We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


Slow keystrokes and slow window updating at low processor load?

sagy_ee asked
Medium Priority
Last Modified: 2010-08-05
During the last days, my Windows XP Prof installation shows slowed down keystroke responses in certain applications (e.g. firefox, thunderbird, RDP sessions). Also, window update rates seem to slow down, e.g. the cursor blinks much slower in this firefox text edit field into which I type this very text. While this unresponsiveness makes typing quite annoying, it does not exceed 500-1000ms. In some respect it resembles using a Remote Desktop session over a very slow connection.

That being said, processor load as reported eg. by Task Manager is quite low (0-10%) on my 2.6Ghz PC, little to no harddisk activity, in other words it's not the computer experiencing constant overload. It's just slowed-down typing or window-updating, respectively. Application startup times and stuff like that is normal.

I am wondering about the reason for this, more specifically whether this might be due to some keylogger/backdoor activity in the background? But I couldn't track down anything suspicious. Strange that it only applies to certain apps, while e.g. typing text in notepad is fast as normal.

Any hints? I would really appreciate any help that makes typing and my nightly sleep (backdoor?) comfortable again...

Watch Question

It sounds like some malware running in the background.  Grab kaspersky antivirus trial (http://www.kaspersky.com/) and scan to see if there are any viruses (make sure the get the latest virus defs first).

If none found, uncheck all the startup programs using autoruns (http://www.sysinternals.com/Utilities/Autoruns.html), restart and see if the problem persists.
If problem is fixed it is some software causing the problem, if not you have a hardware problem (probably a bad cpu or motherboard).

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
I would do several things

1. Download and run hijack this http:\\tomcyote.org/hjt. Post a logfile up here

2. Go to http://www.ccleaner.com download and run C cleaner but do not run the registry cleaner. This will clean out temporary files and make the scans faster.

3. GO to the following sites in this order none of these have to be downloaded they are all online scanners.

Pandasoftware and run activescan it is an online virus scanner save a report when it is done scanning.

Trend Micro Housecall

Bitdefender - WORD OF CAUTION you need to change the default so that it is not selected to automatically delete if it cannot disinfect. some viruses will infect crtitical windows system files and if this option is selected it may delete files it shouldn't even though they are infected. but if this is the case please post the filesnames and location up here

Symantec - run their online security scanner for viruses.

Once that is done do the following
Download and run the following programs they can coexist and are free
http://www.lavasoft.com -Adaware 1.06 Personal Edition this will scan and remove spyware and adware

http://security.kolla.de - SPybot seek and destroy same function as above

http://www.ewido.net  - Ewido anti spyware same as above

http://www.intermute.com/spysubtract/cwshredder_download.html -download coolweb shredder


4. Run Rootkit revealer http://www.sysinternals.com/Utilities/RootkitRevealer.html  see if it finds anything if it does and it is suspicious then post the result here and we can look at it further

Once all this is done you have a clean bill of health and then we can look at optimizing the PC by disbaling unecessary unwated services.


Thanks for your comments! I tried the Kaperspy online scanner, but it wouldnt properly install the ActiveX although running under administrator context (could imagine that it conflicts with existing NOD32 Antivirus, let's see the other online scanners...). Unchecking Autoruns (except for a few trusted/signed ones, mostly Outpost Firewall/NOD32 Antivirus related) didn't help improve performance.

@briancassin: That looks like a comprehensive catalog of procedures. I'll try all and post results as I get along the list.



HijackThis Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 10:27:56, on 05.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
D:\programs\system\Outpost Firewall\outpost.exe
D:\programs\Archiving\Alcohol120\Alcohol 120\StarWind\StarWindService.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aldi.com/
O1 - Hosts: k2
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\programs\Office\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\programs\SysAdmin\SpybotSD\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\programs\system\CanonMP780\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Outpost Firewall] D:\programs\system\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] D:\programs\system\Outpost Firewall\feedback.exe /dump:os_startup
O4 - HKLM\..\Run: [nod32kui] "C:\Programme\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TrueImageMonitor.exe] D:\programs\SysAdmin\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\programs\Office\Acrobat\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [FJTWAIN Setup] C:\WINDOWS\Twain_32\fjscan32\FjtwSetup.exe /Station
O4 - HKLM\..\Run: [FtLnSOP_setup] C:\WINDOWS\Twain_32\Fjscan32\SOP\FtLnSOP.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\programs\system\ActiveSync\WCESCOMM.EXE"
O4 - Startup: Active SMART.lnk = D:\programs\SysAdmin\ActiveSMART\ActiveSMART.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Error Recovery Guide.lnk = ?
O4 - Global Startup: LRZ VPN Client.lnk = D:\programs\SysAdmin\LRZVPNClient\vpngui.exe
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://D:\programs\system\CanonMP780\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://D:\programs\system\CanonMP780\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://D:\programs\system\CanonMP780\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://D:\programs\system\CanonMP780\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://D:\programs\Office\Acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\programs\system\ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\programs\system\ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\programs\system\ActiveSync\inetrepl.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - D:\programs\system\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\programs\Office\MSOUTL~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MedionShop - {01E9CF82-AE9D-42BA-A629-B23D51A4B86B} - http://www.medionshop.de/ (file missing) (HKCU)
O16 - DPF: {09D6F55E-F235-4102-9C60-1D09CFD9FAFF} (launch Class) - https://nickwoods.etowns.org:10001/vpclient4102.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} - https://www.reuschel.com/hbci/de/plugin/AXFOAM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/de/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096229127296
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{07CEC2F4-4923-4FE5-97E4-F534D3E2A0B9}: NameServer =,
O17 - HKLM\System\CS1\Services\Tcpip\..\{07CEC2F4-4923-4FE5-97E4-F534D3E2A0B9}: NameServer =,
O17 - HKLM\System\CS2\Services\Tcpip\..\{07CEC2F4-4923-4FE5-97E4-F534D3E2A0B9}: NameServer =,
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O20 - AppInit_DLLs: D:\programs\system\OUTPOS~1\wl_hook.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - d:\programs\system\FritzBoxFon\IGDCTRL.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - D:\programs\SysAdmin\LRZVPNClient\cvpnd.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Programme\Eset\nod32krn.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - D:\programs\system\Outpost Firewall\outpost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\programs\Archiving\Alcohol120\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Looking through ypour hijack this file it is clean.... but that doesn't necessarily mean the machine has a clean bill of health it is just their is nothing obvious happening  Continue on with the rest of what I have suggested but also do the following two things below

