Odd increase in CPU

Running Vista Business (x64) on a Lenovo T500. For some time now I've had a problem that I'm unable to troubleshoot because a process or service or something is running without appearing on Task Manger or PerfMon.

The computer runs, after a reboot or after awakening from sleep (!) at very low CPU. With the expected spikes, but almost immediately back down to between 2 and 15% CPU, maybe 30% if I've got 5 programs running. (I'm using PerfMon to measure this.) I can run a variety of programs, including word processors, browsers, etc., for a while, generally half an hour or so, but inevitably it suddenly starts running above 50% CPU. When I look at the PerfMon list the offending program isn't listed on the CPU list and the sum of the CPU's that are listed is generally below 10%. In other words, something is using CPU that isn't listed. Task Manager doesn't list it either.

An odd aspect of this is that if, after the CPU starts running high, I hit the sleep button and immediately resume from sleep it's gone! Back to very low CPU, even if multiple programs are left open when I sleep and resume. Weird, huh?

1) Does this "high CPU user disappears with sleep/resume" ring a bell with someone? What CPU hog would get turned off (although only temporarily) with sleep?

2) Is there another CPU use list that would show processes/services, etc. that don't show in the lists of Task Manager or PerfMon?

I've tried logging with PerfMon to compare both states, but the answer can't be found. Any suggestions to this difficult problem would be appreciated.

Welcome we should be able to resolve this
First run a full anti virus scan
the
Run a full updated scan with malwarebytes. If positive thats your answer
If negative
Try a clean boot to diagnose.
http://support.microsoft.com/kb/929135
If these results are negative try a memory test.
http://www.geekstogo.com/forum/topic/246994-guide-to-using-memtest86/
If negative try in safe mode and see if problem persists.

In task manager make sure that you tick, lower left, show process from all users.

Did you check "Show processes for all users" in Taskmanager. It is the button on the bottom left. If not, you are only seeing half of the story.

Now it's a hardware interrupt problem

Still having the problem, but some updates. And one important comment regarding troubleshooting CPU increases.

Thanks, Rich, for all your suggestions, but none of them turned out to reveal the culprit. I checked my memory with the Windows memory checking device and (it does a double check) everything was normal. I ran Norton and Malwarebytes screens for viruses & malware and only found tracking cookies. The "clean boot diagnosis" is REALLY hard to do on an intermittent problem. I have to web surf at the minimum a few minutes before the problem shows up, and it can take half an hour. I spent a couple of days convincing myself that none of those non-windows services were the problem. I did leave a couple of them off since a closer look revealed that I never needed them. It's remarkable how much Lenovo and the installation of software over time can set up services to run all the time for nothing.

The biggest step in learning more about what the problem was was running Process Explorer. This was the answer to my question "Is there another CPU use list that would show processes/services, etc. that don't show in the lists of Task Manager or PerfMon?" Yes, clicking "Show processes from all users" in Task Manager shows all the processes running. But neither Task Manager or PerfMon showed the one thing that Process Explorer showed. "Hardware interrupts" - whatever that will end up meaning - were consuming about half the CPU activity, even with all "processes" turned off.

So now I have a hardware problem, although I keep seeing (on troubleshooting sites that address the hardware interrupts problem) that it's "probably a driver." But there's very little wisdom about how to pinpoint, or even narrow down, which driver needs updating or which hardware is working for a while then beginning to cause the interrupts.

What approach would you use to find it?

The built in memory check is unreliable, use the memory test that I suggested. If you pass we know its not memory.

Hello!

You have hit the nail on the head with DPCs and Interrupts.

Do you happen to have a recent version of the Windows SDK on your machine, because the discontinued KernRate --> Windows Performance Analysis Toolkit, which is contained in the Windows SDK. They are not easy to use though...

Also, do you have much experience with ETW or Process Monitor?

Thanks a lot!

Richard

A DPC latency problem is most likely caused by a bad driver. Run this program to find out the details: DPC Latency Checker

I checked my memory with MemTest. This isn't the easiest thing to do, but according to richc46 it's definitive, or, at least, better than other ways. No errors, "Passed" after Test #8 - no apparent problem with the memory chips.

