Nearly 100% CPU Usage

P

Paul

Paul said:
Great information, Paul.

Is there any easy way for me to tell how fast individual operations are
running? I'm kinda clueless about that. Paul C.

The answer is both yes and no. The problem is, there may not be a single
utility that gives "the answer". It may take two utilities, to determine
what is happening. I suppose I could copy the contents of the
Throttlegate.pdf document, but reading it complete with its graphs,
is more educational.

(It may not be here any more. This is where I got mine.)

http://imsahp.chambana.net/~randall/dell/throttlegate.pdf

The author of throttlegate, uses Control Panels:Administrative Tools:performance
and adds a counter called "ProcessorPerformance" and "% of Maximum Frequency"
to the graph. The percentage of CPU seen in the continuously updated graph,
would correspond to the first three table entries. The graph might not
take the "Clock Throttle" into effect.

Throttling action Effective processing power (frequency)
1. Transition from state P0 to P1 2261 MHz
2. Transition from state P1 to P2 1596 MHz
3. Transition from state P2 to P3 798 MHz (with FSB frequency cut in half)
4. Clock Throttling at 7/8 capacity of state P3 700 MHz
5. Clock Throttling at 6/8 capacity of state P3 600 MHz
6. Clock Throttling at 5/8 capacity of state P3 500 MHz
7. Clock Throttling at 4/8 capacity of state P3 400 MHz
8. Clock Throttling at 3/8 capacity of state P3 300 MHz
9. Clock Throttling at 2/8 capacity of state P3 200 MHz
10. Clock Throttling at 1/8 capacity of state P3 100 MHz

To handle the effects of the bottom seven entries, a program is used to
access the processor MSR and get the clock throttle fraction. The little
program is called msr.exe .

http://perfinsp.sourceforge.net , then download and use msr.exe from the package.

http://iweb.dl.sourceforge.net/proj...e Inspector/Sep-24-2009/pi_win32-20090924.zip

There is a script in throttlegate.pdf, that calls msr.exe in a 1 second loop. This
prints out some registers in a Command window. The throttlegate.pdf document
doesn't describe how to decode the register values. (The Intel Architecture Documents
likely have that kind of info. You can see this is rocket scientist material...)

*************************************************************************************
@echo off
c:
cd \ibmperf\bin
:start
cls
echo IA32_CLOCK_MODULATION
for /f "usebackq skip=2 tokens=1,3-5" %%i in (`msr -r 0x19a`) do @echo %%i %%j %%k %%l
echo.
echo IA32_THERM_STATUS
for /f "usebackq skip=2 tokens=1,3-5" %%i in (`msr -r 0x19c`) do @echo %%i %%j %%k %%l
echo.
echo IA32_PERF_CTL
for /f "usebackq skip=2 tokens=1,3-5" %%i in (`msr -r 0x199`) do @echo %%i %%j %%k %%l
echo IA32_PERF_STATUS
for /f "usebackq skip=2 tokens=1,3-5" %%i in (`msr -r 0x198`) do @echo %%i %%j %%k %%l
ping –n 1 127.0.0.1 > NUL 2>&1
goto start:
*************************************************************************************

An alternative to all that complexity, might be "RMClock". It has a graphical
output. One problem I have with it, is the output tends to be confusing.
But maybe the lines on the screen will stand out immediately, if
you're having a problem. RMClock adds a power management scheme to the Power
control panel, but you don't have to use it. RMClock also has the ability
to replace the "idle" task, with its own "idle" task. I used to use that
on my previous computer, to get proper SpeedStep behavior (my AV software
was screwing up SpeedStep). Again, you don't need to use that feature, and
just looking at the graphs should be enough.

http://cpu.rightmark.org/download.shtml

RightMark CPU Clock Utility (RMClock)

RMClock Utility 2.35 29/02/2008 .EXE 571 Kb
Executable & data files

Run RMClock, try to run a demanding program, then watch the system response.
I would shut the laptop for a couple hours (not charging it, you're trying
to cool it down), then immediately start RMClock, followed by a program
that will heat up the processor. Then watch the graphs. The claim is,
RMClock can watch clock modulation, but I don't know if it is clever enough
to plot the 1/8th to 7/8th thing or not. The violet colored graph might do
it. You'll just have to check and see.

