can't find FastFind or FindFast.
On NT-family OSs, you don't have control over FastFind / FindFast - it
appears to install whether you like it or not, though what really may
be happening is that NT's built-in indexer is used instead?
As Pop says, I may not really have a problem. But this machine has had one
hard disk failure, and before it failed the disk activity increased steadily.
Hard drives can fail progressively (bad sectors) or abruptly (e.g.
burned-out logic chip, motor failure, catastrophic failure of heads
and/or actuator, etc.). When hard drives fail progressively, it
typically starts with multiple attempts required to access disk.
At first, the number of such retries may be below the threshold at
which attempts are abandoned and/or the HD's firmware steps in to
"fix" the sector. At this stage, SMART may show no anomalies (even in
the detail), but the extra retries increase time spent by the HD and
thus slow things down.
When the retries become excessive, SMART starts flagging them as
errors, and may attempt to "fix" the bad sectors by copying info to a
good spare sector, and then altering the hard drive's private sector
addressing to use the new sector. All of this is still below the OS
file system's "bad cluster" management, or "disk fail" alerts, but the
extra head travel involved can make the slowdown palpable.
At some point, Windows XP may detect "too many" failures and start to
reduce the UDMA level, all the way down to PIO. Once you hit PIO, you
will notice a more significant slowdown because now the processor is
intimately involved with all HD data transfers. Couple that with
increased retries, and you really feel the pain!
As the number of errors recorded in SMART's detail increases, the
counters may drop below the acceptability threshold, tilting the SMART
summary from "OK" to "Fail". BIOS can monitor this SMART summary
status during POST, although the default is usually to disable this;
if enabled, then at this stage POST may start reporting the HD to be
"bad" according to SMART, "fast" HD diags (that simply read SMART
summary) will flag the HD as bad, and the HD vendor will generally
accept the HD as defective and issue an RMA if under warranty.
Something else may happen before or after this stage; attempts to
access HD may fail to the point that the HD's internal defect
management can no longer hide the problem. This sets a flag in the
file system that will cause all volumes on that physical HD to be
surface-scanned for errors when XP next boots; in addition, NTFS will
try to do what the HD's internal defect management has already failed
to do, i.e. copy the bad sector's contents elsewhere. The difference
is that once the OS "sees" the defect, it is flagged as such within
the affected file system - it's no longer hidden under the OS.
You may also get a patchy pattern of slowdown, if a single area of
disk is significantly damaged (e.g. after a head strike). This may
map to particular files, causing major slowdown only when those files
are invoked, but not otherwise. "Just re-installing Windows" may
appear to fix this if the process happens to locate affected files
elsewhere, e.g. further "up" the volume, but etc.
I'd like to make sure it's not doing anything unecessary this time around.
My approach would be:
1) Verify HD health
You can use HD Tune (free, from
www.hdtune.com) to:
- check HD temperature (preferably < 40C)
- view SMART counter and raw data in detail
- test the surface of the entire physical disk
Any problems, back up yer data and replace the HD!
2) Exclude additional software activity
You've already started on this I know, but systematically, start by
starting Windows, doing nothing, then shutting down again. If that is
fine, then it's an app you are manually running (bearing in mind that
some apps leave bits "hanging around" after they "exit").
Assuming that is not fine, then try these measures to exclude external
events that may be stimulating extra activity:
- disconnect or disable ALL networking ('net, LAN, WiFi, IR, etc.)
- unplug all peripherals, such as USB devices, printers, etc.
- ensure no removable disks are left in place (CDs, USB sticks etc.)
Assuming that is still not fine, then you'd want to try various ways
to suppress various code integrations. I'd start with the most
extreme method - Safe Mode Command Only - and if that is still slowed
down by unwanted software activity, then I'd strongly suspect malware
(perhaps an intra-file code-infecting virus) or core driver / hardware
issues such as processor slowing down due to overheating.
If Safe Mode Command Only is fine, then try the following and compare
results to guide further tshooting:
- Safe Mode Command Only
- Safe Mode (adds Explorer and integrations back as shell)
- if slow, use NirSoft's Shell Extension Viewer to chase
- Safe Mode with networking, but off 'net (av may be off?)
- Windows with everything suppressed in MSConfig (off 'net)
- Windows with vanilla VGA (unlikely to be relevant)
- try different user accounts, if applicable
The difference between Safe Mode and MSConfig startup suppression is
that the latter still carries the full normal load of device drivers,
so that a driver issue will still affect performance whereas Safe Mode
may be free of the problem if the driver's suppressed.
If YMMV according to user account, then check:
- per-account bloat:
- huge user registry hive
- cluttered user account Temp and/or TIFF (esp. on FATxx)
- per-account integration:
- user account's Startup group
- HKCU...Run etc. startup axis
- per-user component of file associations and shell integrations
Once you find a useful works/not-works (e.g. fine in MSConfig
suppression, sucks in full Windows) then you can delve into detail.
For example, if MSConfig suppression helps, then try adding back
suppressed items one at a time until it "breaks" again.
Same thing if you find Safe sucks but Safe Command is fine, and you
are using Nirsoft's Shell Extension Viewer to suppress shell
integrations; add these back one at a time until it breaks, etc.
If using Nirsoft's Shell Extension Viewer, I'd be conservative; start
by suppressing only those items that are non-Microsoft and you are
sure aren't part of Windows (some "no vendor" items are part of
Windows). Yes, Nirsoft does let you reversably enable what you
disable, but it may be possible to knock out your ability to start
Windows and access the utility if you get carried away
3) Exclue malware
In practice, I do this first, but it is the most difficult step (for
meaningful values of "exclude", that is). Some malware object to
being detected and removed, and may foil your attempts to do so if it
is running at the time you try to detect and remove it. The only way
to be sure it is not running, is to not run any code off the HD at
all, by booting off something else and running known-clean (i.e.
prepared from a clean PC) scanners from there; Google( Bart PE )
-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
