svchost 100% CPU and Possible windows update problems
Jesson@discussions.microsoft.com Russell Jesson
Manager svchost.exe was using a 100% CPU. Using system internals process
explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
Tapisrv and Termservice.
Looking inside the thread that is using the CPU is ntdll.dll
I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
booted in safe mode and cleared all the softwaredistribution folder. The slow
running does not affect safe mode but as the service is not started no great
surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.
I tried to update AVG virus checker but it wanted KB929547 applied so I
downloaded it and tried to run but after several hours all I got was install
failed with 0x800706bb
Any ideas??
Stephen Caudill
svchost.exe that was spiking the CPU. Did some trial and error with
services and couldn't nail it down. It lasted about 2 weeks
(intermittently) and has now not reared its ugly head for a couple of
weeks now.
I think I read somewhere that it was a conflict with the virus app? I'm
using eTrust. Not sure, but possibly an update fixed it? Good luck!
-scaudill
Russell Jesson wrote:
> Vista Basic Machine started running very slowly and when I looked in Task
> Manager svchost.exe was using a 100% CPU. Using system internals process
> explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
> Tapisrv and Termservice.
>
> Looking inside the thread that is using the CPU is ntdll.dll
>
> I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
Russell Jesson
some progress as if I look at the Process explorer properties for svchost the
thread it reports is ntdll.dll!RtlUserThreadStart and suspending this makes
the machine usable. So I’ve been trying various things to no effect to help
the problem.
The AVG8 scan finds nothing.
Currently uninstalling Windows Live xxxx as there are reports, all be it old
ones, that this can cause problems and I’m also in the process of getting the
flashplayer update as this was also mentioned.
However even with the CPU down very low (with thread suspended) the Windows
Installer crawls along, well uninstalling in this case.
I’ll keep looking and report back on findings.
AJR
Scroll down for Mark's post on solving CPU spikces.
"Russell Jesson" <Russell Jes...@discussions.microsoft.com> wrote in message
news:65C38F6B-2BFD-4874...@microsoft.com...
propman
> take a look at http://blogs.technet.com/markrussinovich/rss.xml
>
> Scroll down for Mark's post on solving CPU spikces.
>
>
Thanks for posting the link....haven't had the time to do an in depth
read but it's a topic I've been meaning to explore and so am sure the
information will come in real handy.... :-)
Russell Jesson
The sysinternals process explorer has shown it’s a single thread causing the
problem and it’s identified as ntdll.dll!RtlUserThreadStart Killing this
thread fixes the problem but it returns on a reboot or possibly restart of
the service(s) I’ve only tried cryptsvc so far but that causes the problem to
reoccur.
Tried the Kernrate as suggested and it is showing ntkrnlpa with fltmgr
second but the first it 80% the second was 4%.
Looking at the stack information from process explorer I see top of the list
ntkrnlpa.exe!KiUnexpectedInterrupt+0x40
Also I’ve updated all the drivers on the system and anything else I can
think of with no effect.
Mikey2OZ
Post Originated from http://www.VistaForums.com Vista Support Forums
Russell Jesson
The only way of fixing it was to do a total re-install of Vista. Once that
was done and all the updates applied and applications re-installed the
machine runs without problems.
Obviously there was some sort of corruption somewhere but there was no
malware detected anywhere on the system. The only two items that may be
related was there were some dodgy MP3 played which may have automatically
downloaded a codec containing malware. Also the system was reporting traced
of having Norton installed and to my knowledge it had never been near the
system.
Jason
Sean Baltzar
Hi dudes.
Im realy not anything near a pro or anything when it comes to computers but i have solved the problem with the "ntdll dll RtlUserThreadStart" thingy. I unistalled the printer it was a hp deskjet something.
Best regards Sean
Oooh, i just noticed this is an realy old thread :(. Hope someone that need some help with svchost going bonkers notice this post.
> On Wednesday, May 21, 2008 7:57 AM Russell Jesso wrote:
> Vista Basic Machine started running very slowly and when I looked in Task
> Manager svchost.exe was using a 100% CPU. Using system internals process
> explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
> Tapisrv and Termservice.
>
> Looking inside the thread that is using the CPU is ntdll.dll
>
> I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
> booted in safe mode and cleared all the softwaredistribution folder. The slow
> running does not affect safe mode but as the service is not started no great
> surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.
>
> I tried to update AVG virus checker but it wanted KB929547 applied so I
> downloaded it and tried to run but after several hours all I got was install
> failed with 0x800706bb
>
> Any ideas??
>> On Wednesday, May 21, 2008 10:23 AM Stephen Caudill wrote:
>> For what it's worth, I had the same problem about a month ago. It was
>> svchost.exe that was spiking the CPU. Did some trial and error with
>> services and couldn't nail it down. It lasted about 2 weeks
>> (intermittently) and has now not reared its ugly head for a couple of
>> weeks now.
