Jump to content
Microsoft Windows Bulletin Board

svchost still consuming CPU after boot


Recommended Posts

Posted

I've read many posts regarding the lengthy start-up issues associated with

svchost and MS updates - mine appears somewhat different. After booting up,

and after all services have started, my machine runs through cycles of CPU -

viewed on Task Manager these spkies are typically around 40% of CPU,

sometimes higher, and are occurring on a very consistent cycle, around every

6-8 seconds. This happens even with nothing open on my machine.

 

I've run all the scans to check for viruses and spyware. I can see that

these processes running are within svchost.exe and/or services.exe. I've

tried shutting down everything that is in my startup and the problem still

exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU

on these cycles, other processes are now affected - example, a full virus

scan now takes about twice as long as it used to. As there are tons of tasks

running within svchost, I have no idea how to narrow this down. I'm running

XP Home/SP2 and have applied all updates automatically. Any ideas?

Guest Kayman
Posted

"MG" <MG@discussions.microsoft.com> wrote in message

news:8A7781C6-074E-409C-AEA5-04F19C4ADF03@microsoft.com...

> I've read many posts regarding the lengthy start-up issues associated with

> svchost and MS updates - mine appears somewhat different. After booting

> up,

> and after all services have started, my machine runs through cycles of

> CPU -

> viewed on Task Manager these spkies are typically around 40% of CPU,

> sometimes higher, and are occurring on a very consistent cycle, around

> every

> 6-8 seconds. This happens even with nothing open on my machine.

>

> I've run all the scans to check for viruses and spyware. I can see that

> these processes running are within svchost.exe and/or services.exe. I've

> tried shutting down everything that is in my startup and the problem still

> exists. This cycling of CPU goes on non-stop, all the time. As it eats

> CPU

> on these cycles, other processes are now affected - example, a full virus

> scan now takes about twice as long as it used to. As there are tons of

> tasks

> running within svchost, I have no idea how to narrow this down. I'm

> running

> XP Home/SP2 and have applied all updates automatically. Any ideas?

>

The most usual cause recently for the 100% svchost usage is

a problem with the Windows Update Service which is fixed by upgrading to the

Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available

here:

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

and installing the updated KB927891 hotfix, here:

http://support.microsoft.com/?kbid=927891 for a complete fix.

--

In the case that you are seeing associated with the DNS Client, I would

suspect a long known issue that occurs when using a HOSTS file for ad

blocking. See the discussion here:

http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,

then it's normally best to just Disable the DNS Client Service.

Guest MowGreen [MVP]
Posted

Kayman wrote:

>

> "MG" <MG@discussions.microsoft.com> wrote in message

> news:8A7781C6-074E-409C-AEA5-04F19C4ADF03@microsoft.com...

>

>> I've read many posts regarding the lengthy start-up issues associated

>> with

>> svchost and MS updates - mine appears somewhat different. After

>> booting up,

>> and after all services have started, my machine runs through cycles of

>> CPU -

>> viewed on Task Manager these spkies are typically around 40% of CPU,

>> sometimes higher, and are occurring on a very consistent cycle, around

>> every

>> 6-8 seconds. This happens even with nothing open on my machine.

>>

>> I've run all the scans to check for viruses and spyware. I can see that

>> these processes running are within svchost.exe and/or services.exe. I've

>> tried shutting down everything that is in my startup and the problem

>> still

>> exists. This cycling of CPU goes on non-stop, all the time. As it

>> eats CPU

>> on these cycles, other processes are now affected - example, a full virus

>> scan now takes about twice as long as it used to. As there are tons

>> of tasks

>> running within svchost, I have no idea how to narrow this down. I'm

>> running

>> XP Home/SP2 and have applied all updates automatically. Any ideas?

>>

> The most usual cause recently for the 100% svchost usage is

> a problem with the Windows Update Service which is fixed by upgrading to

> the

> Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available

> here:

> http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

>

> and installing the updated KB927891 hotfix, here:

> http://support.microsoft.com/?kbid=927891 for a complete fix.

> --

> In the case that you are seeing associated with the DNS Client, I would

> suspect a long known issue that occurs when using a HOSTS file for ad

> blocking. See the discussion here:

> http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,

> then it's normally best to just Disable the DNS Client Service.

>

 

Is Spybot installed and is the Immunize feature Enabled ? This will also

cause DNS client side issues.

