# [SOLVED] High CPU usage after resuming from SLEEP



## baryoakley

I run Win7 Ultimate on a new (1 month old) 3GB laptop. It has a good wireless connection to my router. Everything works just fine, until I put the laptop into sleep mode.

When I wake it up it takes around 3 - 4 minutes before I can use the internet. I ran Process explorer and found that svchost (network services) was taking 100% of the CPU during this time. On my machine this svchost is running CryptSvc, Dnscache, LanmanWorkstation & NlaSvc.

Any idea what is happening, and what I can do about it?


----------



## jcgriff2

*Re: High CPU usage after resuming from SLEEP*

Do you have an Internet Security product installed, e.g., NIS, N360, KIS, MIS, etc...?


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Yes - AVG Free 9.0 - I use the MS Firewall.


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

I did some more investigating tonight with Resource Monitor - the results are strange (to me at least). First nlasvc tookm 98%, followed by a period when lanmanworkstion took 98%, followed by a period when dnscache took 97%, followed again by nlasvc, then by dnscache and finally plugplay from a different instance of svchost. After that everything quietened down, and I was back to normal!


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Well - nobody seems to have any ideas it seems! If it helps, I have now found that this happens after Hibernate, and even when I unplug the power supply!! It seems to be something to do with moving from one state to another!


----------



## paulspignon

*Re: High CPU usage after resuming from SLEEP*

I have exactly the same problem as baryoakley,Win 7 Professional 64-bit, AVG Free, always latest update, MS firewall. The net result is that Hibernate is a useless feature - it takes so long to get working again you may as well shut down, and try to remember what you were doing before. jcgriff's posting wasn't any help - no follow up. This was February. How about some support Microsoft?


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Glad I'm not alone - in case someone pops up and suggests AVG is at fault, I am now running MS Security essentials (having first un-installed AVG), and this problem is still happening. 

Another change from Paul - my system is running Win7 32bit.


----------



## jenae

*Re: High CPU usage after resuming from SLEEP*

Hi, on Vista and Seven sleep\hibernate is active by default, (laptops) so instead of the system state being held in physical memory it is held on the HDD in the Hiberfil.sys folder. This folder can corrupt and results in what you see, to fix:-

Go to start ,all programs, accessories and right click on command prompt select "run as administrator" at the prompt Type:-



Code:


powercfg /hibernate off

Press enter
Restart your computer.

Next repeat the procedure this time type:-



Code:


powercfg /hibernate on

Press enter

Windows will rebuild the Hiberfil.sys folder and you should be OK.
Do not forget to reset your preferred power options.


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Thanks for the response. I have done exactly as you suggest - rebooting after each stage, but regrettably nothing has changed. Note that I do not use 'Hibernate' only 'Sleep'. It took around 3 minutes after coming back from sleep for the CPU usage to return to normal levels. As before it was the DNSCACHE, NLASVC etc that took all the cycles.


----------



## paulspignon

*Re: High CPU usage after resuming from SLEEP*

Unfortunately that procedure (powercfg ...) doesn't help in my case either. I did it twice, but have still seen the long period of 100% CPU usage after resume on several occasions. As noted, in my case it doesn't happen every time, but often enough to be a real pain.


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

In my case it happens everytime I come back from 'sleep'!! I have all the available MS updates, and there is no Virus or trojan on my system (and 'Yes' I do know what I'm talking about!). My AV is MS Security Essentials, the Firewall is the MS built in one.


----------



## jcgriff2

*Re: High CPU usage after resuming from SLEEP*

Did the laptop come with a trial version of Norton, McAfee, etc... that you selected not to install?


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Yes, Norton - however I removed it with the Norton Removal Tool. There is no vestige of it left.


----------



## jcgriff2

*Re: High CPU usage after resuming from SLEEP*

The *scvhost * you mentioned contains system services related to Networking.

As a test, turn wifi off or disconnect Ethernet, whichever is applicable; put system to sleep; wake it up.

How is CPU usage upon wakeup without network connection?


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Ok - here are the results:

Turn off WiFi - 100%CPU for 1 min.
Sleep
2 min wait
Wake - 100%CPU for 2 mins.
Turn on WiFi - 100%CPU for 2 mins.

Each period of 100%CPU involved the same proceses (DNSCACHE, NLASVC etc.)


----------



## jcgriff2

*Re: High CPU usage after resuming from SLEEP*

Let me obtain system info; maybe it will yield a clue.

