I bought a Compaq Presario R3424 laptop in March 2005, running Windows XP Home SP-2. 1.6 GHz AMD Athlon chip; 512 MB of memory; 55 GB hard drive. Machine is stand-alone, not networked. Uses built-in wireless; router is connected to a cable modem.
No exclamation points showing up the Device Manager, so it appears that all is well there. BIOS is up-to-date.
Sometimes, it would be running just fine but then very suddenly slow to a crawl, with the CPU usage jumping to 100%. In Task Manager, I could see that sometimes the offending process (taking up 99%) was winlogon (which of course can't be terminated), other times it was Outlook.exe, other times it was Word.exe. Sometimes when I kill the offending process, that solves the problem. But other times, anotherr process just goes to 99% when I kill the first process that was at 99%. I don't remember whether it has ever been other processes (such as explorer.exe or system.exe) that were stuck at 99%, but I do know that it has never been a process that was unfamiliar to me. The only thing that every got rid of this condition is a hibernate (usually) or a restart (always). When the problem happened, I had often (but not always) stepped away from the computer for a while right beforehand.
After running the leading spyware detectors (Ad-Aware, Microsoft Anti-Spyware, Norton, and online scans from McAfee and others), running the Norton WinDoctor diagnostic, doing lots of Google research, I gave up, went back to Microcenter in April 2005, and exchanged the laptop for an identical one. But then once I installed all my software on the new machine, the exact same thing started happening!
This is a very tough problem to troubleshoot because it happens only occasionally (perhaps twice a week), so it's nearly impossible to test different combinations of open applications, processes, etc. But when it does happen, it is very disruptive to my work because I tend to have a lot of applications open at one time, so I am very reluctant to reboot. So the process of getting the machine to hibernate might take 10-15 minutes because the CPU is so tied up that it can take 15 seconds just for the mouse to respond, which means it takes me 5 minutes just to open up Task Manager (versus a few keystrokes).
It could be some combination of software that is causing this problem, but it's all the same software and operating system that I had on my previous machine.
I have ensured that I have no extraneous start-up items in msconfig, and I have killed all unnecessary processes. No background tasks such as defrag are running. I can post a HijackThis log if that would be helpful.
Is there some kind of logging mechanism so that I can go back and see what occurred right below the jump to 100%? That might help narrow down the problem, since it could be a million things (based on my research so far in the ExpertsExchange knowledge base).
Suggestions are welcome, but what would be even better would be for someone to diagnose this for me via web conferencing. It would be willing to pay for someone's time to do this, as long as pricing and terms were discussed beforehand. Are there any companies (big or small) that specialize in providing that type of remote support using web conferencing tools?
==========================
Deleted, with no points refunded
08/04/2005 06:05AM PST
DarthMod
Community Support Moderator
==========================
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Also start regedit, then navigate to HKEY_Local_machine\system\
and make sure ClearPageFileAtShutdown is set to 0
I also advise you to shutdown the PC now and then, as some apps don't allways clear the memory the way they should, and this resets everything. Also run windowsupdates regularly.
Which AV software are you using? Norton tends to be quite a system resources hog and can greatly slow your system down.
I agree with rindi. I switched to AVG from Norton antivirus and machine runs smooth and nimble after eliminating the big resource hog NAV.
OK, how about checking the event log in Windows XP:
Right click on "My Computer" Icon and select "manage".
Double click "System Tools" icon in right column
Double click both "system" and "applications" one at a time
examine log watching the time indications as they proceed the slow down
Try right clicking on yellow or red marked events for examining and analyzing reasons
good luck and wish you well in discovering this slow down reason.
bs5
Thanks for your suggestions, rindi and bullshooter5. Some replies:
1) I've been quite satisified with the speed of the machine except when it comes to a screeching halt in a matter of about 2 seconds as the CPU usage jumps to 100%. So I don't think my focus needs to be on how to speed up the machine, since there is some as-yet unidentified dramatic event that is causing the CPU spike.
Having said that, though, I don't think having many apps open at the same time is the cause, since sometimes it happens very soon after a fresh reboot when there is hardly anything open. Also, I'm running the same software as I did on my last Windows XP Home SP-2 machine a few months ago, which had only half the RAM of this one (256 vs. 512 MB).
Also, I had already deleted temporary files, emptied the recycle bin, and run a defrag.