 

MowGreen [MVP 2003-2007]

===============

*-343-* FDNY

Never Forgotten

===============

Posted

I went through the agent update - indicated that I already had that version

in place. I also applied the hotfix indicated. Neither of these had any

impact on my issue.

 

"MowGreen [MVP]" wrote:

> Kayman wrote:

>

> >

> > "MG" <MG@discussions.microsoft.com> wrote in message

> > news:8A7781C6-074E-409C-AEA5-04F19C4ADF03@microsoft.com...

> >

> >> I've read many posts regarding the lengthy start-up issues associated

> >> with

> >> svchost and MS updates - mine appears somewhat different. After

> >> booting up,

> >> and after all services have started, my machine runs through cycles of

> >> CPU -

> >> viewed on Task Manager these spkies are typically around 40% of CPU,

> >> sometimes higher, and are occurring on a very consistent cycle, around

> >> every

> >> 6-8 seconds. This happens even with nothing open on my machine.

> >>

> >> I've run all the scans to check for viruses and spyware. I can see that

> >> these processes running are within svchost.exe and/or services.exe. I've

> >> tried shutting down everything that is in my startup and the problem

> >> still

> >> exists. This cycling of CPU goes on non-stop, all the time. As it

> >> eats CPU

> >> on these cycles, other processes are now affected - example, a full virus

> >> scan now takes about twice as long as it used to. As there are tons

> >> of tasks

> >> running within svchost, I have no idea how to narrow this down. I'm

> >> running

> >> XP Home/SP2 and have applied all updates automatically. Any ideas?

> >>

> > The most usual cause recently for the 100% svchost usage is

> > a problem with the Windows Update Service which is fixed by upgrading to

> > the

> > Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available

> > here:

> > http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

> >

> > and installing the updated KB927891 hotfix, here:

> > http://support.microsoft.com/?kbid=927891 for a complete fix.

> > --

> > In the case that you are seeing associated with the DNS Client, I would

> > suspect a long known issue that occurs when using a HOSTS file for ad

> > blocking. See the discussion here:

> > http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,

> > then it's normally best to just Disable the DNS Client Service.

> >

>

> Is Spybot installed and is the Immunize feature Enabled ? This will also

> cause DNS client side issues.

>

> MowGreen [MVP 2003-2007]

> ===============

> *-343-* FDNY

> Never Forgotten

> ===============

>

Guest Kayman
Posted

"MG" <MG@discussions.microsoft.com> wrote in message

news:33BF0D3B-53B3-4DF7-97E3-71008CD1994C@microsoft.com...

>I went through the agent update - indicated that I already had that version

> in place. I also applied the hotfix indicated. Neither of these had any

> impact on my issue.

>

Tricky one.

Download Process Explorer:

http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx

You've got to do some reading. Try to identify the item which is causing

your high cpu usage, and post to forum http://forum.sysinternals.com/ or

this ng.

Good luck :)

Guest MowGreen [MVP]
Posted

I repeat:

 

Is Spybot installed and is the Immunize feature Enabled ? This will also

cause DNS client side issues and a spike in CPU useage.

 

MowGreen [MVP 2003-2007]

===============

*-343-* FDNY

Never Forgotten

===============

 

 

MG wrote:

> I went through the agent update - indicated that I already had that version

> in place. I also applied the hotfix indicated. Neither of these had any

> impact on my issue.

>

> "MowGreen [MVP]" wrote:

>

>

>>Kayman wrote:

>>

>>

>>>"MG" <MG@discussions.microsoft.com> wrote in message

>>>news:8A7781C6-074E-409C-AEA5-04F19C4ADF03@microsoft.com...

>>>

>>>

>>>>I've read many posts regarding the lengthy start-up issues associated

>>>>with

>>>>svchost and MS updates - mine appears somewhat different. After

>>>>booting up,

>>>>and after all services have started, my machine runs through cycles of

>>>>CPU -

>>>>viewed on Task Manager these spkies are typically around 40% of CPU,

>>>>sometimes higher, and are occurring on a very consistent cycle, around

>>>>every

>>>>6-8 seconds. This happens even with nothing open on my machine.

