High CPU usage problem

[Sturdy]

Hi all,

I have 2 conditions that I have been trying to correct for several months
since XP Pro was re-installed (clean). Both conditions seem to occur randomly
and I think both conditions may be related. Sometimes occurrences ar minutes
apart, other times days apart.

1) The entire computer freezes for about 30-60 seconds cycles, unfreezes for
1-2 minutes then freezes again. There is no visible activity. Mouse et al is
dead, no DSL, etc. Usually one or more reboot corrects but this has also
occurred at the Win XP splash screen.

2) Taskman CPU usage goes to about 45% for several minutes then returns to
normal. Taskman shows occassional spikes but no process reflects this amout
of usage. Again, no network activity. It appears something is running that
does not show in taskman.

I've reloaded drivers, new drivers, removed all startup apps, bios changes,
etc. but no joy. Device mgr indicates all devices are working without
conflict. I feel this may be networking related since these issues occur most
often when I try using two apps that both access the network.

I'd appreciate any ideas on how to trace or resolve the problem. TIA...
Cheers,
Sturdy

 

[JS]

You need to find and identify the specific process or application that's
runs every few minutes.
For more exploratory and detailed look, download and try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and 'Show Lower
Pane' options.
(This will provide the detailed info you need)
Next click on the CPU column to sort processes by %CPU usage.
Then about every few minutes you should see another process
(the one that's slowing down your PC) float to or near the top of the list.
Then click on the process of interest that's listed in the CPU % column,
once it's highlighted, right click and from the options listed select:
the 'Search Online' option.
This should display what out there on the web about that process.

Note: some entries like Explorer and svchost may need to be expanded
to show the detail, (sub processes),
in this case click on the + located to the left of the entry.

JS

 

[Sturdy]

Thanks for the response, JS.

You need to find and identify the specific process or application that's
runs every few minutes.

I'll give process explorer a try. This is what I was trying to do with
taskman. Unfortunately, when total freeze occurs, everything is locked and I
can't access any app so I'll need to wait for a 'partial freeze'. It may take
several days.

 

[Sturdy]

Thanks for the response, R. McCarty.

First thing I'd recommend is to check both your System and Application
Event logs. Check for Red Icons that denote errors.

Logs don't show any issue. When the box freezes, nothing seems to occur
until the box comes to life and activity seems to re-start exactly where it
left
off.

Freezing can be a hardware related issue with IRQ mapping.

I've tried changing mapping from the bios but the bios seems to have a
mind of it's own. Often IRQ are shared but XP shows no conflict..
I'll relook this.

It can also be due to USB loading.

Please explain 'loading.' USB is flakey, tries to boot any thumbdrive even tho
USB boot is off in the bios. Also often fails to install my external HD. I
generally keep all USB devices unplugged.

You would want to check your NIC settings and make sure the
operating mode is "Auto-Detect" and that any Offload capabilities are
enabled. The problem may also be a background service that is halting
or trying to perform some automated process ( Update or Scan ).

I'll check these.

 

[JS]

Just a reminder that you will need to have Process Explorer running prior to
the freeze.
So run it each time you startup the PC, experiment a little so that you are
familiar
with it's capabilities. This way your ready when the problem occurs.

Good Luck
JS

 

[R. McCarty]

IRQ sharing isn't usually an issue. On ACPI setups, you'll likely see a
number of shared IRQs with several devices mapped together. BIOS
control is overridden by the OS, so trying to manually map IRQs isn't
likely to work. About the only IRQ control is what slot you install a
PCI card into. Most motherboards only provide one or two slots that
have an Independent IRQ ( not shared ). Usually it's Slot #2 & 5 as
counted from the Video ( AGP/PCIe ) but you have to consult the MB
documentation as it usually provides an IRQ slot map.

USB loading relates to how much Root Hub power is consumed. The
Hubs can provide up to 500mA. The controller has a fixed amount of
Bandwidth and some devices can consume a good portion of that. If
loading is an issue you'll usually plug in a device and it ( or other ) USB
peripherals won't be detected. You can check the loading by using
Device Manager, USB Category
Controllers - Check the Advanced (TAB) for bandwidth usage
Root Hubs - Check the Power (TAB) for mA consumption

 

[Daave]

Hi all,

I have 2 conditions that I have been trying to correct for several
months
since XP Pro was re-installed (clean). Both conditions seem to occur
randomly
and I think both conditions may be related. Sometimes occurrences ar
minutes
apart, other times days apart.