2. I did verify that the ClearPageFileAtShutdown was set to 0, thanks.
3. To answer a question that both of you asked, I've been using Norton Anti-Virus. So I will turn that off the next time I'm going to be using the laptop offline for a long period, and then I'll see whether the spike every happens when Norton is turned off.
4. Thanks for letting me know about the event viewer. (I didn't know it existed.) Everything was fine when I stepped away from the computer at 7 pm on June 3, and when I came back at 11:30, CPU usage was at 100%, and it took me nearly an hour just to get it to hibernate (since I didn't want to push the power button and lose track of my workspace of open e-mail messages and web sites). I want to post all the errors that I see listed under the "Application" and "System" nodes of the tree in the event viewer (since I have no idea what they mean), but I don't think they will fit in this post. So I pasted them into two text files on my web site (one for the Application node of the event viewer and one for the System node)at:
www.AuditLeverage.com/Down
www.AuditLeverage.com/Down
Any feedback would be much appreciated, thanks again.
Mike
Sorry, the links don't work.
I have a further question. Are you using a screen saver? Try using the blank screen screensaver, that one doesn't use to much resources. The other grafical screen savers usually use more power than no screen saver, which in my opinion is by for not the point of a screen saver!
I give lot's of credit for solving some of these issues to posters like cpc 2004. He has the ability to read mini dump files which can aid in determining the exact cause for these types of obscurities. I also credit the below copy and paste to him in helping locate these advanced event files:
minidumps are located in \windows\minidump
Control Panel -> Adminstrative Tools -> Event Viewer -> System ->
Right click on suspect event and select properties for explanation of problem. These logged files are useful in determing problems and solutions but it takes someone qualified at reading them.
bs5
Sorry about that, here are the corrected links:
www.AuditLeverage.com/Down
www.AuditLeverage.com/Down
Good question about the screen saver. The answer is yes, I always use the blank one.
I'm also going to go into Control Panel > Power Management and disable standby for when the laptop is plugged in. (I had already disabled hibernate for when the laptop is plugged in.) Maybe that will help. All or most of the occurrences of the problem have been when it's plugged in.
Thanks again.
Thanks, Temporo. The File Indexing service was stopped but not disabled, so I disabled it.
Andy, thanks for your suggestion about running HijackThis the next time this happens. I will try that, although it will take me a loooooong time because the mouse and keyboard response times are so incredibly slow when CPU is at 100% usage.
In answer to your other questionabout whether the problem ever occurs when I'm not connected to the internet, I don't know, but from now on I will make sure to track: 1) whether connected to Internet, 2) whether Norton is running, 3) whether the machine is plugged in, 4) how long it's been since the last reboot, 5) how many applications and files are open, 6) what the offending process is, 7) whether a hibernation gets rid of the problem.
Thanks, bullshooter5 - you mentioned c:\windows\minidump, but the only file in there is Mini052805-01.dmp, which was last modified on 5/28/05. The place where the errors are stored must be different, because as you can see from the two text files that I posted, the error history goes right up through to this weekend.
You also mentioned that cpc2004 is good at reading these event viewer logs like the ones in those two text files that I posted. Is there any way I can appeal to his kindness/mercy to take a look at them? :>)
cpc2004 is very good and always seems helpful regarding his minidump analysis. Here is a minidump thread that cpc2004 participated in. He is one of the listed expert responders and if you were to click on his highlited name, youshall be flown to his profile where he has posted his email addy.
http://www.experts-exchang
Why don' t you send him a request to view this thread with a link. Tell him I recommended him to you and mentioned I thought he would be very helpful.
Good luck and I hope youcan clear this matter up ....we might all learn something in the process.
bs5
Debug a loop problem is a very hard as I have to debug a program without source code and documentation. When the CPU has 100%, force a crash dump. I have to study the stack trace to find out why windows loops. Maybe the problem is related to a new virus or trojan.
Procedure to force a crash dump
1. Run REGEDIT
2. Locate HKEY_LOCAL_MACHINE\SYSTEM\
3. Create a new DWORD value and name it CrashOnCtrlScroll
4. Right-click on this newly created value and click on Modify
5. Enter 1 in the Value data field and click on OK.
6. Close regedit and reboot your system.
7. When the CPU is 100% you hold the right CTRL key and pressing "Scroll Lock" twice. XP will crash and take a dump
8. The bugcheck code is E2.
9. Attach the minidump at the webspace.
Note: Check the dump option to full memory dump instead of minidump. I will examine the minidump as I'm afraid that minidump does not have the information that I want. Although full memory is huge, it is useful as I don't know which process used most of the CPU resources. Maybe I have to examine all the processes in order to find out the culprit.
