The other day, I was at a friend’s home to diagnose a problem he was having with his Windows 10 computer.
It had become almost unbearably slow.
He’d called earlier, indicating the problem had begun after some kind of pop-up message to “call this number” that could not be dismissed, followed by mis-click of some sort on Microsoft Edge, at which point the disk light began flickering continuously and the system came to a crawl.
Fearing the worst, I advised him to turn off the machine until I could get there and see it in person.
The characteristics of speed
There are four separate characteristics that contribute to how fast or slow a computer appears to work.
Whenever I encounter a machine reported as being “slow”, I look at each of these aspects to help narrow the problem.
What follows is (of necessity) an oversimplification of the process I used to diagnose the problem.
CPU: the processor
Your computer’s CPU is the “brains” of the operation. Its job is purely calculation, but those calculations involve everything from crunching numbers to telling the rest of your computer’s hardware what to do. If, for example, it’s too busy crunching numbers, it has no time left over to tell your keyboard to accept keystrokes, your disks to read and write data, or your screen to update. The net result is that your computer is “slow”.
The CPU can be completely busy for many legitimate things, like performing encryption, processing video, or even calculating a complex spreadsheet. Less legitimately, the CPU can be fully consumed by program bugs or even malware.
Malware performing encryption — i.e. ransomware — was at the top of my list of concerns for my friend’s computer. A quick look at Task Manager, however, showed nothing out of the ordinary.
The CPU was, in fact, mostly idle. The CPU was doing next to nothing, yet the computer was definitely slow. That didn’t rule out ransomware, though. My concern remained.
Disk: the storage that sticks around
Your hard disks are where your files and other things — like Windows itself and the programs you use — are stored.
Hard disks can be small or large, fast or slow — and many variations and combinations in between. Regardless of the technology used (spinning metal platters coated with magnetic material – the reason we call them “hard disks” – or electronic circuitry used in SSDs or “Solid State Drives”), one characteristic they all share is that it takes time to read information from them or write information to them.
Your hard disks can be busy simply because your computer is busy reading or writing a large file, or many little files. Since the disk can do only one thing at a time, all that time reading or writing anything can get in the way of reading or writing anything else. The system appears to slow down because it is waiting for other reading or writing to complete.
The reason I remained concerned about ransomware is because if malware was in fact reading, encrypting, and then writing all the files on my friend’s hard disk, it’s possible the disk would be at the choke point: the CPU would spend only a fraction of its time actually encrypting compared to the time it spent waiting for the hard disk to finish reading or writing whatever came next.
That the disk light was flickering, indicating near-constant disk activity, did nothing to alleviate my concerns. So I used Task Manager to see what the disk was doing. Sorted by disk activity, nothing really stood out.
Yet the system was slow. My thoughts were shifting away from ransomware and more towards “what the heck?”
Internet: transferring data to and from online services
Your internet connection is your computer’s connection to the outside world. For many of us, our computers have shifted from stand-alone computing devices to our “window to the world”, with that window being nothing more than information transferred across your connection to the internet.
Often, what we call our computer being “slow” is really just our own impatience. It takes time to transfer data to and from the various servers and services you use online. Your internet connection has a maximum speed, as determined by your ISP and the plan you have with them.
Only so much data can transferred at a time. If your computer is attempting to transfer more than that capacity allows, someone’s going to be left waiting. If that’s you, waiting for a webpage to load, it’ll feel slow. It’s not your computer, per se, but rather the speed of your internet connection, that slows things down.
The problem, of course, is that there’s a lot more going on than just you and your web browser. All the computers in your home probably share that same internet connection, and all of them have a variety of things happening online, from other people using their browsers and other services, to software downloading automatic updates. It all comes out of the capacity of your shared internet connection.
My friend didn’t have a lot else happening online in his home, but that disk light was still flickering. I was wondering if some different malware was at work, perhaps downloading files or acting as some kind of spam bot.
Back to Task Manager I went, this time sorting by network activity.
Again, nothing out of the ordinary. Edge was there, doing its thing. Multiple instances, and none generating enough traffic to move the needle, but that was to be expected. Or so I thought.
RAM: short-term memory
RAM, or “Random Access Memory”, is your computer’s short-term memory. It’s where running programs reside, it’s where the data they’re working on resides, and it’s what gets instantly erased when you turn off your computer.
Your computer only has so much RAM, but that doesn’t prevent Windows from trying to use more. Using a process called “virtual memory”, Windows can simulate having more RAM than it actually does, by moving (reading and writing) some of what’s in actual RAM to the hard disk to make room for newer requests.
If your computer has enough RAM, virtual memory is virtually never used. Since accessing RAM is significantly faster than accessing a hard drive, if your computer does find itself bumping into memory limits and using virtual memory, actually adding RAM is one of the fastest and most effective upgrades you can get.2
Back at Task Manager, this time I sorted by memory usage.
Once again, everything looked normal.
It was starting to look like I’d struck out.
Let’s blame Edge
None of the items I looked into above seemed out of the norm. But, to be honest, it also didn’t seem abnormally slow. It wasn’t the newest of machines, but it seemed adequate for my friend’s needs.
I also hadn’t seen the “call this number” pop-up message that my friend had seen, so I certainly wasn’t seeing exactly what he saw either.
Normally, he uses Chrome, but in the excitement resulting from that pop-up, he somehow clicked on the Edge icon in the taskbar. So, I did too.
Then it started again.
And again. And again. And again.
Within a few minutes, the taskbar slowly filled up with instances of Edge. If you’re not paying attention to your taskbar — and it’s totally understandable why you might not be — you might not even noticed it happening.
Each copy, or “instance”, of Edge uses up a little more RAM, until eventually virtual memory is called for. Windows dutifully responds by swapping things to and from disk, allocating more and more virtual memory, until all it’s doing is managing more and more copies of Edge.
The system slows to a crawl. Left to its own devices, eventually the system would become completely unusable.
I couldn’t close Edge fast enough to prevent it from opening another instance of itself, so I used Task Manager to kill as many as I could, leaving just one that had already done the “start another copy” thing.
I suspected that the home page setting had somehow become corrupt. You can set Edge to open one or more webpages automatically when it starts, and I suspect this was somehow confused: one of those pages caused a new instance of Edge to open, where it repeated the process of opening web pages automatically (which opened another copy of Edge, which opened pages automatically, ad infinitum).
I reset Edge’s “Open Microsoft Edge with” setting (via the ellipsis menu, “Settings” menu item) to be “Start page” – Edge’s own default start page.
I closed Edge, restarted it, and all was well once again.
The takeaway: what happened?
I have no idea what happened.
And that’s a very practical, pragmatic reality of what it means to resolve computer problems. Occasionally, the best you can hope for is that the problem goes away, without really understanding why it appeared in the first place.
But that doesn’t prevent me from hypothesizing. 🙂
My guess is that the “call this number” pop-up (you should never call the number, by the way) was nothing more than a persistent and annoying webpage (or pop-up within a webpage). Perhaps it was a malicious ad; perhaps my friend accidentally clicked on a link he normally wouldn’t have; or perhaps he mistyped a URL into his browser’s address bar. While it got our attention, it was in all probability a red herring.
Since he doesn’t regularly use Edge, it’s unclear how long its start-page configuration had been confused, lying in wait to confound us. Not being able to trace that back to a specific time or event meant it would be impossible to know exactly how or why it happened. I was so focussed on fixing it that I didn’t examine the “broken” setting first.
The good news, however, was that understanding the four characteristics of what it means to be “slow” not only gave me a framework to examine the system, but also helped confirm the diagnosis when we finally discovered something amiss.