1) The entire computer freezes for about 30-60 seconds cycles,
unfreezes for
1-2 minutes then freezes again. There is no visible activity. Mouse et
al is
dead, no DSL, etc. Usually one or more reboot corrects but this has
also
occurred at the Win XP splash screen.

2) Taskman CPU usage goes to about 45% for several minutes then
returns to
normal. Taskman shows occassional spikes but no process reflects this
amout
of usage. Again, no network activity. It appears something is running
that
does not show in taskman.

Boot into Safe Mode and please post pertinent copies of Error reports
from Event Viewer, easily accessed by:

Start | Run | type "eventvwr" (without the quotes)

For more info, see "How to view and manage event logs in Event Viewer in
Windows XP":

http://support.microsoft.com/kb/308427

 

[Sturdy]

Thanks, I'll get PE installed tonight.

Just a reminder that you will need to have Process Explorer running prior to
the freeze.
So run it each time you startup the PC, experiment a little so that you are
familiar
with it's capabilities. This way your ready when the problem occurs.

Good Luck
JS

 

[Sturdy]

Thanks for the details...

USB loading relates to how much Root Hub power is consumed. The
Hubs can provide up to 500mA. The controller has a fixed amount of
Bandwidth and some devices can consume a good portion of that. If
loading is an issue you'll usually plug in a device and it ( or other ) USB
peripherals won't be detected. You can check the loading by using
Device Manager, USB Category
Controllers - Check the Advanced (TAB) for bandwidth usage
Root Hubs - Check the Power (TAB) for mA consumption

This could be my USB HD issue but probably not the freeze issue.
The HD gens a lot of heat but has its own power. I'll try this tonight.
Hmmm...now where did I put that USB power adapter?

 

[Sturdy]

Thanks for the response Daave

Boot into Safe Mode and please post pertinent copies of Error reports
from Event Viewer, easily accessed by:

Start | Run | type "eventvwr" (without the quotes)

I'll take a look at the logs tonight. I had a 'partial freeze' last night
and the
log may reflect something. A total freeze doesn't produce a log entry,
presumably because the log is frozen too.

 

[Gerry]

Sturdy

You complain of freezes but your subject is "High CPU". As you say it
could be two problems but you do not seem to have not seen any evidence
of high CPU usage only freezes? Could the high CPU usage be a red
herring?

Is this a laptop or desktop? It could be dust inside the casing. Remove
the side panels and use an Air Duster.

Have you checked your hard drive?

Try HD Tune only gives information and does not fix any
problems.

Download and run it and see what it turns up. You want HD Tune
(freeware) version 2.55 not HD Tune Pro (not Freeware) version 3.00.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon ( copy to
Clipboard ) and copy into a further message. Make sure you do a full
surface scan with HD Tune.

Another possibility is faulty RAM?

What are your anti-virus / anti-spyware arrangements?

How much RAM do you have?

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

I would be interested in seeing a Disk Defragmenter report. Open Disk
Defragmenter and click on Analyse. Select View Report and
click on Save As and Save. Now find VolumeC.txt in your My Documents
Folder and post a copy. Do this before running Disk Defragmenter as it
is more informative.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[sandy58]

Hi all,

I have 2 conditions that I have been trying to correct for several months
since XP Pro was re-installed (clean). Both conditions seem to occur randomly
and I think both conditions may be related. Sometimes occurrences ar minutes
apart, other times days apart.

1) The entire computer freezes for about 30-60 seconds cycles, unfreezes for
1-2 minutes then freezes again. There is no visible activity. Mouse et al is
dead, no DSL, etc. Usually one or more reboot corrects but this has also
occurred at the Win XP splash screen.

2) Taskman CPU usage goes to about 45% for several minutes then returns to
normal. Taskman shows occassional spikes but no process reflects this amout
of usage. Again, no network activity. It appears something is running that
does not show in taskman.

I've reloaded drivers, new drivers, removed all startup apps, bios changes,
etc. but no joy. Device mgr indicates all devices are working without
conflict. I feel this may be networking related since these issues occur most
often when I try using two apps that both access the network.