Before you get the crash dump. Attach the minidump Mini052805-01.dmp and DrWatson log here. Maybe I can find out clues to resolve the problem.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
cpc2004, thanks for your response. I did the registry edit that you mentioned and forced the XP crash and dump. It never asked me for a bugcheck code, though (you mentioned that it's E2).
You mentioned that I should attach these two files "at the webspace," but I'm not sure what webspace you're referring to, so I just put them on my site:
www.AuditLeverage.com/Down
www.AuditLeverage.com/Down
Thanks again for any input that you can provide.
Check the following M$ article:
http://support.microsoft.c
Also make sure you have applied the patches for your antivirus and firewall programs...
I've posted my HijackThis log here in case it is helpful for either this thread or this morning's thread called: "Computer suddenly has slowed to a crawl."
Logfile of HijackThis v1.99.1
Scan saved at 3:31:47 PM, on 7/4/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spools
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\wltrys
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\imapi.
C:\WINDOWS\system32\taskmg
C:\Program Files\Symantec\ACT\act.exe
C:\Documents and Settings\Michael Awad\My Documents\Software\HijackT
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-F
O2 - BHO: CWebToolsBHO Class - {C49A89A1-D366-4151-904C-1
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: Microgarden WebTools - {E929661E-3728-4E52-BCCB-A
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe
O4 - Startup: Norton SystemWorks.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.h
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-0
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O14 - IERESET.INF: START_PAGE_URL=http://ie.r
O16 - DPF: {9B57C630-AA6E-440D-8D44-D
O16 - DPF: {BB8B9052-8D27-45D4-B79F-8
O16 - DPF: {EB387D2F-E27B-4D36-979E-8
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-7
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.ex
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVSvc - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMAN
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (default) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.e
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrys
Your IE isn't uptodate, run windowsupdates.
Then, you are running symantec Antivirus (and internet security), which is know to use a lot of resources, so don't be too surprised with excesive CPU usage.
Thenn I'd disable the following from starting:
AIM (AOL Messenger can be a point of attack and isn't necessary to run allways)
msmsgs (Same as above)
Act (don't know if you allways need that)
iPodService (shouldn't be necessary to allways run)
Then also check the marked items, those "nasty" should be removed, except if you know they are OK, and the unknown is the same.
From your Drwatson log, I find an exception with c0000006 (in page io error) which is the symptom of read error at paging space. You had better define a new paging space and get rid of the old paging space.
Application exception occurred:
App: D:\cdrestore.exe (pid=2188)
When: 6/8/05 @ 13:18:06.281
Exception number: c0000006 (in page io error)
Can you attach the lateset DrWatsion log here?
Thanks very much, cpc2004. Can you tell me how to go about "defining a new paging space and getting rid of the old paging space?" I don't know what that means.
The excerpt that you pasted in from my DrWatson log refers to my D:\ drive (which is my CD-ROM, as you probably guessed) and CDRestore.exe, which is a fairly useless utility that was included on a DVD that I was recently trying to restore my backup data from. All it does is to unzip the files from the DVD to the hard drive (or other location). So I can avoid using it in the future if it causes problems. (The utility isn't actually installed on my c:\.)
I've posted my latest DrWatson log to:
www.AuditLeverage.com/Down
The DrWatson log might not be very useful because there are entries in it between June 8 and June 23. But I know that this problem (CPU usage spiking to 100%) occurred on June 9 (twice), 10, and 14 (twice). So it's not being logged in DrWatson.
Thanks again.
Michael
Right Click "My Computer", select "Properties", then "Advanced", Then "settings" in "Performance Options". Now again the "Advanced" tab, and now "Virtual Memory".
You should now see the drive letters of you HD's and also where the pagefile is located. Select that driveletter, then in the bottom change the option from system controlled to user controlled, and then set both the max and the min size to the same number, preferably 1.5x the size of your ram. Then click on "Set", then reboot. Now you should have created a new pagefile.
Thanks, cpc2004. To answer your question, I'm using Norton AntiVirus 2005, version 11.0.11.4, which came installed with the laptop when I bought it from Microcenter.
(Virus definitions are up to date.)