It is possible that a laptop system, has a much more "interesting" graph
than a desktop does. (I found another article, where they overheated
a P4 on purpose, and the colored graphs respond to the insult. They
removed the heatsink, to demonstrate how the computer protects itself
if the heatsink falls off. So there is a more educational screenshot
than this one, but I'll never find it again.)

http://www.xbitlabs.com/articles/cpu/display/oc-guide_7.html

Another easy to use utility is CPUZ. I would use this in
conjunction with RMClock, to help you correlate real frequency
numbers, against at least one of the lines on the RMClock screen.
CPUZ doesn't incorporate clock throttle 1/8th to 7/8th in its
results, so this is more useful for watching FSB and multiplier
values.

(32 bit no-install version)
http://www.cpuid.com/download/cpuz/cpuz_152.zip

The entries in the "Clocks" section should be updated every few
seconds. On my computer, I can see Extended SpeedStep move between
operating points, when the computer shifts between idle and busy.

http://raymond.cc/images/cpuz.gif

If you have time to waste, there is fun to be had... Geek fun.

Paul
 
J

Jose

VanguardLG.

Something I forgot to mention regarding items inside of Task
Manager(Processes tab) on my wife's XP laptop: I noticed that there are 6
entries for svchost.exe as follows:

Network Service
Local Service
System Service
Network Service
Local Service
System Service
System Idle    98%
For the first 6 items all have different amounts of Memory usage shown.

Does that list of svchost.exe  entries make sense to you or anyone else?
Can I delete any of them or will that cause issues?  Paul C

Task Manager is a tinker toy. Get Process Explorer as indicated.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

Read about why multiple svchost processes are normal and also how to
interpret some things with Process Explorer:

http://www.bleepingcomputer.com/tutorials/tutorial129.html

You may want to be careful not to consume too much of your time with
"trying" things, things that it could be or things that might work
maybe.

You need to be figuring things out and fixing things, not trying
things.

To avoid additional speculation please provide additional information
about your system.

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select
All, Copy and then paste
the information back here.

There will be some personal information (like System Name and User
Name), and whatever appears to
be private information to you, just delete it from the pasted
information.

This will minimize back and forth Q&A and eliminate guesswork.
 
D

db

if your computer is running fine
in safe mode, then you may want
to execute the process known as
a "clean boot"

to initiate a clean boot click on
start>run>msconfig

after you type and enter msconfig
go to the startup tab and uncheck
all the items that are enabled then
click apply.

you may want to jot them down.

next go to services tab and "hide"
all microsoft services.

what remains should also be
unchecked then click apply,
exit and reboot.

