PPRuNe Forums

Go Back   PPRuNe Forums > Supplementary Forums > Computer/Internet Issues & Troubleshooting
Forgotten your Username/Password?
Register FAQ Calendar Advertise Mark Forums Read

Computer/Internet Issues & Troubleshooting Anyone with questions about the terribly complex world of computers or the internet should try here. We will also try and help with troubleshooting any technical problems you may have with the forums.


Reply
 
Thread Tools Display Modes
Old 9th July 2009, 12:53   #1 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
CPU running at 100%

I have an HP Pavilion (just 4 months old) operating in the living room (where the cable/ADSL delivery point is) as a very lightly loaded server to a small (3 laptops) home office network (mixed wifi and LAN).

'Server' is an exaggeration of its actual role as the server functionality is limited to a couple of very small shared database applications (individual company mortgage and insurance application software), a platform for a couple of shared programmes such as Quark which we open/run from the workstations plus back-up duties.

I have not yet even loaded the planned SAGE accounting system.

It uses the PC as a monitor (the little it is needed) and I had thoughts of recording TV programmes on it (and DVD movies) but have not got round to it

With 3GB RAM and a reasonably high spec dual core Intel processor (can't find the spec at the moment) it should make easy work of this and until recently has.

However it was accidentally turned off at the power switch recently and ever since it was recovered (safe mode etc) it has been painfully slow and indicating 100% CPU usage constantly.

I have run Regtool, Defrag etc (a bloody slow process), used a goback/restore to a date before the 'switch off' and everything is indicating healthy but still running like a snail.

Any ideas ?
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 13:02   #2 (permalink)
More bang for your buck
 
Join Date: Nov 2005
Location: land of the clanger
Age: 67
Posts: 1,767
Download Process Explorer from: Windows Sysinternals: Documentation, downloads and additional resources
and that should tell you which program is being the hog, once you know that then you can deal with it.
green granite is online now   Reply
Old 9th July 2009, 13:02   #3 (permalink)
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 10,710
ASSUMING we are talkng WINDOWS? XP? ????

Task Manager - processes, click on CPU column to get highest useage at the top and....................?
BOAC is offline   Reply
Old 9th July 2009, 13:12   #4 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
Thanks for those guys - Vista by the way
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 13:28   #5 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
Have opened Task Manager (after a long wait) - and the mystery deepens.

Up to a maximum of 6 processes taking CPU capacity (but none of them showing more tha 01, 02, 03, 04, 05 or 06 (absolute maximum - and then only briefly) which I believe is %age per process. Therefore never more than 10% being used by active processes.

However the bottom bar shows a steady 100% usage for CPU - which reflects what I am seeing in the Google Toolbar monitor.

Another possible clue - lost the use of wireless mouse and keyboard in the 'accidental switch off'. Using wired devices until i can get it operating normal to investigate this.

About to try an earlier go-back/restore.

Last edited by Senior Paper Monitor : 9th July 2009 at 13:44.
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 13:45   #6 (permalink)
 
Join Date: Jun 2009
Location: York
Posts: 19
Try disconnecting the HP from its router and see if the CPU usage goes down. There is a possibility that there is an external source accessing your HP.
geoff1248 is offline   Reply
Old 9th July 2009, 14:03   #7 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
Just tried it Geoff (thanks) - no change
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 14:16   #8 (permalink)
 
Join Date: Feb 2008
Location: UK
Posts: 25
Make sure Task Manager is showing Kernel time as well as User time. (View menu, Show Kernel Times). If a kernel component is consuming the power, then it won't necessarily show up in the 'green' of User time. If it's mostly kernel, that's indicative of graphics, disk activity or memory activity (big simplification), and could indicate a problem with a device driver. Sorting the task manager columns by 'CPU time' might show more info, since the cumulative totals will be grouped together.

I'm not familiar with Vista, but in XP I'd next try Device Manager (in XP, it's right-click 'My Computer' select Manage then Device Manager). Look for any yellow question marks. Try right-clicking in DM & 'Scan for Hardware Changes' & see if your missing wireless etc. is re-detected. If it were me & if there was 'yellow' hardware, I'd probably use DM to remove it & then ask DM to rescan, hoping that it would correctly pick it up. However I'd be wary of advising someone else to follow my advice unseen, in case it made things worse! Perhaps best to create a Restore Point before you try any of these.

You could also look in event manager (eventmgr.exe from start/run) and see if there's anything odd there.
Tim00 is offline   Reply
Old 9th July 2009, 14:27   #9 (permalink)

PPRuNe Spoonerist
Moderator
 
Join Date: Sep 2003
Location: Twickenham
Posts: 4,175
I would strongly second green granite's suggestion to download Process Explorer - it shows a great deal that the ordinary Task Manager does not.

Check your IDE controller in device manager to ensure that it hasn't fallen back to PIO mode instead of DMA.

SD
__________________
You can't have everything - where would you put it?
Saab Dastard is offline   Reply
Old 9th July 2009, 15:05   #10 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
Thanks for the extra suggestions - am off to try these - back in an hour I guess (one way or another)
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 15:56   #11 (permalink)
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 10,710
If no luck, look at Svchost.exe Using 100% CPU Resources in Vista – Identify Causing Services My Digital Life
BOAC is offline   Reply
Old 9th July 2009, 17:31   #12 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
More help/advice need I am afraid.