I also took the advice of whs - I'm running out of things to do to figure out this problem and I just don't know enough about these machines to figure out this odd increase in CPU rate. I ran dplat.exe and went thru the diagnostic procedure, but no answer to identify the CPU hog.

So here it is, boiled down for the hardware/hardware driver problem solver:

1) It's happening on a Lenovo T500 laptop running Vista, but, really, I haven't had any problem with Vista until now. This problem isn't likely to have anything to do with the Vista OS - Process Explorer says it's "hardware interrupts." Hardware interrupts are hardware related, or, (supposedly as often as not) driver problems. The trick is figuring out which device is doing the interrupts. That's what I'm trying to do here, find which device is intermittently no good or has a bad driver...

2) After a restart or cold boot the CPU use is very low, as expected. It takes 15 minutes to 1 or 2 hours before the problem appears: then CPU runs high, varying at between 33 and 75% for no apparent reason, even if my taskbar is empty. Even if I start my machine and don't open a browser or do anything, after long enough, there is a change to this high CPU usage. Task Manager and PerfMon find the high CPU usage but the CPU user is not on their lists. (If the CPU usage on either of these two is added up it's about 50% below the real total.) The remainder is the "hardware interrupts" only found by Process Explorer - in the 40 to 60% bracket. But what is the CPU hog? No indication other than that.

3) Here's an amazing part - after it starts, I can use the laptop's sleep function and 20 seconds later the computer is "asleep" and about 30 seconds later I've resumed and my desktop is open. The CPU rate is back down to a few percent! Until 15 or 60 minutes later (similar to a cold boot), then the CPU rate is back up to varying between 33 & 75%. Whatever the cause, the sleep function turns off the interrupts! This might mean something to someone that knows how computers work.

Ruled out as causes: very unlikely to be viruses or malware (negative Norton + Malwarebytes screen); memory chips are OK based on the MemTest boot disk test (you have to burn a disc, reboot, and wait half an hour for the test to complete - passed, no errors) as well as the Vista Memory Diagnostic Tool; non-Windows services ruled out based on a 'clean boot' with stopping all these services - it still occurs. I also did the DP Latency checker latency test. But you don't exactly (as suggested by whs above, "run the program to find out the details." You have to manually turn off devices in Device Manager, one at a time (!) to see if the dplat DPC's stop (DPCs shown on a real time chart). I have a long list of devices that I turned off without stopping the high CPU use - everything I could disable without a restart or without disabling the use of the computer.

So that's it. I'm stumped. Any brilliant ideas? Is there a hardware forum that might address this type of problem? Thanks for any input, and many thanks for all the suggestions so far.

Have you looked for a root kit? Another virus but runs under windows and not easily detected.

Have you done reinstall?

Seems like I've found the solution. It has to have been a bad (for some reason - it worked without any problem for a long time) video card driver. I updated my dual card driver (through the ATI site - it didn't work just to "update driver" in Control Panel, I had to manually save the driver, extract it, and update both cards with the update program on the hard drive.) Anyway, it seems to have worked - no longer have the hardware interrupts. The machine seems to work better than ever. Oddly, there was a glitch with two igfxprs running after I did the update - and one of them being a CPU hog. At that point disabling a startup igfxpers seems to have worked.

When these glitches happen they are really time consuming! This one in particular didn't resolve with any quicky solution. The key was using a CPU rate reader that included everything (i.e. included hardware interrupts and DPCs). After that it was relentlessly trying to understand it. The answers from the experts didn't hurt anything, but it was still hacking at it myself that solved it. Nice having a fast computer!

Thanks to all that lent a hand!

Ben

You could have fixed that 5 days ago if you had run the latency checker.

@whs - As noted already above, I ran dplat.exe and went thru the diagnostic procedure, but no answer to identify the CPU hog. And as I also noted above, the DP latency checker doesn't just tell you what the problem is - it's a 'disable one device at a time' method. The offending driver didn't appear on the list of disableable devices. And frankly, a better method, if you are going to use a 'disable one device at a time' method would be to just look at Process Monitor's hardware interrupts CPU use rate. The DP latency checker shows a real time chart that's not nearly as black and white.