Re: How to remove a networked PC?

On Tue, 24 Apr 2007 10:38:58 +0100, Terry Pinnell
<terrypinDELETE@xxxxxxxxxxxxxxxxxxx> wrote:

Chuck <none@xxxxxxxxxxx> wrote:

On Mon, 23 Apr 2007 21:20:10 +0100, Terry Pinnell
<terrypinDELETE@xxxxxxxxxxxxxxxxxxx> wrote:

Chuck <none@xxxxxxxxxxx> wrote:

Terry,

If you have performance problems, or even think that you have them, I would
suggest that you start with Process Explorer, and find out for a certainty what
processes contribute to your problems.
<http://nitecruzr.blogspot.com/2006/04/watching-what-your-computer-is-doing.html>
http://nitecruzr.blogspot.com/2006/04/watching-what-your-computer-is-doing.html

If your computer is running XP SP1, now, THAT could be part of your problem.
<http://nitecruzr.blogspot.com/2006/08/if-you-have-windows-xp-without-sp2.html>
http://nitecruzr.blogspot.com/2006/08/if-you-have-windows-xp-without-sp2.html

Having done that, start malware analysis.
<http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html>
http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html

Thanks Chuck. I'll study those more closely tomorrow. Meanwhile, a few
initial comments:

Should I have Process Explorer (procexp.exe)? I don't see it anywhere.

I do use Filemon, but find it mostly incomprehensible.

I'm fairly confident my performance problems are not malware related.
I use several tools regularly, like Spybot and AdAware.

Terry,

If I had to choose one diagnostic tool for my computer, it would be Process
Explorer. It's linked from my article cited above.

OK, thanks Chuck, now downloaded it.

I'm guessing that you and Mark Russinovich are programmers? I'm not,
and most of the output from PE is beyond me to interpret.

I tried an initial run of PE, with the application that's prompted my
quest, Google Earth (GE). I'll assume for the moment that you're not
familiar with it, as a little background is necessary to what follows.
GE runs fine here, *except* when I open a particular kind of file, a
'network link file'. That small 'shortcut type' file in turn then
downloads a large amount of data from a particular server (to which
the author has previously uploaded it), and it displays clever stuff
in GE. (Such as global cloud cover.) When I run that, GE takes 95-99%
of my CPU, as compared with no noticeable usage when doing other
things.

In PE, both situations show GE taking the same 43 processes. With a
network link open (or being opened - I'm never entirely sure it ever
finishes!) - PE reports CPU as 95%, which I already knew from Task
Manager (and the even more obvious fact that I could do virtually
nothing on the PC).

Same goes for TCPView, which I've also downloaded, after studying your
very readable article at
http://nitecruzr.blogspot.com/2005/05/essential-tools-for-desktop-and.html#ProcessExplorer
thank you.

How old is the computer that's having performance problems?

This Athlon 1800 1 GB is about 5 years old. It's the sheer hassle I
anticipate in re-installing and re-tweaking that makes me put off my
next purchase! Plus the fact that, by and large, this PC is doing
pretty well. For example I make (encode and author) family DVDs,
generally regarded as intensive work for any PC, and have no real
problems. It's just the GE problem I described, plus sometimes very
slow Explore operation (opening folders can occasionally take 30 secs)
that frustrates me. Oh, and, if I'm honest, the occasional sudden
crash. Like the one I had as I was finishing composing this reply a
short while ago! Sudden black screen and a reboot. Something else to
fret about ;-(

I'm saving this text regularly as I type...

How much free disk space does it have?

Main partition is D: is 178 GB and has 88.7 GB free. My OS partition
is C:, which is 11.7 GB with 1.52 GB free. Other partitions are all
OK.

Do you defrag regularly?
Nightly, with Diskeeper in 'smart' mode.

Can you do a health check on the disk drive?

Used chkdsk /f on C: and D: a week or so ago, but I will do another.

For a single computer, I'd investigate any performance problems in this order:
1) Malware.
2) Hardware.
3) Software.
4) Network.

Terry,

1) Excessive CPU use when running Google Earth. Google Earth is VERY CPU
intensive. IT's drawing a detailed map of the earth (or some portion of it).
If you have enough bandwidth, the CPU drain from Google Earth could be massive.

2) When you open folders in Windows Explorer, observe what's in the folders. A
large number of files or folders, for instance, can take time.

Terry, any computer system will always max out on something, if it's not running
idle. Sometimes you'll notice the maxed out state, other times you'll be doing
something else and won't notice. If you run GE, and your Internet service feeds
you data fast enough, you'll max out the CPU. If you have slow DSL, like I
have, you'll max out on network (Internet) traffic before you max out the CPU.
If you're typing, it's maxed out on the input (you).

You don't have to understand PE immediately. Just run it when you are using
Task Manager, and look at the additional metrics that it gives you. Process
Explorer simply has more metrics, for you to observe.

And no, I'm not a programmer. And the one time that I was in the room with Mark
Russinovich he was speaking to a crowd of several thousand and I was one
listening.

Now the black screen and system restart we should investigate. But that's not a
network issue. This could have numerous causes. Details please.
# How often does it do this.
# Are you doing anything specific when it does this.
# Any specific time of day or day of week when this happens more often.
# Is the computer attached to a UPS?
<http://nitecruzr.blogspot.com/2005/06/background-information-useful-in.html>
http://nitecruzr.blogspot.com/2005/06/background-information-useful-in.html
<http://nitecruzr.blogspot.com/2005/08/solving-network-problems-tutorial.html>
http://nitecruzr.blogspot.com/2005/08/solving-network-problems-tutorial.html
<http://nitecruzr.blogspot.com/2005/05/protect-your-hardware-use-ups.html>
http://nitecruzr.blogspot.com/2005/05/protect-your-hardware-use-ups.html

--
Cheers,
Chuck, MS-MVP [Windows - Networking]
http://nitecruzr.blogspot.com/
Paranoia is not a problem, when it's a normal response from experience.
My email is AT DOT
actual address pchuck mvps org.
.

Relevant Pages

  • Re: How to remove a networked PC?
    ... Should I have Process Explorer? ... network link open (or being opened - I'm never entirely sure it ever ... - PE reports CPU as 95%, which I already knew from Task ... I recently posted in a couple of forums about over 100 invalid ...
    (microsoft.public.windowsxp.network_web)
  • Re: Explorer is leaking memory and eating CPU
    ... media files while CPU is overloaded with other tasks like audio/video ... explorer will open all multimedia files to display dimentions and duration. ... | the memory of AX controls after using them and this causes my problems. ... does the issue also occur in Safe Mode? ...
    (microsoft.public.windowsxp.general)
  • Windows doesnt work with dual core processors
    ... Basically, what happens is that, intermittently, whatever Windows app you ... CPU cycles and locks up for long periods of time. ... Explorer, this is the application that will grind to a halt and lock up. ... I have scoured this system with two antivirus programs and three ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Browser freeze
    ... IMHO) will graphically show you what network traffic is present on your system. ... Process Explorer will show you what processes, foreground and background, ... They're all free - and most pretty small, so they download quickly enough. ... Now check for, and remove, spyware. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Explorer is non-responsive with tray activity when domain (AD) traffic is dropped.
    ... > Explorer hangs when accessing DFS shares". ... > I have several domain client systems, ... > When these client machines are running and are on a network connection ... > domain controller and blocking until communication succeeds or fails via ...
    (microsoft.public.windows.server.active_directory)
Loading