svchost still consuming CPU after boot
MG
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.
I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?
Kayman
"MG" <M...@discussions.microsoft.com> wrote in message
news:8A7781C6-074E-409C...@microsoft.com...
a problem with the Windows Update Service which is fixed by upgrading to the
Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
here:
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
and installing the updated KB927891 hotfix, here:
http://support.microsoft.com/?kbid=927891 for a complete fix.
--
In the case that you are seeing associated with the DNS Client, I would
suspect a long known issue that occurs when using a HOSTS file for ad
blocking. See the discussion here:
http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,
then it's normally best to just Disable the DNS Client Service.
MowGreen [MVP]
Is Spybot installed and is the Immunize feature Enabled ? This will also
cause DNS client side issues.
MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============
MG
in place. I also applied the hotfix indicated. Neither of these had any
impact on my issue.
Kayman
>I went through the agent update - indicated that I already had that version
> in place. I also applied the hotfix indicated. Neither of these had any
> impact on my issue.
>
Download Process Explorer:
http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx
You've got to do some reading. Try to identify the item which is causing
your high cpu usage, and post to forum http://forum.sysinternals.com/ or
this ng.
Good luck :)
MowGreen [MVP]
Is Spybot installed and is the Immunize feature Enabled ? This will also
cause DNS client side issues and a spike in CPU useage.
MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============
Ottmar Freudenberger
>I went through the agent update - indicated that I already had that version
> in place. I also applied the hotfix indicated. Neither of these had any
> impact on my issue.
Do you have any Personal Firewall software installed? If true, try
a "netsh winsock reset" to be entered under "Run" in the Start menu,
hit [Enter] or click on "OK" and reboot Windows afterwards.
Bye,
Freudi
MG
run the executable and rebooted - no difference.
I did recently run Spybot but have not set it up to do anything else. My
problem existed long before installing Spybot on my machine.
I have run Process Explorer on my machine. I'll attach here what I see -
basically, you can see the svchost.exe and services.exe are casuing the CPU
spikes - multiple occurrences are running - by the way, the spikes appear to
be perfectly timed in rythm, consistently 5-6 seconds apart. If I leave task
manager open for a while, I sometimes notice the spikes go up to close to
100% and then back down to 0 - at other times, the spikes are not as high.
They are, however, VERY consistent in their spacing 5-6 seconds apart. If
you look at the CPU usage history on task manager, it looks just like a heart
beat chart...
With process explorer, I see threads being created, but don't know what is
kicking them off, nor know how to determine. Here is what I see - first the
thread:
Kernal32.dll! CreateThread+0x22
Within this thread:
ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4
There are multiple threads with the Kernal... info being created, and I can
see they are the threads consuming CPU. The info above is what I see within
the thread - I've posted this on other forums but it doesn't seem to mean
anything to anyone. Sure hope this helps.
Ottmar Freudenberger
> In reply to the last 3 posts - I do have a personal firewall - McAfee - I did
> run the executable and rebooted - no difference.
Hm, would you mind uninstalling the Personal Firewall cr^H^H and
enabling the Windows Firewall instead at least for test purposes?
> I did recently run Spybot but have not set it up to do anything else. My
> problem existed long before installing Spybot on my machine.
How long does the problem exists approximately?
Bye,
Freudi
MG
uninstalling it? I did turn it off to see what happened - no change.
As for this issue - it has been present since the early part of this year -
somewhere around March or April.
Ottmar Freudenberger
> Are you referring to simply turning off the McAfee fiewall as opposed to
> uninstalling it?
Uninstall it.
> As for this issue - it has been present since the early part of this year -
> somewhere around March or April.
Hm, did you have any difficulties in installing KB931784 (MS07-022)
eventually? And you don't have any of these "Theme/Design" changing
"Vista Packs" and the like installed, do you?
Bye,
Freudi
MG
To your second question, I don't know how to answer it. Have had no issues
to my knowledge. I use auto update, and don't recall any issues in applying
any of those.
Ottmar Freudenberger
> I'm not sure how to uninstall just the firewall portion of my McAfee package.
Please cantact the manual for/of that software or McAfee support.
> To your second question, I don't know how to answer it.
Okay. And the answer for "And you don't have any of these "Theme/Design"
changing "Vista Packs" and the like installed, do you?" is?
Bye,
Freudi
MG
there are some recurring entries - wanted to see if any of these are helpful.
I find this one daily or multiple times per day:
Friday, August 10, 2007 - Service Control Manager - The mrtRate service
failed to start due to the following error: The system cannot find the file
specified.
Tuesday, July 24, 2007 - Service Control Manager - The Application
Management service terminated with the following error: The specified module
could not be found.
This one shows up occasionally:
Friday, August 10, 2007 - EventSyste m - The COM+ Event System detected a
bad return code during its internal processing. HRESULT was 8007041F from
line 44 of d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp. Please
contact Microsoft Product Support Services to report this error.
And lastly, I've noticed that my keyboard hotkeys are no longer working - a
recent development - I tried to restart the task which appears to control,
and this log appears:
Sunday, August 12, 2007 - Service Control Manager - The Human Interface
Device Access service terminated with the following error: The specified
module could not be found.
Any of this seem to be of concern?
Ottmar Freudenberger
> OK - haven't given up on this yet.
Have you uninstalled your Personal Firewall software though and
enabled Windows Firewall in the meantime? If true, see the following.
If untrue, please do it!
> Friday, August 10, 2007 - EventSyste m - The COM+ Event System detected a
> bad return code during its internal processing. HRESULT was 8007041F from
> line 44 of d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp. Please
> contact Microsoft Product Support Services to report this error.
0x8007041F means "Database locked"
In case the COM+ System Application is *not* disabled (check via
Start -> Run -> services.msc -> [Enter]) and *not* blocked via
your now uninstalled Personal Firewall software, the following MSKB
article may help: http://support.microsoft.com/kb/909444/en-us -
although it's aiming 0x80070005 errors.
Bye,
Freudi
MG
to uninstall only that component. As well, it's not clear as to why you feel
this is related to my svchost issue - can you elaborate?
Ottmar Freudenberger
> I have not uninstalled McAfee firewall as I've not been ablr to determine how
> to uninstall only that component.
Once again: Please cantact the manual for/of that software or McAfee
support. In case you can't manage it, uninstall the whole suite.
> As well, it's not clear as to why you feel
> this is related to my svchost issue - can you elaborate?
I do have some experiences, you know? And yes, in almost *all* cases a
Personal Firewall has been the culprit. Uninstalling and running the "netsh
winsock reset" command under "Run" in the Start menu fixed those issues.
Bye,
Freudi
MG
indicated and enabled Windows firewall. I still have my issue.
Ottmar Freudenberger
> OK - I uninstalled the McAfee personal firewall, ran the command you
> indicated and enabled Windows firewall. I still have my issue.
And you've rebooted Windows? Then it's not an issue related to any
Windows Update. Feel free to ask back in the Windows XP newsgroup
then.
Bye,
Freudi
Ottmar Freudenberger
> FYI - have been working through the Windows XP forum and may have found a
> solve. What appears to have had an impact was uninstalling AOL from my
> machine. After uninstalling and restarting, my CPU spikes have almost
> totally disappeared. Thought you might want to know.
Okay, thanks for posting back! :-)
Bye,
Freudi