Windows 7 - svchost still consuming CPU after boot

Asked By M on 05-Aug-07 01:44 PM
I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different.  After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds.  This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware.  I can see that
these processes running are within svchost.exe and/or services.exe.  I've
tried shutting down everything that is in my startup and the problem still
exists.  This cycling of CPU goes on non-stop, all the time.  As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to.  As there are tons of tasks
running within svchost, I have no idea how to narrow this down.  I'm running
XP Home/SP2 and have applied all updates automatically.  Any ideas?




Kayman replied on 05-Aug-07 07:22 PM
The most usual cause recently for the 100% svchost usage is
a problem with the Windows Update Service which is fixed by upgrading to the
Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
here:
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
and installing the updated KB927891 hotfix, here:
http://support.microsoft.com/?kbid=927891 for a complete fix.
--
In the case that you are seeing associated with the DNS Client, I would
suspect a long known issue that occurs when using a HOSTS file for ad
blocking.  See the discussion here:
http://www.mvps.org/winhelp2002/hosts.htm .  If you are using a HOSTS file,
then it's normally best to just Disable the DNS Client Service.
MowGreen [MVP] replied on 06-Aug-07 02:12 PM
Is Spybot installed and is the Immunize feature Enabled ? This will also
cause DNS client side issues.

MowGreen  [MVP 2003-2007]
===============
*-343-*  FDNY
Never Forgotten
===============
M replied on 06-Aug-07 10:02 PM
I went through the agent update - indicated that I already had that version
in place.  I also applied the hotfix indicated.  Neither of these had any
impact on my issue.
Kayman replied on 07-Aug-07 02:58 AM
Tricky one.
Download Process Explorer:
http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx
You've got to do some reading.  Try to identify the item which is causing
your high cpu usage, and post to forum http://forum.sysinternals.com/ or
this ng.
Good luck :)
MowGreen [MVP] replied on 07-Aug-07 02:34 PM
I repeat:

Is Spybot installed and is the Immunize feature Enabled ? This will also
cause DNS client side issues and a spike in CPU useage.

MowGreen  [MVP 2003-2007]
===============
*-343-*  FDNY
Never Forgotten
===============
Ottmar Freudenberger replied on 07-Aug-07 03:04 PM
Do you have any Personal Firewall software installed? If true, try
a "netsh winsock reset" to be entered under "Run" in the Start menu,
hit [Enter] or click on "OK" and reboot Windows afterwards.

Bye,
Freudi
M replied on 07-Aug-07 09:02 PM
In reply to the last 3 posts - I do have a personal firewall - McAfee - I did
run the executable and rebooted - no difference.

I did recently run Spybot but have not set it up to do anything else.  My
problem existed long before installing Spybot on my machine.

I have run Process Explorer on my machine.  I'll attach here what I see -
basically, you can see the svchost.exe and services.exe are casuing the CPU
spikes - multiple occurrences are running - by the way, the spikes appear to
be perfectly timed in rythm, consistently 5-6 seconds apart.  If I leave task
manager open for a while, I sometimes notice the spikes go up to close to
100% and then back down to 0 - at other times, the spikes are not as high.
They are, however, VERY consistent in their spacing 5-6 seconds apart.  If
you look at the CPU usage history on task manager, it looks just like a heart
beat chart...

With process explorer, I see threads being created, but don't know what is
kicking them off, nor know how to determine.  Here is what I see - first the
thread:

Kernal32.dll! CreateThread+0x22

Within this thread:

ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

There are multiple threads with the Kernal... info being created, and I can
see they are the threads consuming CPU.  The info above is what I see within
the thread - I've posted this on other forums but it doesn't seem to mean
anything to anyone.  Sure hope this helps.
Ottmar Freudenberger replied on 07-Aug-07 11:09 PM
Hm, would you mind uninstalling the Personal Firewall cr^H^H and
enabling the Windows Firewall instead at least for test purposes?


How long does the problem exists approximately?