However two things I did notice

1. You do have a lot of running processes ... Go to start Run type msconfig and hit enter go to the startup tab and uncheck whatever it is you do not need on a daily basis as this is just wasting system resources then hit apply and ok it will ask you to reboot upon reboot a window will come up check the box that basically says do not remind me and do not open msconfig again.

2. You have a matrox video card, their has been a lot of issues with these as of recent go to http://www.matrox.com/graphics/en/corpo/support/drivers/home.php
 and download the latest drivers for your card. The Parhelia Series inparticular has been having a lot of serious issues with it's original drivers.

From the info you have posted so far my best guess is that you have some bad hardware.  If i had to pick a most likely culprit i would say it is the motherboard.  Also, have you tried a different keyboard?


Thanks for staying with me ;-)  ... Meanwhile scanned with Pandasoft (found 6 suspicious cookies and 1 adware - no big deal and "disinfected now") and TrendMicro (no hits). Will go on with BitDefender, but it takes time scannign the full harddrive. The problem persists, stranger than before even: Visiting an amazon page with Firefox, I opened the Firefox text search box by "Ctrl-F" and tried to  type in a search word - but I could not get it right, after 4 or 5 letters the letter order got mixed. Doing it in slow motion, I found that after about 5 letters , the cursor magically moved one letter back to the left, and such cursor jumps mixed the letters with further typing (and I am not at a notebook with touchpad). I tried it again and again, same result, then left the computer as it was, returned one hour later, amazon page still open, and see: no cursor jumping.

Matrox card: It'S a rather aged one (G450), not Parhelia (it is fanless and that's nice). The driver that I use is the last one published for that card. Hasn't caused problems so far, don't think it is causing trouble.

Running processes: Yes, that is certainly a good idea. Actually the system reached a state where it might be a good idea to start from scratch anyway, as there are some layers of obsolete apps on it.

Hardware problem: I changed my keyboard and mouse from cordless usb to ps/2 now, but  no change. And my instinct  (and partly experience) tells me, that this is not hardware based. I mean with the years, you get a feeling, and hardware problems would be diffferent (not so much context dependent etc.). If I use notepad or notetab for text file editing, than letters appear in realtime, what a pleasure, no delays at all. Another thing are those strange jitters in graphical buildup of  windows that are being opened or switched to the foreground: Nearly unnoticable, but often there is a tiny delay to update the lowest part fo the window . Just like using VNC over a fast connection or Remote Desktop (well, VNC-style rather). And still I wouldn't call the system slow or overloaded overall. It is mainly typing and minor very peculiar graphical delays.

Ok guys, I'll try BitDefender then. I get the impression this will end in a clean OS install...

do you have the problem when you are disconnected from all networks?


Tried that before, disconnected for a short while with no change. Maybe I should reboot with network disconnected and see... BitDefender  still running, I'll reboot after the scan.

using process explorer (http://www.sysinternals.com/Utilities/ProcessExplorer.html) see what is happening with interrupts, DPCs, context switches, io read delta, and io write delta when you are seeing this slow response

Also try to narrow down exactly which programs the behavior appears in and which it does not.  Perhaps there is some common element in the instances where it is not working.


It's past midnight here in Europe now, BitDefender reports clean drives - I'll have some sleep. Won't return to this desk until tomorrow evening, so have a good start into the week. More on this in 24h, thanks for your guidance!
Sagy ee,

I have been watching to see the progress. You mentioned VNC do you currently have or use this on your system ?   Their have been a boatload of security issues with this. Back in May an update came out for VNC because an attacker could gain remote control of your system without needingyour password.

Have you tried deleting the normal.dot  template in word and then rerunning word ?
I would continue with the srest of the steps I have outlined to make sure it is clean once all of those steps are done we will know th system is clean and we are dealing with a hardware or software issue related to the o.s. that is not caused by virus or the like.


On this machine I am only using a vnc viewer, not the server functionality, and it is a security hardened VNC version from RealVNC - comes as just one exe file, only for viewing remote machines.

Yes, I'll continue to do the full catalogue tomorrow and post results, not giving it up yet! But for now, I'll call it a day..


Removing normal.dot and running word shows no specific effect, just tried it out very briefly.
OK continue with the list above after all is said and done it may be adviseable to defrag the drive since all the temporary files were removed etc...


Sorry to have left this question behind! I was on a short notice business trip... Returning to my desk now I somehow found enlightenment when I opened the screen settings dialog and came across the hardware acceleration settings: They were completely switched off, and turning them on solved the problem. Lucky hit.

I think it is fair enough to still give the credits to briancassin, as he has helped me a lot to regain trust in my system. Thanks a lot, briancassin and dave4dl!

By the way, the last thing I tried before leaving was to find the Symantec Online Scanner, but I couldn't find it on their website. Maybe I was to tired...


Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.