>>>>

>>>>I've run all the scans to check for viruses and spyware. I can see that

>>>>these processes running are within svchost.exe and/or services.exe. I've

>>>>tried shutting down everything that is in my startup and the problem

>>>>still

>>>>exists. This cycling of CPU goes on non-stop, all the time. As it

>>>>eats CPU

>>>>on these cycles, other processes are now affected - example, a full virus

>>>>scan now takes about twice as long as it used to. As there are tons

>>>>of tasks

>>>>running within svchost, I have no idea how to narrow this down. I'm

>>>>running

>>>>XP Home/SP2 and have applied all updates automatically. Any ideas?

>>>>

>>>

>>>The most usual cause recently for the 100% svchost usage is

>>>a problem with the Windows Update Service which is fixed by upgrading to

>>>the

>>>Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available

>>>here:

>>>http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

>>>

>>>and installing the updated KB927891 hotfix, here:

>>>http://support.microsoft.com/?kbid=927891 for a complete fix.

>>>--

>>>In the case that you are seeing associated with the DNS Client, I would

>>>suspect a long known issue that occurs when using a HOSTS file for ad

>>>blocking. See the discussion here:

>>>http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,

>>>then it's normally best to just Disable the DNS Client Service.

>>>

>>

>>Is Spybot installed and is the Immunize feature Enabled ? This will also

>>cause DNS client side issues.

>>

>>MowGreen [MVP 2003-2007]

>>===============

>> *-343-* FDNY

>>Never Forgotten

>>===============

>>

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

>I went through the agent update - indicated that I already had that version

> in place. I also applied the hotfix indicated. Neither of these had any

> impact on my issue.

 

Do you have any Personal Firewall software installed? If true, try

a "netsh winsock reset" to be entered under "Run" in the Start menu,

hit [Enter] or click on "OK" and reboot Windows afterwards.

 

Bye,

Freudi

Posted

In reply to the last 3 posts - I do have a personal firewall - McAfee - I did

run the executable and rebooted - no difference.

 

I did recently run Spybot but have not set it up to do anything else. My

problem existed long before installing Spybot on my machine.

 

I have run Process Explorer on my machine. I'll attach here what I see -

basically, you can see the svchost.exe and services.exe are casuing the CPU

spikes - multiple occurrences are running - by the way, the spikes appear to

be perfectly timed in rythm, consistently 5-6 seconds apart. If I leave task

manager open for a while, I sometimes notice the spikes go up to close to

100% and then back down to 0 - at other times, the spikes are not as high.

They are, however, VERY consistent in their spacing 5-6 seconds apart. If

you look at the CPU usage history on task manager, it looks just like a heart

beat chart...

 

With process explorer, I see threads being created, but don't know what is

kicking them off, nor know how to determine. Here is what I see - first the

thread:

 

Kernal32.dll! CreateThread+0x22

 

Within this thread:

 

ntoskrnl.exe+0x4856

ntoskrnl.exe!CcUnpinDataForThread+0x338

ntoskrnl.exe!ZwYieldExecution+0xb78

ntdll.dll!KiFastSystemCallRet

RPCRT4.dll!I_RpcBCacheFree+0x5ea

RPCRT4.dll!I_RpcBCacheFree+0x403

RPCRT4.dll!I_RpcBCacheFree+0x5d2

kernel32.dll!GetModuleFileNameA+0x1b4

 

There are multiple threads with the Kernal... info being created, and I can

see they are the threads consuming CPU. The info above is what I see within

the thread - I've posted this on other forums but it doesn't seem to mean

anything to anyone. Sure hope this helps.

 

"Ottmar Freudenberger" wrote:

> "MG" <MG@discussions.microsoft.com> schrieb:

>

> >I went through the agent update - indicated that I already had that version

> > in place. I also applied the hotfix indicated. Neither of these had any

> > impact on my issue.

>

> Do you have any Personal Firewall software installed? If true, try

> a "netsh winsock reset" to be entered under "Run" in the Start menu,

> hit [Enter] or click on "OK" and reboot Windows afterwards.

>

> Bye,

> Freudi

>

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

> In reply to the last 3 posts - I do have a personal firewall - McAfee - I did

> run the executable and rebooted - no difference.

 

Hm, would you mind uninstalling the Personal Firewall cr^H^H and

enabling the Windows Firewall instead at least for test purposes?

> I did recently run Spybot but have not set it up to do anything else. My

> problem existed long before installing Spybot on my machine.

 

How long does the problem exists approximately?