Bye,
Freudi
M replied on 08-Aug-07 12:32 AM
Are you referring to simply turning off the McAfee fiewall as opposed to
uninstalling it?  I did turn it off to see what happened - no change.

As for this issue - it has been present since the early part of this year -
somewhere around March or April.
Ottmar Freudenberger replied on 08-Aug-07 12:40 AM
Uninstall it.


Hm, did you have any difficulties in installing KB931784 (MS07-022)
eventually? And you don't have any of these "Theme/Design" changing

Bye,
Freudi
M replied on 08-Aug-07 07:46 PM
I'm not sure how to uninstall just the firewall portion of my McAfee package.
To your second question, I don't know how to answer it.  Have had no issues
to my knowledge.  I use auto update, and don't recall any issues in applying
any of those.
Ottmar Freudenberger replied on 09-Aug-07 03:46 AM
Please cantact the manual for/of that software or McAfee support.


Okay. And the answer for "And you don't have any of these "Theme/Design"
changing "Vista Packs" and the like installed, do you?" is?

Bye,
Freudi
M replied on 12-Aug-07 12:44 PM
OK - haven't given up on this yet.  I've taken a look at my system logs -
there are some recurring entries - wanted to see if any of these are helpful.

I find this one daily or multiple times per day:

Friday, August 10, 2007 - Service Control Manager - The mrtRate service
failed to start due to the following error: The system cannot find the file
specified.


Tuesday, July 24, 2007 - Service Control Manager - The Application
Management service terminated with the following error: The specified module
could not be found.


This one shows up occasionally:

Friday, August 10, 2007 - EventSyste m - The COM+ Event System detected a
bad return code during its internal processing. HRESULT was 8007041F from
line 44 of d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp. Please
contact Microsoft Product Support Services to report this error.


And lastly, I've noticed that my keyboard hotkeys are no longer working - a
recent development - I tried to restart the task which appears to control,
and this log appears:

Sunday, August 12, 2007 - Service Control Manager - The Human Interface
Device Access service terminated with the following error: The specified
module could not be found.


Any of this seem to be of concern?
Ottmar Freudenberger replied on 12-Aug-07 10:48 PM
Have you uninstalled your Personal Firewall software though and
enabled Windows Firewall in the meantime? If true, see the following.
If untrue, please do it!


0x8007041F means "Database locked"
In case the COM+ System Application is *not* disabled (check via
Start -> Run -> services.msc -> [Enter]) and *not* blocked via
your now uninstalled Personal Firewall software, the following MSKB
article may help: http://support.microsoft.com/kb/909444/en-us -
although it's aiming 0x80070005 errors.

Bye,
Freudi
M replied on 12-Aug-07 11:28 PM
I have not uninstalled McAfee firewall as I've not been ablr to determine how
to uninstall only that component.  As well, it's not clear as to why you feel
this is related to my svchost issue - can you elaborate?
freud replied on 13-Aug-07 06:32 AM
Once again: Please cantact the manual for/of that software or McAfee
support.  In case you can't manage it, uninstall the whole suite.


I do have some experiences, you know? And yes, in almost *all* cases a
Personal Firewall has been the culprit. Uninstalling and running the "netsh
winsock reset" command under "Run" in the Start menu fixed those issues.

Bye,
Freudi
M replied on 13-Aug-07 09:42 PM
OK - I uninstalled the McAfee personal firewall, ran the command you
indicated and enabled Windows firewall.  I still have my issue.
Ottmar Freudenberger replied on 13-Aug-07 11:27 PM
And you have rebooted Windows? Then it is not an issue related to any
Windows Update. Feel free to ask back in the Windows XP newsgroup
then.

Bye,
Freudi
M replied on 16-Aug-07 11:54 PM
FYI - have been working through the Windows XP forum and may have found a
solve.  What appears to have had an impact was uninstalling AOL from my
machine.  After uninstalling and restarting, my CPU spikes have almost
totally disappeared.  Thought you might want to know.
Ottmar Freudenberger replied on 17-Aug-07 02:33 AM
Okay, thanks for posting back! :-)

Bye,
Freudi