Rindi, thanks for the tip about changing the pagefile size. I have 512 MB of RAM, so I changed the pagefile size min and max to 768 and 768, respectively. (Before, I think it was 768 and 1536, respectively.)
I'm having several more issues on this same laptop which are probably unrelated to the issue we've been discussing in this thread. If any of you have any insight on these additional issues, please go to the appropriate thread (see below) to answer so that I can award 500 separate points rather than splitting the points for the current thread.
- Whenever I have the "Shell Hardware Detection" service enabled, the computer either won't boot or slows down to a crawl (even though CPU usage was staying below 5%). So I've been doing without this service (since I don't know what it does) and it hasn't happened in the one month since then. See my separate posting at:
www.experts-exchange.com/O
- When I try to burn a CD, it says "There is no disc in the drive," even though I've tried several different CDs. It worked fine a couple of months ago.
www.experts-exchange.com/O
- Error message: "WMI information may be corrupted." (WMI stands for Windows Instrumentation Panel.)
www.experts-exchange.com/O
- When I open Norton AntiVirus 2005 and try to enable auto-protect, it says: "The Norton AntiVirus Auto-Protect Driver could not be loaded. Your system is not protected from viruses. Please restart your computer." Restarting doesn't help.
www.experts-exchange.com/O
Sure, thanks for asking. I'll post the raw text file as well as the more graphical HTML version generated by www.hijackthis.de/index.ph
www.AuditLeverage.com/Down
www.AuditLeverage.com/Down
I'd again try disabling the following. Make sure you are in safe mode and you have system restore disabled. I'd also uninstall NAV and then reinstall it, as it could have been compromissed.
C:\Program Files\AIM\aim.exe ---> Are you sure you need AOL messenger?
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl ---> as above.
C:\WINDOWS\system32\cisvc.
C:\WINDOWS\system32\imapi.
C:\Program Files\Messenger\msmsgs.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cidaem
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
Hi cpc2004 et al -
As suggested, I waited until the next time the CPU usage jumped to 100% and then ran the Microsoft utilities pstat and qslice. The output can be downloaded from:
www.AuditLeverage.com/Down
I've also uploaded a screen print (which you probably don't need) of the output of QSlice, which shows a summary of the same data as pstat, but in graphical form:
www.AuditLeverage.com/Down
In Task Manager, the process that was taking 99% of the CPU was winlogon.exe, which of course it doesn't let me terminate.
Also, as a reminder, the CPU usage always goes from 100% down to less than 5% when I hibernate and then "wake up" the laptop from hibernation. (I have disabled all power management features when the laptop is plugged in.)
Thanks again.
The winlogon.exe spends a lot of CPU time at kernel mode at context switching (ie 56299) which is exception high. I will search google any relating hits at XP.
pid:2a8 pri:13 Hnd: 426 Pf: 7502 Ws: 4508K winlogon.exe
tid pri Ctx Swtch StrtAddr User Time Kernel Time State
2ac 15 1189 0103D353 0:00:00.156 0:00:00.468 Wait:UserRequest
2c0 13 100 7C810856 0:00:00.000 0:00:00.015 Wait:LpcReceive
2c8 13 4 7C810856 0:00:00.000 0:00:00.000 Wait:DelayExecution
2cc 15 224 7C810856 0:00:00.015 0:00:00.000 Wait:EventPairLow
2d0 15 156 7C810856 0:00:00.000 0:00:00.000 Wait:DelayExecution
2dc 13 13 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
304 15 161 7C810856 0:00:00.000 0:00:00.015 Wait:UserRequest
3a4 14 8 7C810856 0:00:00.015 0:00:00.000 Wait:UserRequest
3a8 15 118 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
3ac 13 2 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
478 15 12 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
47c 11 4 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
1c0 15 2 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
1dc 15 56299 7C810856 0:00:00.015 1:18:01.687 Ready
^^^^^^^^^^^
14c 13 7 7C810856 0:00:00.000 0:00:00.000 Wait:LpcReceive
f44 13 3 7C810856 0:00:00.000 0:00:00.000 Wait:LpcReceive
748 15 147 7C810856 0:00:00.000 0:00:00.000 Wait:EventPairLow
pid:2d4 pri: 9 Hnd: 296 Pf: 1409 Ws: 4172K services.exe
I searched google and there have a couple of hits relating to 100% cpu due to a lot of hardware interrupts shown by process explorer from sysinternals. Download process explorer. The installation is easy. Unzip the file and execute procexp.
http://www.sysinternals.co
Run process explorer as it does not use a lot of system resource. When the CPU goes up to 100%, switch the process explorer and check any abnormal behaviour.
