svchost.exe using 99% cpu

Discussion in 'Computer Support' started by Network23, Oct 5, 2004.

  1. Network23

    Network23 Guest

    I have been trying to figure out what is causing it to use 99% cpu
    usage.

    Here is what I know so far.

    I did a tasklist /svc

    AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
    EventSystem, FastUserSwitchingCompatibility,
    lanmanserver, lanmanworkstation, Netman,
    Nla, RasMan, Schedule, SENS, SharedAccess,
    ShellHWDetection, TapiSrv, Themes, TrkWks,
    W32Time, winmgmt, wscsvc, wuauserv, WZCSVC

    Somthing in there is causing it.
    I cant shut that svchost down with ctrl-alt-del
    but the program cacheman xp lets me shut it down.
    Once it is shut down the system goes back to normal.

    What could be causing it?

    Thanks.
     
    Network23, Oct 5, 2004
    #1
    1. Advertisements

  2. Network23

    SwissTony Guest

    The tools that you can use to investigate what is happening are Active
    Ports and Process Explorer. With Active Ports you can put a short-cut in
    the Start folder so you can get a clear picture at the logon sequence to
    see the connections being made to and from the machine. With PE, you can
    look at processes and look inside a process to see what processes are
    using it. You see if it's the real svchost.exe, then you'll need to find
    out what's trying to use svchost.exe as it is just the messenger and is
    not the culprit.

    Both AP and PE can be used to terminate a running process and both are
    free.

    http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_and
    _Rootkit_Tools_in_a_Windows_Environment.html
     
    SwissTony, Oct 5, 2004
    #2
    1. Advertisements

  3. Network23

    Network23 Guest

    OK, I installed both, but i am not exatly sure what to look for.
    This is what active ports shows (on the bottom right corner the black
    and white text of 100 is my cpu usage.
    http://mtpdist.com/help/image1.jpg

    Here is what Process Explorer shows
    http://mtpdist.com/help/image2.jpg
    under the bottom of type and name is a massive amount of stuff.

    When I click properties on it it shows:
    http://mtpdist.com/help/image3.jpg

    It took me over an hour just to move between programs and get this
    posted. So any extra heads up would be appreciated.

    I have XP with sp2 (problem started 2 months ago and gets worse)
    it is a 1700xp with 512 megs and shouldnt be doing this.

    Thanks.
     
    Network23, Oct 5, 2004
    #3
  4. Network23

    Duane Arnold Guest

    Duane Arnold, Oct 5, 2004
    #4
  5. Network23

    DC Guest


    Lemme guess: this only happens at boot up, right?

    Disable the DHCP client service.

    Trust me on this one. I went through hell sorting this out on my
    system.

    More info:
    http://www.theeldergeek.com/dhcp_client.htm
     
    DC, Oct 5, 2004
    #5
  6. Network23

    Duane Arnold Guest

    So, I'll assume you're showing the svchost.exe that's got the 99% CPU. You
    can use Properties/Thread tab and look inside of svchost.exe to see what's
    thread/program is using and hogging svchost.exe. You can go to View/Show
    lower pane. You can do Lower Pane View/ show DLL(s).

    The lower pane will show all the dll(s) and there locations when you click
    on the dll. You can also right-click and Properties.

    Duane :)
     
    Duane Arnold, Oct 6, 2004
    #6
  7. Network23

    Pennywise Guest

    |> I have been trying to figure out what is causing it to use 99% cpu
    |>usage.
    |>

    Download Process Explorer http://tinyurl.com/5bp9aand
    Double click on the process your have problems with. It has the
    ability to show the cpu usage of each sub program.

    |> Here is what I know so far.
    |>
    |>I did a tasklist /svc
    |>
    |>AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
    |>EventSystem, FastUserSwitchingCompatibility,
    |>lanmanserver, lanmanworkstation, Netman,
    |>Nla, RasMan, Schedule, SENS, SharedAccess,
    |>ShellHWDetection, TapiSrv, Themes, TrkWks,
    |>W32Time, winmgmt, wscsvc, wuauserv, WZCSVC
    |>
    |>Somthing in there is causing it.
    |>I cant shut that svchost down with ctrl-alt-del
    |>but the program cacheman xp lets me shut it down.
    |>Once it is shut down the system goes back to normal.
    |>
    |>What could be causing it?
    |>
    |>Thanks.
     
    Pennywise, Oct 6, 2004
    #7
  8. Network23

    Network23 Guest

    Under the properties and threads, nothing shows up for cpu or cswitch
    delta. but it does show alot of other things running, but not whats
    causing it
    arrghh
     
    Network23, Oct 6, 2004
    #8
  9. Network23

    DC Guest


    No, not "arrghh". I gave you the solution in a reply, yesterday. Did
    you even try it?

    Here, in case you missed it:
    Message-ID: <>
     
    DC, Oct 6, 2004
    #9
  10. Network23

    treehugger Guest

    "ccApp.exe" It's your Norton email checking that's causing the 99% CPU usage and slowdown. See this page for a fix: http://computercops.biz/pstp276479-.html#276479

    treehugger
     
    treehugger, Oct 6, 2004
    #10
  11. Network23

    Duane Arnold Guest


    The other poster may be on to something for you. If you go to the
    svchost.exe in question with Process Explorer and go to the
    Properties/Service tab is DHCP Client listed? If DHCP Client is listed,
    then you can try stopping the DHCP Client service on XP and see if that
    buys you anything. I don't know if by disabling the DHCP Client service
    it will have any adverse affect in the long run. If that does clear your
    problem, you may want to send a email to MS Tech Support about the issue.

    Duane :)
     
    Duane Arnold, Oct 6, 2004
    #11
  12. Network23

    Duane Arnold Guest

    And your point is what here?

    Duane :)
     
    Duane Arnold, Oct 6, 2004
    #12
  13. Network23

    Duane Arnold Guest

    OH! It is you the *nut* or one of the *nuts*. Let me go back to setting up
    Path statements in Xnews to eliminate you or you(s).

    Duane :)
     
    Duane Arnold, Oct 6, 2004
    #13
  14. Network23

    Duane Arnold Guest

    OH! It is you the *nut* or one of the *nuts*. Let me go back to setting up
    Path statements in Xnews to eliminate you or you(s).

    Duane :)
     
    Duane Arnold, Oct 6, 2004
    #14
  15. Network23

    Rex Ballard Guest

     
    Rex Ballard, Oct 6, 2004
    #15
  16. Network23

    Duane Arnold Guest

    This is a *test* hit me with some more *Path* statements. I'll eliminate a
    he/she/it/bitch/snake/cockroach like you from the seen eventually. ;-)

    Duane :)
     
    Duane Arnold, Oct 6, 2004
    #16
  17. Network23

    Duane's Mum Guest

     
    Duane's Mum, Oct 6, 2004
    #17
  18. Network23

    Duane's Mum Guest

     
    Duane's Mum, Oct 6, 2004
    #18
  19. Network23

    Duane Arnold Guest

    Xnews is the bomb. It knocks out all bums, clowns and cockroaches. You can
    pass that on to the other cockroach with you too, which I eliminated
    already.

    Thanks as you have been helpful!
     
    Duane Arnold, Oct 7, 2004
    #19
  20. Network23

    Duane's Mum Guest

     
    Duane's Mum, Oct 7, 2004
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.