I'd appreciate any ideas on how to trace or resolve the problem. TIA...
Cheers,
Sturdy

Codecs installed? What video/graphics card if any?

 

[Sturdy]

Hi Gerry, thanks for the response.

You complain of freezes but your subject is "High CPU". As you say it
could be two problems but you do not seem to have not seen any evidence
of high CPU usage only freezes? Could the high CPU usage be a red
herring?

Please see my first post. I apologize for the confusion. I think high cpu
usage is the root of both problems (freeze and slowdown). The first (and most
often occurring) is a total lockout (freeze) where it's like somebody pulled
the power but the image stays on the monitor. No input or output of any kind.
The second condition is about 45% usage (slowdown) where the system slows and
the mouse is jerky but IO still possible. I assume both conditions may be
caused by the same errant process or condition totally or partially hogging
the cycles.

In the total freeze, there is no way to view anything except what is already
on the screen since the entire box is frozen. Taskman freezes as does event
logging. Process Explorer (recommended by JS) may do the same but may show
added detail at the time of the freeze/slowdown. I'll try PE tonight but will
need a freeze or slowdown to occur.

In the slowdown, Taskman is still operating and shows 45% usage but there is
no process visible in Taskman that shows more than 2% cpu so something else
is consuming those cycles. PE may show more detail.

By 'red herring' do you mean a deception or not really slowing down? I can
assure you the system gets much slower. I routinely check for malware and
find none. I use Symantec AV/AS/firewall (a freebie provided with my Verizon
DSL account). These issues also occur when the AV or Spybot S&D is not
installed. The problems doesn't seem to be any recognizable app. I don't
think malware is phoning home since there is no network activity. But it
could be building a file for later broadcast.

Is this a laptop or desktop?

An old desktop workhorse but it is clean and cool with plenty of air
movement. CPU temp is low but I don't remember exactly (I'll check tonight).

Have you checked your hard drive?

Well, no. Three internal HD ( 80, 120, & 300 GB) but never a hiccup since I
added the 450W PS. These issues were occurring before the 300 went in. Also a
CD and DVD drive but the problems haven't occurred when the opticals were in
use.

Try HD Tune only gives information and does not fix any
problems.

Download and run it and see what it turns up. You want HD Tune
(freeware) version 2.55 not HD Tune Pro (not Freeware) version 3.00.
http://www.hdtune.com/

URL doesn't reaspond so DL from www.MajorGeeks.com

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon ( copy to
Clipboard ) and copy into a further message. Make sure you do a full
surface scan with HD Tune.

I'll give HD Tune a spin tonight. Can't hurt.

Another possibility is faulty RAM?
How much RAM do you have?

2GB that passes mem tests. If mem is a problem, I would expect mem intensive
apps to be erratic. The problems do not occur any more often when I run Adobe
PS and Lightroom (no games allowed).

What are your anti-virus / anti-spyware arrangements?

See above.

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

Will check tonight.

I would be interested in seeing a Disk Defragmenter report. Open Disk
Defragmenter and click on Analyse. Select View Report and
click on Save As and Save. Now find VolumeC.txt in your My Documents
Folder and post a copy. Do this before running Disk Defragmenter as it
is more informative.

Will do tonight. I defrag occassionally but it always says not needed.

I can see a busy night, thanks to all for the ideas and assist.

Sturdy

 

[JS]

A couple of tips on using Process Explorer.

1) You will notice one or more small graphs directly beneath the menu bar.
The one on the left is the CPU usage graph, double click on the graph to get
a larger graph.
2) If you mouse over any spike in the CPU usage graph you will see what
process caused the spike.
3) Select the 'View' option in the menu bar, near the bottom of the View
list is 'Update Speed'
select 1 second or .5 seconds, this specifies how often Process Explorer
take a sample.

When the computer freezes for a long period of time,
wait until you get control (unfreezes) back
and then check (mouse over) the right hand end of the CPU graph,
even if Process Explorer freezes you just may be able to see what
caused the problem.

If it's an Svchost.exe process that is taking all the CPU resource.
In the 'Process' column, double click on that particular Svchost.exe process
Then click on the 'Services' tab in the Window that pops up.

JS

 

[Sturdy]

Hi JS, et al

TGIF...With all the ideas presented, I had a lot more than I could handle
last night. It looks like troubleshooting this problem will take several
days. But I really appreciate all of the help from you and the others that
responded.