After you install process explorer. If the CPU goes to 100%. Switch to process explorer and zoom in winlogin. Click thread and zoom in the thread which use most of the CPU kernel time and I believe that it is last 4th thread. Screen print. Click the "Stack" button and screen print. Attach the 2 screen prints here.
I do the same experient at my XP and my winlogon.exe also has the thread id 676 (ie x'1dc'). I belieive your winlogon.exe should have the same thread id 676 and this thread use a lot of CPU time.
The following are the stack trace of my thread id 676.
Stack trace
ntoskrnl.exe!KiUnexpectedI
ntoskrnl.exe!NtWaitForSing
ntoskrnl.exe!KeReleaseInSt
kernel32.dll!WaitForMultip
kernel32.dll!RegisterWaitF
Thread 676 is waiting for hardware interrupt and it matches with my finding at google.
It will be very useful if you can copy the stack trace of thread 676 when the CPU goes up 100%.
Can you check your BIOS setup and do you enable the PCI IDE bus master option?
http://www.daniweb.com/tec
Many thanks, cpc2004. I have installed Process Explorer and will post the two screen prints you requested the next time the CPU usage goes to 100%.
Also, I checked my BIOS (Phoenix BIOS version F34), and it appears that it does not have a setting for the the PCI IDE bus master option.
One more thing: you said " I believe that it is last 4th thread" that uses the most CPU time. Do you mean the 4th thread, or the last thread, or the 4th-to-last thread? Or do you mean simply that I should choose whichever thread is using the most CPU time?
Thanks again.
Thanks, cpc2004. It happened again, so I captured and uploaded the two screen prints (I combined them into one file) at:
www.AuditLeverage.com/Down
It's very fuzzy in the browser, but if you download the .gif, the picture is quite clear.
In the first screen print (not the stack trace, but the other one), the lower window pane lists lots of items, but only the first six are visible. If you would like to know what all the others are, just let me know. Also let me know whether you would like me to wait until the next time the problem recurs before I scroll down in ProcessExplorer and capture that information for you. Thanks again.
cpc2004, thanks very much for your response and your patience.
So if I understand you correctly, you're saying is two things:
1) Your Aug. 14 message said: "The thread id is 680 and 676. Do you mean that thread 680 use a lot of CPU time?" So I guess you're asking why I sent you the stack info for thread 676 even though thread 680 was the one that was using 99.98% of the CPU. Probably what happened is that when I right-clicked on thread 680 to view the properties and it listed a whole bunch of threads, I just clicked on the Stack button right away without first going to the thread that was using a lot of CPU. I will make sure not to neglect that extra step next time.
2) I should wait until this happens one or two more times, then send you those screen prints as well so that we can see whether it's always the same thread that's using so much CPU.
So I will upload those screen prints when they are ready. Thanks again for all your help - you are a life-saver.
Dear cpc2004,
Here's a screen print of it happening again. Is this the data that you need?
www.AuditLeverage.com/Down
Thanks again.
hi have you checked for the W32.Netsky.D@mm worm see this link http://www.liutilities.com
I find PID 3880 was running which is indexing service. It uses a lot of CPU and memory. Indexing Services is unneccessary and can be removed.
Disable Indexing Services
http://www.tweakxp.com/twe
http://mywebpages.comcast.
To disable it, go to the Control Panel and click Add or Remove Programs. Click the Add/Remove Window Components. Simply untick the Indexing services and click Next!
Refer the following url for potential problem caused by index services
http://support.microsoft.c
Hello again, Martin -
Thanks very much for following up. The answer to your question is no, there's not really any update because I'm not sure what to do next. When I saw the Symantec link that you sent me on 15 October, I ran an online virus scan (McAfee, I think) and came up clean.
Is there any other information that I can provide that would be helpful in determining the cause of the problem?
Thanks again.
This problem is also related to 100% CPU and proces explorer find out the culprit
http://www.experts-exchang
Thanks, cpc2004. I reviewed that posting that you suggested (Q21633577) and disabled both of the menu-related effects described there.
(Control Panel > Display > Appearance tab > Effects > Uncheck "Use the following transition effect for menus and tooltips" and "Show shadows under menus.")