>>
>> I think I read somewhere that it was a conflict with the virus app? I'm
>> using eTrust. Not sure, but possibly an update fixed it? Good luck!
>> -scaudill
>>
>>
>>
>> Russell Jesson wrote:
>>> On Wednesday, May 21, 2008 10:47 AM RussellJesso wrote:
>>> I just swapped from AVG7.5 to 8.0 and problem is still there However making
>>> some progress as if I look at the Process explorer properties for svchost the
>>> thread it reports is ntdll.dll!RtlUserThreadStart and suspending this makes
>>> the machine usable. So I’ve been trying various things to no effect to help
>>> the problem.
>>>
>>> The AVG8 scan finds nothing.
>>>
>>> Currently uninstalling Windows Live xxxx as there are reports, all be it old
>>> ones, that this can cause problems and I’m also in the process of getting the
>>> flashplayer update as this was also mentioned.
>>>
>>> However even with the CPU down very low (with thread suspended) the Windows
>>> Installer crawls along, well uninstalling in this case.
>>> I’ll keep looking and report back on findings.
>>>
>>>
>>> "Stephen Caudill" wrote:
>>>> On Wednesday, May 21, 2008 6:24 PM AJR wrote:
>>>> take a look at http://blogs.technet.com/markrussinovich/rss.xml
>>>>
>>>> Scroll down for Mark's post on solving CPU spikces.
>>>>> On Wednesday, May 21, 2008 8:02 PM propman wrote:
>>>>> AJR wrote:
>>>>>
>>>>> Thanks for posting the link....have not had the time to do an in depth
>>>>> read but it is a topic I have been meaning to explore and so am sure the
>>>>> information will come in real handy.... :-)
>>>>>> On Thursday, May 22, 2008 5:02 AM RussellJesso wrote:
>>>>>> Thanks for the suggestions no solution yet but more information.
>>>>>>
>>>>>> The sysinternals process explorer has shown it’s a single thread causing the
>>>>>> problem and it’s identified as ntdll.dll!RtlUserThreadStart Killing this
>>>>>> thread fixes the problem but it returns on a reboot or possibly restart of
>>>>>> the service(s) I’ve only tried cryptsvc so far but that causes the problem to
>>>>>> reoccur.
>>>>>>
>>>>>> Tried the Kernrate as suggested and it is showing ntkrnlpa with fltmgr
>>>>>> second but the first it 80% the second was 4%.
>>>>>>
>>>>>> Looking at the stack information from process explorer I see top of the list
>>>>>> ntkrnlpa.exe!KiUnexpectedInterrupt+0x40
>>>>>>
>>>>>> Also I’ve updated all the drivers on the system and anything else I can
>>>>>> think of with no effect.
>>>>>>
>>>>>>
>>>>>> "AJR" wrote:
>>>>>>> On Sunday, May 25, 2008 3:33 AM Mikey2OZ wrote:
>>>>>>> I'm running Windows Server 2008 AD on my laptop that I use an an Instructors server in the classroom. I've left it on for a couple of days, and this morning, all 4GBs of RAM were used and my CPUs were sitting on 100%. I brought up Process Explorer and checked. Under a scvhost.exe, there were over 600 taskeng.exe jobs scheduled. I open up the object, and there are two ntdll.dll!RtlUserThreadStart threads. I tried to get the laptop to reboot, but apparently my RAM crashed into the virtual memory and went BSOD.When I reboot, there are not tasks scheduled. After a few hours, there are a couple of dozen. Then there is more and more. It's been about 12 hours since I rebooted, and I have about 130 taskeng.exe jobs pending.Any Ideas?
>>>>>>>
>>>>>>>
>>>>>>> Post Originated from http://www.VistaForums.com Vista Support Forums
>>>>>>>> On Wednesday, May 28, 2008 4:37 AM RussellJesso wrote:
>>>>>>>> Follow up to the problem.
>>>>>>>>
>>>>>>>> The only way of fixing it was to do a total re-install of Vista. Once that
>>>>>>>> was done and all the updates applied and applications re-installed the
>>>>>>>> machine runs without problems.
>>>>>>>>
>>>>>>>> Obviously there was some sort of corruption somewhere but there was no
>>>>>>>> malware detected anywhere on the system. The only two items that may be
>>>>>>>> related was there were some dodgy MP3 played which may have automatically
>>>>>>>> downloaded a codec containing malware. Also the system was reporting traced
>>>>>>>> of having Norton installed and to my knowledge it had never been near the
>>>>>>>> system.
>>>>>>>>
>>>>>>>> "Russell Jesson" wrote:
>>>>>>>>> On Wednesday, May 28, 2008 11:34 AM Jason wrote:
>>>>>>>>> it is typical for a virus to inject itself into a svchost process. I would do a full scan/reinstall.