Here is what little I learned:
1) The good: CPU temp is steady at 48/118, system temp at 37/98. Defragged
C: but it was not very fragmented. As I was sleep deprived, I saved but
forgot to copy the report.

3) HDTune doesn't seem to like my drives. Benchmarks look okay but Info and
Health tabs are blank. Error scan (Quick) looks okay for C:. Will do full
when I have time. HDTune.com is apparently down so I can't dl the manual and
there is no Help file (cool app tho).

3) Process Explorer may have uncovered some unusual activity. PE seems to
reveal more than you ever need to know ;-)

If it's an Svchost.exe process that is taking all the CPU resource.
In the 'Process' column, double click on that particular Svchost.exe process
Then click on the 'Services' tab in the Window that pops up.

No freezes last night. I had two slowdowns that indicated svchost where cpu
went to 80% for about 20 minutes each. I looked at the lower pane (a bunch of
entries but didn't see anything unusual (or that I understood!). Didn't know
about the above so will try that next. I need to RTFM.

Strangest, I had a third instance that went to 80% for about 30 min before
I reduced to about 6% by shutting down apps one at a time (no help). The
strange part is that the app hogging the cycles was procexp.exe. I don't
understand how that is possible. I tried to recreate but gave up and went to
bed at midnight.

Seems suspicious that all three instances went to about 80% for several
minutes. Since there is no obvious slowdown, periods of high usage may be
happening more often than I realized before PE. I don't think PE would
normally go to 80% since it would be too intrusive if it consumed that much
cpu. This appears to be the most likely avenue to continue troubleshooting.
Could this be a hijack?

Again, thanks to all for the assist.
Sturdy

 

[Gerry]

Sturdy

Replies inline

Hi JS, et al

TGIF...With all the ideas presented, I had a lot more than I could
handle last night. It looks like troubleshooting this problem will
take several days. But I really appreciate all of the help from you
and the others that responded.

Here is what little I learned:
1) The good: CPU temp is steady at 48/118, system temp at 37/98.
Defragged C: but it was not very fragmented. As I was sleep deprived,
I saved but forgot to copy the report.

3) HDTune doesn't seem to like my drives. Benchmarks look okay but
Info and Health tabs are blank. Error scan (Quick) looks okay for C:.
Will do full when I have time. HDTune.com is apparently down so I
can't dl the manual and there is no Help file (cool app tho).

HD Tune relies on S.M.A.R.T. You may need to enable S.M.A.R.T. in the
BIOS. Also make sure the box for S.M.A.R.T is ticked
as a supported feature on the Info tab in HD Tune..

3) Process Explorer may have uncovered some unusual activity. PE
seems to reveal more than you ever need to know ;-)

No freezes last night. I had two slowdowns that indicated svchost
where cpu went to 80% for about 20 minutes each. I looked at the
lower pane (a bunch of entries but didn't see anything unusual (or
that I understood!). Didn't know about the above so will try that
next. I need to RTFM.

Strangest, I had a third instance that went to 80% for about 30 min
before I reduced to about 6% by shutting down apps one at a time (no
help). The strange part is that the app hogging the cycles was
procexp.exe. I don't understand how that is possible. I tried to
recreate but gave up and went to bed at midnight.

It would be helpful if you could post the Command Line of the svchost
process generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.

Seems suspicious that all three instances went to about 80% for
several minutes. Since there is no obvious slowdown, periods of high
usage may be happening more often than I realized before PE. I don't
think PE would normally go to 80% since it would be too intrusive if
it consumed that much cpu. This appears to be the most likely avenue
to continue troubleshooting. Could this be a hijack?

Again, thanks to all for the assist.
Sturdy

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JS]

Process Explorer does not load down the CPU that much.
What Service Pack are you at (SP1, SP2 or SP3)?

Move your cursor over the Svchost entry that is slowing things down
and then double click and then click on the 'Image' tab (as Gerry suggested)
Report back on what you find.

JS

 

[Sturdy]

Hi all,

Well, it's been two weeks and not a hiccup! We must have really scared this
old box! I have been monitoring everything with procexp but no freezes,
slowdowns, etc. I'm sure it's waiting to get me when least expected...sigh.

I just want to thank everyone for the helpful assistance.
Best regards,
Sturdy