So who knows, maybe that will solve my problem, although I doubt it because MaxAix’s problem was that explorer.exe was using 100% of CPU, but for me it’s winlogon.exe. But I think the reason you sent me the URL for that post is that it’s an example of a case where ProcessExplorer was able to pinpoint the problem.
Your 27-Sept note mentioned that based on the ProcessExplorer screen prints that I sent you, PID 3880 (Indexing Service) was using a lot of CPU and that I should remove it. That has been done, but I’m still having the problem.
So I’m not sure what to do next. The next time the problem occurs, are there any ProcessExplorer screen prints that would be helpful for you beyond the ones that I’ve already uploaded?
Thanks again for all your help – much appreciated.
Thanks very much, cpc2004. In answer to your question, it is not always the same thread that uses a lot of CPU when the CPU jumps to 100% and paralyzes the machine until I hibernate. Following is a somewhat random sample of 5 of the times this has happened during the past few months. (In all 5 cases, winlogon.exe was the offending process using about 99% of the CPU.)
Aug. 8: This was 3 days before I had ever heard of Process Explorer, so I don't know what the offending thread was, but I do have the pstat.txt output from that day at:
www.AuditLeverage.com/Down
Aug. 14: Winlogon was Thread 676, using 99% of CPU. Here's the Process Explorer output:
www.AuditLeverage.com/Down
Sept. 19: Winlogon was Thread 676, using 99% of CPU.
Sept. 26: Winlogon was Thread 676, using 99% of CPU, all of which was CSwitchDelta 2772: !PlaySoundW+0x77f (thread 1724), as you can see in the screen print that you saw at www.AuditLeverage.com/Down
Dec. 9: Winlogon was Thread 772, using 99% of CPU, all of which was !PlaySoundW+0x77f (thread 268).
The CSwitch Delta (which may not be relevant) kept changing: 2851, 2989, 3849, 3101, 3991, then finally 4514.
I will run both Process Explorer and pstat.exe the next time this happens and will post both results here. Thanks again.
CPU went up to 100% again today, so I've uploaded the results of Microsoft's pstat.exe utility:
www.AuditLeverage.com/Down
Once again, hibernating fixed the problem.
When I ran Process Explorer before hibernating, the process that was taking 99% of CPU was winlogon (just as in all previous times) - this time it was thread 772 again. Within that, thread 224 (not 268 or 1724 as in previous times) was taking 99% of the CPU time. However, this time and the previous time times (Sept. 26 and Dec. 9), the guilty "start address" was !PlaySoundW+0x77f.
I did a Google search on !PlaySoundW+0x77f and wasn't able to learn much. Does anybody know what this is and how I can perhaps fix or disable it?
Thanks again.
User Time Kernel Time Ws Faults Commit Pri Hnd Thd Pid Name
0:00:00.625 11:32:05.890 2020 8247 6084 13 448 18 772 winlogon.exe
pid:304 pri:13 Hnd: 448 Pf: 8247 Ws: 2020K winlogon.exe
tid pri Ctx Swtch StrtAddr User Time Kernel Time State
dc 15 6 7C810856 0:00:00.000 0:00:00.000 Wait:UserRequest
e0 15 447528 7C810856 0:00:00.062 11:32:04.875 Ready <----- PlaySoundW+0x77f
ac8 15 3 7C810856 0:00:00.000 0:00:00.000 Wait:EventPairLow
I don't know your sound card driver. If you search google with the keyword blueletaudio.sys and CPU, you will some hits which may be useful to resolve the problem.
aeaudio.sys F8229000 63840 8640 4032 Thu Oct 23 14:17:07 2003
blueletaudio.sys F8A3D000 4992 1920 7168 Mon Oct 18 23:39:23 2004
Your video display driver is recommended to upgrade.
Install nVidia 61.77 and it is a stable display card driver http://www.nvidia.com/obje
nv4_disp.dll BF9D3000 2330144 930272 0 Wed Apr 07 22:51:09 2004
Thanks very much, cpc2004. I feel like we are closing in on the solution now, especially because the 99% CPU thread is always identified with !PlaySoundW+0x77f , which implies that the problem is related to a sound card driver.
I upgraded my video display driver at the URL that you recommended.