--
db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- @Hotmail.com
- nntp Postologist
~ "share the nirvana" - dbZen

~~~~~~~~~~~~~~~
 
P

Paul Calcagno

As an update of my situation to everyone who offered such great advice, I
just finished running the MSRT malware program (KB890830-which ran fast but
took almost 6 hours due to the 1.2 million files on my laptop!!!). It came
up with zero (0) errors in the `full scan'! During the scan, with my
Ad-Aware real time scanner disabled, my % CPU figure was running around 70%.
When the scan finished the %CPU time had dropped to a few percent, with
System Idle time in the high 90's. Anyone have any comments about those
numbers?

So, it seems all is pretty well at this point. I've not had a chance to run
the Windows Live Safety Center Protection scan in safe mode with Networking
yet, but will tomorrow. Thanks again to everyone for your support. What a
great resource.

Paul C.
 
P

PA Bear [MS MVP]

Tip: Run Disk Cleanup before doing any further scans.

Please note that the MSRT only scans for a certain set of specific,
known-malware (and not necessarily all variants of same). See the complete
list in http://support.microsoft.com/kb/890830. The Windows Live Safety
Center's 'Protection' scan is much more thorough (but certainly not the be
all/end all of scans). You don't necessarily need to scan in Safe Mode with
Networking but that may be the only way to run the scan on some infected
computers. And even that isn't foolproof.

Repost:
 
P

Paul Calcagno

PA Bear. I did run Disk Cleanup (after downloading the utility that stops
Disk Cleanup from hanging up) and it finally works!. Also, I'm running
Windows Live Safety Center's 'Protection' scan as we speak. So far after
almost 3 hours it's about 50% complete, yet it's found 5 bad errors. I sure
hope this utility has a way to delete the errors when it's done. It's a
little hard to tell if what's going to happen at the end of the scan since
my only choices are 1) let it finish or 2) cancel it. There's no
pause/resume buttons.

Thanks again PA Bear.............Paul C.
 
P

Paul Calcagno

Hi PA Bear.

I don't mean to be dense but what do you mean by "3. Now run a thorough
check for hijackware, including posting requested
logs in an appropriate forum, not here....". Not sure how to do this.

Paul C.
 
J

Jose

Hi PA Bear.

I don't mean to be dense but what do you mean by "3. Now run a thorough
check for hijackware, including posting requested
logs in an appropriate forum, not here....".  Not sure how to do this.

Paul C.

Just do this:

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.
 
D

Daave

Hi, Paul. I see it's been a few days and you're still trying to get to
the bottom of this performance issue. Here's (hopefully) an overview of
the situation:

Although your wife's laptop has had problems in the past with
overheating, that *seems* to have been fixed. You can always run
utilities to get more information. I would start with SpeedFan:

http://www.almico.com/speedfan.php

Also, what is the model number of this laptop? As Paul pointed out,
certain Dell laptop models have experienced throttling problems:

Latitude E6400
Latitude E6500

Source:
http://blogs.zdnet.com/gadgetreviews/?p=9799

Malware is always a possibility. This is why PA Bear has recommended
running HijackThis and posting your log to an appropriate Web forum to
get expert advice.

Of course, there is a disitinct possibility you don't have malware. :)
If this is the case and if you do not have a hardware issue, you have
already been given links to run Process Explorer and search for the
runaway process that way. For your convenience, here they are again:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

http://www.bleepingcomputer.com/tutorials/tutorial129.html

Another thing you can try is to see if you have the same performance
issue in Safe Mode. If you don't, this is very useful information. At
this point, you can configure a Clean Boot:

http://support.microsoft.com/kb/310353

.... and systematically re-enable programs and processes until you notice
the performance hit in order to determine which program/process is
responsible for the sluggishness.

You really need to delete your temp files and defrag your hard drive!
Try this either in Safe Mode or after having configured a Clean Boot.

HTH.

P.S. Security suites, ironically, are often the cause of sluggishness.
 
P

Paul Calcagno

Daave, you're going to have to bear with me on this, but I'm embarrassed to
say that my wife's laptop is NOT a Dell. It's a Compaq Presario 3000. Does
that matter regarding the Throttlegate we've been discussing?