Couldn't locate sysinternals etc, but followed the excellent article linked by BOAC.

Found one svchost activity using considerably more RAM than any other (48,824K - over twice as much as any otehrs) but virtually no CPU activity (despite displaying 'all users').

Under 'Services' the process listed:

wudfsvc (Windows Driver Foundation - user mode Driver Framework)

WPDBusEnum (Portable Device Enumerator Service)

Wlansvc (Wlan Autoconfig)

WdiSystem (Diagnostic System Host)

UxSms (Desktop Window Manager Session Manager)

TrkWks (Distributed Link Tracking Client)

Tablet Input (Tablet PC Input Service)

Sysmain (Superfetch)

Pca Svc (Program Compatability Assistant Service)

Netman (Network Connections)

Hidserv (Human Interface Device Access)

EMDMgmt (Readyboost)

Audio Endpoint (Windows Audio Endpoint Builder)

All above show: PID1116 Running LocalSystemNetworkRestricted

Frankly mneans little to me - am moving well out of my comfort zone.

Any more ideas ?
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 18:17   #13 (permalink)
More bang for your buck
 
Join Date: Nov 2005
Location: land of the clanger
Age: 67
Posts: 1,767
Try this link for process explorer: Process Explorer
green granite is online now   Reply
Old 9th July 2009, 19:01   #14 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
Right Mr GG - have got the Process Explorer running on the machine - it clearly shows interrupts, SVChost and a couple of other processes taking the odd percent here and there but the total balance of 100% being absorbed by 'System' on PID4.

Any suggestions what I am supposed to do now ?
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 19:22   #15 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
More Info ....

Highlight 'System' and select 'Properties' / 'Threads' are there are a number of threads listed with the same 'start address'.... ntkmlpa.exe!KeQuerySystemTime+DX50

The first four of these (and occasionally the fifth) are showing high values under CPU (totalling well over 90% all the time) and CSwitchDelta.

I suspect that this is the source of the problem - but have no idea what to do now.
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 19:28   #16 (permalink)
 
Join Date: Jan 2009
Location: Oxford
Posts: 29
That should be ntkrnlpa ( i.e r & n not an m) ...

Some Googling gives ...

Description

ntkrnlpa.exe is a process associated with Microsoft® Windows® Operating System from Microsoft Corporation.\r
Click to run a free scan for ntkrnlpa.exe related errors.


Recommendation

Not a critical component, but see the information above before disabling it. It is highly recommended to Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings..
Senior Paper Monitor is offline   Reply
Old 9th July 2009, 19:39   #17 (permalink)

PPRuNe Spoonerist
Moderator
 
Join Date: Sep 2003
Location: Twickenham
Posts: 4,175
If one of the core OS files is causing problems following an unexpected power outage, I would suspect corruptions that won't be easy to eliminate.

I suggest attempting a repair, and if that doesn't work, a re-installation.

See here for details of how to do a repair install for Vista.

You will need to BACKUP ALL YOUR DATA, SETTINGS, CONFIGURATION DETAILS FIRST!!!!!!

If you don't have an installation DVD, try restoring (destructive) from the restore / recovery partition (see your PC Manual).

SD
__________________
You can't have everything - where would you put it?
Saab Dastard is offline   Reply
Old 9th July 2009, 19:59   #18 (permalink)
 
Join Date: Feb 2008
Location: UK
Posts: 25
Quote:
It is highly recommended to Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings..
My opinion, but whatever you do, do not install any software that offers to scan.
I'd still guess a device driver problem, a hardware problem, or malware. Try redetecting your hardware.
Tim00 is offline   Reply
Old 9th July 2009, 20:31   #19 (permalink)
More bang for your buck
 
Join Date: Nov 2005
Location: land of the clanger
Age: 67
Posts: 1,767
Try downloading this 'hot fix' from MS: Performance is slow on a multiprocessor computer that is running Windows Server 2008 or Windows Vista

I'm not saying it will work but it will update ntkrnlpa.exe

Other than that, what Saab says.
green granite is online now   Reply
Old 9th July 2009, 21:02   #20 (permalink)
 
Join Date: Jan 2008
Location: Bracknell, Berks, UK
Age: 38
Posts: 174
It sounds very much to me like the modus operandi of malware (especially since being initiated from a fresh boot).

Google for "superantispyware" and "malwarebytes antimalware", and scan the PC with each of those. You may find that the malware has been written to intercept the running of these though, but at least it should give an indication of the program not running properly (e.g. exiting immediately or not being able to start), which would further reinforce my hunch. Anyway, some ways around that are to rename the executable, and to boot in safe mode with command prompt (which doesn't execute any svchost processes usually), then run the program from the command prompt (not via explorer), and scan that way (remembering to update the package with the latest updates first).

Anyway, see how you go and report back?
Mike-Bracknell is offline   Reply
Reply
 


Thread Tools
Display Modes


Posting Rules
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


All times are GMT +1. The time now is 15:11.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0 RC7
© 1996-2009 The Professional Pilots Rumour Network

As these are anonymous forums the origins of the contributions may be opposite to what may be apparent. In fact the press may use it, or the unscrupulous, or sciolists*, to elicit certain reactions.

*"sciolist"... Noun, archaic. "a person who pretends to be knowledgeable and well informed".