Also, I looked in Device Manager in order to answer your question: "Which sound card driver are you using? smwdm.sys or blueletaudio.sys?" You can see in the following screen shot that it appears that I am using both at the same time, which may be the cause of the problem.
www.AuditLeverage.com/Down
You can see on the left that the Device Manager also shows that a few other audio drivers are installed (such as "Legacy Audio Drivers"), so that may be causing a conflict as well.
If you can take a look at that screen shot and let me know what you think I should do next, I would really appreciate it. (Sorry this is taking so much of your time, though.)
Hello, the CPU 100% problem happened again yesterday.
Winlogon was Thread 768 (although I think it was 772 right after the slowdown and then changed to 768 a few minutes later). Within that thread, 99% of the CPU usage was by !PlaySoundW+0x77f (thread 1752).
Comparing that with the data in my 12/16/05 posting above, it's clear that the slowdown is consistently due to Winlogon and !PlaySoundW+0x77f. Does it matter that the thread numbers are not always the same?
Thanks again.
Hi Martin -
Thanks very much for following up. Good news: I uninstalled the smwdm.sys and downloaded a replacement which I was then unable to install. But in the three weeks since I uninstalled the old driver, my sound still works fine and the CPU has never even once gotten back up to 100%. So it appears that the problem is solved! I'll keep this question open just a bit longer just in case.
Thanks again!
Mike
Hi Martin -
I really appreciate your note to follow up. More good news: this problem still hasn't recurred ever since I uninstalled smwdm.sys, so I think you solved my problem for me! Thanks a lot. This question has been assigned the maximum value of 500 ponts, but you've earned about 500,000 points answering it!
There have been several occasions lately when the CPU usage has gone up to 100%, but that just means that the the machine is very slow, not totally incapacitated like it was before. The offending process lately has been IEXPLORE.exe, and the CPU usually (though not always) comes back down once I close the browser. Also, it seems to happen more when I do one or more of the following:
- when I have lots of browser tabs open, using the new tabbed browsing feature of the "MSN Search Toolbar with Windows Desktop Search," which I downloaded from toolbar.msn.com.
- when I am editing the rich-text content of a web page using the open-source content management system DotNetNuke.com
But much more importantly, I also have the following unresolved posts about this laptop which are PROBABLY UNRELATED to this one. I can't decide whether I should do a Windows XP Home repair install to get rid of them.
- "Norton AntiVirus Auto-Protect Driver could not be loaded"
www.experts-exchange.com/O
- Error message: "WMI information might be corrupted"
www.experts-exchange.com/O
- Having the "Shell Hardware Detection" service enabled causes the computer to slow down or to be unable to boot (even though CPU usage stays below 5%).
www.experts-exchange.com/O
This Shell Hardware Detection problem does not cause me any inconvenience, since I never use it, but it makes me wonder whether it is yet another sign that something is fundamentally wrong with this Windows install. I'm almost certain that it's not a hardware problem because (as I noted at the very beginning of the post you're reading now) the EXACT same problem happened with an identical model of laptop purchased from Microcenter that same month. So either it's a problem with the way the manufacturer installed Windows XP Home, or (more likely) there is some incompatibility being caused by the unique combination of software that I installed.
In your opinion, as you look at those first two problems ("WMI information might be corrupted" and especially the "Norton Anti-Virus Auto-Protect Driver could not be loaded," since I have to admit that I have been without any virus protection for months now), do you think they're fixable? Or should I do a Windows repair install? Are there any risks to doing a repair install? Will all my othere installed software be unaffected?
Once again, thanks so much.
Michael
If you have an answer for my question above, then please answer it not in this thread but rather in a separate one that I have created, which is at:
www.experts-exchange.com/O
I made that one worth another 500 points, since it is really a separate issue from the one raised in this thread, and this one has already been resolved by cpc2004. Many thanks.
Business Accounts
Answer for Membership
by: rindiPosted on 2005-06-05 at 10:40:07ID: 14149176
Having many apps open may be a reason for this. How about adding more RAM? Something else that may help is to delete temporary files, empty the recycle bin, then run a defrag. After that set your pagefile to a fixed size (Right Click "My Computer", "Properties", "Advanced", Performance section "Settings", "Advanced", "Change" Button, now select "Custom Size" and enter the same value in both the initial size and the max size. I recommend testing different values, until you are most satisfied with the performance and the stability. If the pagefile is too small, you will run out of memory if a lot is open, if it is too large, it'll do too much swapping to disk, slowing the system down.