Please note, when I turn off the active scanning feature of Ad-Aware, and as
long as I'm only running the A/V scanner associated with CA, my System Idle
time is now above 90%. So I think that closes out the issue of excessive
idle time.

My system may still have Malware because some new strange things started
happening today. All of a sudden my IE won't open, actually it opens, tries
to connect to the home page, then shuts itself down. The only way I can open
IE is with no Add-Ons with a different shortcut I created. I tried a
Restore (which worked) but IE still won't open. The only thing that changed
between IE working and not is that I ran the OneCare Live scanner in safe
mode. After that is when IE stopped working (note; I left this scanner
running all night, my wife got up and just rebooted the computer as it had
finished and turned itself off!!)

For the IE problem I have to admit I don't know how to manage my Add-ons
because trying to enable them one at a time when IE is open in the No
Add-Ons mode doesn't work. If you can advise me how to add back Add-Ons one
at a time that would be great. But keep in mind I can't open IE normally
now.

Regarding Safe mode operation, I've verified that the response time is a lot
better in Safe mode, but as I said, my CPU usage time without scanners
running is most acceptable right now anyway so it's not clear that the
better response time in safe mode really means much.

Any comments about the fact that IE won't open and connect?

I always delete my Temp files and my Temporary IE files. I either do it
inside of IE or I use CCleaner. However, I've never done this is Safe mode
but I will now.

To sum up, my response time is really not an issue anymore and the multiple
A/V scanners seemed to be the culprit. At this point I'm concerned about my
inability to start IE with Add-Ons.

Thanks so much for your help and expertise. You guys are
great.....................Paul C.
 
P

PA Bear [MS MVP]

See my earlier reply:


Paul said:
Hi PA Bear.

I don't mean to be dense but what do you mean by "3. Now run a thorough
check for hijackware, including posting requested
logs in an appropriate forum, not here....". Not sure how to do this.

Paul C.
 
C

chuck

Sometimes, often once or twice a year, I like to spool off
any data to a d: drive (where most of it is already),
format c: and do a fresh install of everything I really
REALLY need. Then I go thru the registry and stop
pretty much everything from autostarting.

I find this gets rid of a bunch of software I did not
really need and never use, and prevents programs (like
Nero) from autostarting and using up memory needlessly.
 
D

Daave

Coments inline.

Paul said:
Daave, you're going to have to bear with me on this, but I'm
embarrassed to say that my wife's laptop is NOT a Dell. It's a
Compaq Presario 3000. Does that matter regarding the Throttlegate
we've been discussing?

As far as I know, there are no throttling isses with Compaqs.
Please note, when I turn off the active scanning feature of Ad-Aware,
and as long as I'm only running the A/V scanner associated with CA,
my System Idle time is now above 90%. So I think that closes out the
issue of excessive idle time.

I take it you mean "excessive *CPU usage*," no? There is no such thing
as excessive idle time. :)

Ad-aware no longer has a sterling reputation. I would uninstall it if I
were you.

Above 90% is an improvement, but if your PC is idling, System Idle
Process should really be at 99%. And CPU usage (at the bottom of that
window) should be either 0% or 1%.
My system may still have Malware because some new strange things
started happening today.

"Still have malware"?

I know you were scanning for malware, but I don't recall you ever saying
that you had any.

Did you have malware at one point? And I don't mean tracking cookies. I
mean actual malicious software running. Did you? Because if you did, I
echo what others said with regard to scanning further for malware.

MBAM and SAS are definite musts.

HijackThis: maybe.

If you *never* had malware, then your problem is probably due to one of
your programs (perhaps even the CA suite you have). Or maybe AdAware is
your problem and you figured that out.

Again, let us know if your idling figures deviate from what I indicated
above. But if you are at 99% System Idle Process while idling, I'm not
sure you have *any* problems. :)

That being said, if you *did* have actaul malware at one point in time,
you're not necessarily out of the woods yet.
All of a sudden my IE won't open, actually
it opens, tries to connect to the home page, then shuts itself down.
The only way I can open IE is with no Add-Ons with a different