 

Bye,

Freudi

Posted

Are you referring to simply turning off the McAfee fiewall as opposed to

uninstalling it? I did turn it off to see what happened - no change.

 

As for this issue - it has been present since the early part of this year -

somewhere around March or April.

 

"Ottmar Freudenberger" wrote:

> "MG" <MG@discussions.microsoft.com> schrieb:

>

> > In reply to the last 3 posts - I do have a personal firewall - McAfee - I did

> > run the executable and rebooted - no difference.

>

> Hm, would you mind uninstalling the Personal Firewall cr^H^H and

> enabling the Windows Firewall instead at least for test purposes?

>

> > I did recently run Spybot but have not set it up to do anything else. My

> > problem existed long before installing Spybot on my machine.

>

> How long does the problem exists approximately?

>

> Bye,

> Freudi

>

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

> Are you referring to simply turning off the McAfee fiewall as opposed to

> uninstalling it?

 

Uninstall it.

> As for this issue - it has been present since the early part of this year -

> somewhere around March or April.

 

Hm, did you have any difficulties in installing KB931784 (MS07-022)

eventually? And you don't have any of these "Theme/Design" changing

"Vista Packs" and the like installed, do you?

 

Bye,

Freudi

Posted

I'm not sure how to uninstall just the firewall portion of my McAfee package.

To your second question, I don't know how to answer it. Have had no issues

to my knowledge. I use auto update, and don't recall any issues in applying

any of those.

 

"Ottmar Freudenberger" wrote:

> "MG" <MG@discussions.microsoft.com> schrieb:

>

> > Are you referring to simply turning off the McAfee fiewall as opposed to

> > uninstalling it?

>

> Uninstall it.

>

> > As for this issue - it has been present since the early part of this year -

> > somewhere around March or April.

>

> Hm, did you have any difficulties in installing KB931784 (MS07-022)

> eventually? And you don't have any of these "Theme/Design" changing

> "Vista Packs" and the like installed, do you?

>

> Bye,

> Freudi

>

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

> I'm not sure how to uninstall just the firewall portion of my McAfee package.

 

Please cantact the manual for/of that software or McAfee support.

> To your second question, I don't know how to answer it.

 

Okay. And the answer for "And you don't have any of these "Theme/Design"

changing "Vista Packs" and the like installed, do you?" is?

 

Bye,

Freudi

Posted

OK - haven't given up on this yet. I've taken a look at my system logs -

there are some recurring entries - wanted to see if any of these are helpful.

 

I find this one daily or multiple times per day:

 

Friday, August 10, 2007 - Service Control Manager - The mrtRate service

failed to start due to the following error: The system cannot find the file

specified.

 

 

Tuesday, July 24, 2007 - Service Control Manager - The Application

Management service terminated with the following error: The specified module

could not be found.

 

 

This one shows up occasionally:

 

Friday, August 10, 2007 - EventSyste m - The COM+ Event System detected a

bad return code during its internal processing. HRESULT was 8007041F from

line 44 of d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp. Please

contact Microsoft Product Support Services to report this error.

 

 

And lastly, I've noticed that my keyboard hotkeys are no longer working - a

recent development - I tried to restart the task which appears to control,

and this log appears:

 

Sunday, August 12, 2007 - Service Control Manager - The Human Interface

Device Access service terminated with the following error: The specified

module could not be found.

 

 

Any of this seem to be of concern?

 

"Kayman" wrote:

> "MG" <MG@discussions.microsoft.com> wrote in message

> news:33BF0D3B-53B3-4DF7-97E3-71008CD1994C@microsoft.com...

> >I went through the agent update - indicated that I already had that version

> > in place. I also applied the hotfix indicated. Neither of these had any

> > impact on my issue.

> >

> Tricky one.

> Download Process Explorer:

> http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx

> You've got to do some reading. Try to identify the item which is causing

> your high cpu usage, and post to forum http://forum.sysinternals.com/ or

> this ng.

> Good luck :)

>

>

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

> OK - haven't given up on this yet.

 

Have you uninstalled your Personal Firewall software though and

enabled Windows Firewall in the meantime? If true, see the following.

If untrue, please do it!

> Friday, August 10, 2007 - EventSyste m - The COM+ Event System detected a

> bad return code during its internal processing. HRESULT was 8007041F from

> line 44 of d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp. Please

> contact Microsoft Product Support Services to report this error.