Please run --> http://www.techsupportforum.com/f217/blue-screen-of-death-bsod-posting-instructions-452654.html

Regards. . .

jcgriff2

`


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

Here is the folder:


----------



## jcgriff2

*Re: High CPU usage after resuming from SLEEP*

Hi - 

The logs show the system resuming from sleep followed by those system services you mentioned hanging -


Code:


[FONT=lucida console]Event[974]:[/FONT]
[FONT=lucida console]Log Name: System[/FONT]
[FONT=lucida console]Source: Microsoft-Windows-Power-Troubleshooter[/FONT]
[FONT=lucida console]Date: 2010-11-13T18:17:00.701[/FONT]
[FONT=lucida console]Description: [/FONT]
[FONT=lucida console][COLOR=red]The system has resumed from sleep.[/COLOR][/FONT]




Code:


[FONT=lucida console]Event[968]:[/FONT]
[FONT=lucida console]Log Name: System[/FONT]
[FONT=lucida console]Source: Service Control Manager[/FONT]
[FONT=lucida console]Date: 2010-11-13T18:18:10.422[/FONT]
[FONT=lucida console]Description: [/FONT]
[FONT=lucida console][COLOR=red]A timeout (30000 milliseconds) was reached while waiting [/COLOR][/FONT]
[FONT=lucida console][COLOR=red] for a transaction response from the LanmanWorkstation service.[/COLOR][/FONT]
 
[FONT=lucida console]Event[969]:[/FONT]
[FONT=lucida console]Log Name: System[/FONT]
[FONT=lucida console]Source: Service Control Manager[/FONT]
[FONT=lucida console]Date: 2010-11-13T18:18:09.876[/FONT]
[FONT=lucida console]Level: Error[/FONT]
[FONT=lucida console]Computer: Barry7-Lap[/FONT]
[FONT=lucida console]Description: [/FONT]
[FONT=lucida console][COLOR=red]A timeout (30000 milliseconds) was reached while waiting [/COLOR][/FONT]
[FONT=lucida console][COLOR=red] for a transaction response from the wscsvc service.[/COLOR][/FONT]
 
 
[FONT=lucida console]Event[971]:[/FONT]
[FONT=lucida console]Log Name: System[/FONT]
[FONT=lucida console]Source: Service Control Manager[/FONT]
[FONT=lucida console]Date: 2010-11-13T18:17:28.842[/FONT]
[FONT=lucida console]Level: Error[/FONT]
[FONT=lucida console]Description: [/FONT]
[FONT=lucida console][COLOR=red]A timeout (30000 milliseconds) was reached while waiting [/COLOR][/FONT]
[FONT=lucida console][COLOR=red] for a transaction response from the Dnscache service.[/COLOR][/FONT]

30000 ms = 30 seconds

Do you have AVG Internet Security with the AVG firerwall?

If so, remove it - [URL="http://jcgriff2.com/A-V_Removal_Tools/AVG_Removal.html"][URL="http://jcgriff2.com/A-V_Removal_Tools/AVG_Removal.html"][url]http://jcgriff2.com/A-V_Removal_Tools/AVG_Removal.html[/URL]


I see > 30,000 entries in your HOSTS file. It is possible that one or more of those entries may play a role here.

Reset the HOSTS file - [url]http://support.microsoft.com/kb/972034/EN-US[/URL]

I know the entries are from the MVPS HOSTS file, which you can easily restore if HOSTS file turns out not to be involved.

Regards. . .

jcgriff2

`[/URL][/URL]


----------



## paulspignon

*Re: High CPU usage after resuming from SLEEP*

Since the second repair of the hibernate file I have not had any occurrences of the "100% CPU load after resume" phenomenon, so nothing more to contribute at this time. If it recurs I'll post something.


----------



## baryoakley

*Re: High CPU usage after resuming from SLEEP*

I first copied my HOSTS file, and then ran the Fixit in the reset HOSTS file link above. It requested that I re-boot, and on doing so I got a notification that the recycle bin was corrupt! I allowed the system to reset it, and inspected what it had done in the .....\etc directory. All that had happened was that the HOSTS filem had been deleted - but not re-created. I put the system to sleep woke it and no delay!!! 

I renamed the copy made earlier to HOSTS - sleep - wake - 3 minute delay!!!

I renamed it back to "HOSTS - Copy" - sleep - wake - no delay!!!

So I now have no HOSTS file, and all seems well!!

I cannot explain it - any thoughts? Does the MVPS file need some attention centrally?


----------



## jcgriff2

*Re: High CPU usage after resuming from SLEEP*

Hi - 

I suspected the HOSTS file may be involved after looking in the Event Viewer logs. My thinking was that the system service timeouts were being caused by a possible loop created by one or more of your start-up apps trying to "phone home" and being referred back to 127.0.0.1 and repeating this cycle until the 30000 ms timeout occurred.

Just a theory, but I have seen other various issues caused by the MVPS HOSTS file as well.

This is the default HOSTS file - 


Code:


[FONT=Lucida Console]
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1       localhost
::1             localhost
[/FONT]

It is also interesting that the Microsoft Fix-It did not replace the HOSTS file with the above default file. 

I'm glad the 3 minute "wake-up" is now resolved for you.

Enjoy Windows 7!

Regards. . .

jcgriff2

`


----------