shortcut I created. I tried a Restore (which worked) but IE still
won't open. The only thing that changed between IE working and not
is that I ran the OneCare Live scanner in safe mode. After that is
when IE stopped working (note; I left this scanner running all night,
my wife got up and just rebooted the computer as it had finished and
turned itself off!!)

Could be malware.

But it could very well be that OneCar Live scan you ran. Are you able to
undo what it did? If not, you should never run such a program! It may
have changed some key registry settings. A System Restore *may* get you
out of that pickle, but who knows?

Or you may now need to post to the IE newsgroup!

Okay, just did a quick Google search. The post by JimR1 may help:

http://social.microsoft.com/Forums/en/onecareofftopic/thread/2d4f818c-b2e6-4abb-b4c3-ba72f4a6a72e

Don't ever, ever, EVER mess with your registry (that is: scanning,
cleaning, optimizing, etc.)! Not even if it's a Microsoft program. It's
too risky. And furthermore, there is no evidence *whatsoever* that doing
so yields any appreciable performance benefit.
For the IE problem I have to admit I don't know how to manage my
Add-ons because trying to enable them one at a time when IE is open
in the No Add-Ons mode doesn't work. If you can advise me how to add
back Add-Ons one at a time that would be great. But keep in mind I
can't open IE normally now.

Which version of IE are you running?

It's impossible to manage add-ons in IE's No Add-On mode! That's the
whole idea of No Add-On Mode. :)

You need to be in the regular mode to manage your add-ons.
Regarding Safe mode operation, I've verified that the response time
is a lot better in Safe mode, but as I said, my CPU usage time
without scanners running is most acceptable right now anyway so it's
not clear that the better response time in safe mode really means
much.
Any comments about the fact that IE won't open and connect?

Could be malware.

But if this behavior happened immediately after the OneCare Live scan,
that's gotta be the reason. Fortunately, you should be able to restore
the older registry keys (per JimR1's post) and reboot. Hopefully that'll
fix it.

AND DON'T EVER "CLEAN" OR "OPTIMIZE" YOUR REGISTRY AGAIN!

(Sorry for shouting, but I want to make sure you hear me. :) )
I always delete my Temp files and my Temporary IE files. I either do
it inside of IE or I use CCleaner. However, I've never done this is
Safe mode but I will now.

I see. Still, if you can't use Disk Cleanup, that *is* a problem. See if
you can use it in Safe Mode.
To sum up, my response time is really not an issue anymore and the
multiple A/V scanners seemed to be the culprit. At this point I'm
concerned about my inability to start IE with Add-Ons.

Other than CA, I don't recall any other AV programs you mentioned.
Refesh my memory, though.

Regarding IE, first fix it by undoing those registry changes. Then see
what happens when you run it in regular mode. Remember, regular mode is
what you need to run IE in if you want to manage your add-ons.
 
P

Paul Calcagno

Hi Daave. Regarding how I may have screwed up the registry by running
OneCare Live Scan, without making anyone feel uncomfortable, I was given
advice on this post to run this by a person I consider an expert. I knew
beforehand that I should be adjusting the registry but there was no
indication given to me that the OneCare Live program was going to mess with
the registry.

Right now I'm running IE7. If I uninstall IE7 and install IE8 will this
registry problem go away. If so, that's an option if undoing the Registry
changes does not work.


Paul C.
 
D

Daave

PA Bear? He *is* an expert. But he stated:

"WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
in Safe Mode with Networking, if need be"

Did you run the "Protection" scan only? Or perhaps did you run other
scans? Since I'm not familiar with this program, all I can do is direct
you once more to this page:

http://social.microsoft.com/Forums/en/onecareofftopic/thread/2d4f818c-b2e6-4abb-b4c3-ba72f4a6a72e

FWIW, PA Bear also said that that scan isn't "foolproof."

Never, ever, ever upgrade IE (or anything for that matter) to try to fix
a problem. It might very well wind up making your problem worse!
 
P

Paul Calcagno

Daave, I posted the following few sentences onto an earlier note to you but
haven't heard back from you yet.

Right now I'm running IE7. If I uninstall IE7 and install IE8 (using Firefox
for the download) will this registry problem go away that might have been
caused by scanning with OneCare Live tool? . If so, that's an option if
undoing the Registry changes does not work.

Paul C.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top