 

0x8007041F means "Database locked"

In case the COM+ System Application is *not* disabled (check via

Start -> Run -> services.msc -> [Enter]) and *not* blocked via

your now uninstalled Personal Firewall software, the following MSKB

article may help: http://support.microsoft.com/kb/909444/en-us -

although it's aiming 0x80070005 errors.

 

Bye,

Freudi

Posted

I have not uninstalled McAfee firewall as I've not been ablr to determine how

to uninstall only that component. As well, it's not clear as to why you feel

this is related to my svchost issue - can you elaborate?

 

"Ottmar Freudenberger" wrote:

> "MG" <MG@discussions.microsoft.com> schrieb:

>

> > OK - haven't given up on this yet.

>

> Have you uninstalled your Personal Firewall software though and

> enabled Windows Firewall in the meantime? If true, see the following.

> If untrue, please do it!

>

> > Friday, August 10, 2007 - EventSyste m - The COM+ Event System detected a

> > bad return code during its internal processing. HRESULT was 8007041F from

> > line 44 of d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp. Please

> > contact Microsoft Product Support Services to report this error.

>

> 0x8007041F means "Database locked"

> In case the COM+ System Application is *not* disabled (check via

> Start -> Run -> services.msc -> [Enter]) and *not* blocked via

> your now uninstalled Personal Firewall software, the following MSKB

> article may help: http://support.microsoft.com/kb/909444/en-us -

> although it's aiming 0x80070005 errors.

>

> Bye,

> Freudi

>

Guest Ottmar Freudenberger
Posted

"MG" wrote:

> I have not uninstalled McAfee firewall as I've not been ablr to determine how

> to uninstall only that component.

 

Once again: Please cantact the manual for/of that software or McAfee

support. In case you can't manage it, uninstall the whole suite.

> As well, it's not clear as to why you feel

> this is related to my svchost issue - can you elaborate?

 

I do have some experiences, you know? And yes, in almost *all* cases a

Personal Firewall has been the culprit. Uninstalling and running the "netsh

winsock reset" command under "Run" in the Start menu fixed those issues.

 

Bye,

Freudi

Posted

OK - I uninstalled the McAfee personal firewall, ran the command you

indicated and enabled Windows firewall. I still have my issue.

 

"Ottmar Freudenberger" wrote:

> "MG" wrote:

>

> > I have not uninstalled McAfee firewall as I've not been ablr to determine how

> > to uninstall only that component.

>

> Once again: Please cantact the manual for/of that software or McAfee

> support. In case you can't manage it, uninstall the whole suite.

>

> > As well, it's not clear as to why you feel

> > this is related to my svchost issue - can you elaborate?

>

> I do have some experiences, you know? And yes, in almost *all* cases a

> Personal Firewall has been the culprit. Uninstalling and running the "netsh

> winsock reset" command under "Run" in the Start menu fixed those issues.

>

> Bye,

> Freudi

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

> OK - I uninstalled the McAfee personal firewall, ran the command you

> indicated and enabled Windows firewall. I still have my issue.

 

And you've rebooted Windows? Then it's not an issue related to any

Windows Update. Feel free to ask back in the Windows XP newsgroup

then.

 

Bye,

Freudi

Posted

FYI - have been working through the Windows XP forum and may have found a

solve. What appears to have had an impact was uninstalling AOL from my

machine. After uninstalling and restarting, my CPU spikes have almost

totally disappeared. Thought you might want to know.

 

"Ottmar Freudenberger" wrote:

> "MG" <MG@discussions.microsoft.com> schrieb:

>

> > OK - I uninstalled the McAfee personal firewall, ran the command you

> > indicated and enabled Windows firewall. I still have my issue.

>

> And you've rebooted Windows? Then it's not an issue related to any

> Windows Update. Feel free to ask back in the Windows XP newsgroup

> then.

>

> Bye,

> Freudi

>

Guest Ottmar Freudenberger
Posted

"MG" <MG@discussions.microsoft.com> schrieb:

> FYI - have been working through the Windows XP forum and may have found a

> solve. What appears to have had an impact was uninstalling AOL from my

> machine. After uninstalling and restarting, my CPU spikes have almost

> totally disappeared. Thought you might want to know.

 

Okay, thanks for posting back! :-)

 

Bye,

Freudi

×
×
  • Create New...