Windows Vista Tips

Windows Vista Tips > Newsgroups > Windows Vista Performance > svchost 100% CPU and Possible windows update problems

Reply
Thread Tools Display Modes

svchost 100% CPU and Possible windows update problems

 
 
Russell Jesson
Guest
Posts: n/a

 
      05-21-2008
Vista Basic Machine started running very slowly and when I looked in Task
Manager svchost.exe was using a 100% CPU. Using system internals process
explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
Tapisrv and Termservice.

Looking inside the thread that is using the CPU is ntdll.dll

I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
booted in safe mode and cleared all the softwaredistribution folder. The slow
running does not affect safe mode but as the service is not started no great
surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.

I tried to update AVG virus checker but it wanted KB929547 applied so I
downloaded it and tried to run but after several hours all I got was install
failed with 0x800706bb

Any ideas??

 
Reply With Quote
 
 
 
 
Stephen Caudill
Guest
Posts: n/a

 
      05-21-2008
For what it's worth, I had the same problem about a month ago. It was
svchost.exe that was spiking the CPU. Did some trial and error with
services and couldn't nail it down. It lasted about 2 weeks
(intermittently) and has now not reared its ugly head for a couple of
weeks now.

I think I read somewhere that it was a conflict with the virus app? I'm
using eTrust. Not sure, but possibly an update fixed it? Good luck!
-scaudill



Russell Jesson wrote:
> Vista Basic Machine started running very slowly and when I looked in Task
> Manager svchost.exe was using a 100% CPU. Using system internals process
> explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
> Tapisrv and Termservice.
>
> Looking inside the thread that is using the CPU is ntdll.dll
>
> I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
> booted in safe mode and cleared all the softwaredistribution folder. The slow
> running does not affect safe mode but as the service is not started no great
> surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.
>
> I tried to update AVG virus checker but it wanted KB929547 applied so I
> downloaded it and tried to run but after several hours all I got was install
> failed with 0x800706bb
>
> Any ideas??
>

 
Reply With Quote
 
 
 
 
Russell Jesson
Guest
Posts: n/a

 
      05-21-2008
I just swapped from AVG7.5 to 8.0 and problem is still there However making
some progress as if I look at the Process explorer properties for svchost the
thread it reports is ntdll.dll!RtlUserThreadStart and suspending this makes
the machine usable. So I’ve been trying various things to no effect to help
the problem.

The AVG8 scan finds nothing.

Currently uninstalling Windows Live xxxx as there are reports, all be it old
ones, that this can cause problems and I’m also in the process of getting the
flashplayer update as this was also mentioned.

However even with the CPU down very low (with thread suspended) the Windows
Installer crawls along, well uninstalling in this case.
I’ll keep looking and report back on findings.


"Stephen Caudill" wrote:

> For what it's worth, I had the same problem about a month ago. It was
> svchost.exe that was spiking the CPU. Did some trial and error with
> services and couldn't nail it down. It lasted about 2 weeks
> (intermittently) and has now not reared its ugly head for a couple of
> weeks now.
>
> I think I read somewhere that it was a conflict with the virus app? I'm
> using eTrust. Not sure, but possibly an update fixed it? Good luck!
> -scaudill
>
>
>
> Russell Jesson wrote:
> > Vista Basic Machine started running very slowly and when I looked in Task
> > Manager svchost.exe was using a 100% CPU. Using system internals process
> > explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
> > Tapisrv and Termservice.
> >
> > Looking inside the thread that is using the CPU is ntdll.dll
> >
> > I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
> > booted in safe mode and cleared all the softwaredistribution folder. The slow
> > running does not affect safe mode but as the service is not started no great
> > surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.
> >
> > I tried to update AVG virus checker but it wanted KB929547 applied so I
> > downloaded it and tried to run but after several hours all I got was install
> > failed with 0x800706bb
> >
> > Any ideas??
> >

>

 
Reply With Quote
 
AJR
Guest
Posts: n/a

 
      05-21-2008
take a look at http://blogs.technet.com/markrussinovich/rss.xml

Scroll down for Mark's post on solving CPU spikces.


"Russell Jesson" <Russell > wrote in message
news:65C38F6B-2BFD-4874-86FC-...
> Vista Basic Machine started running very slowly and when I looked in Task
> Manager svchost.exe was using a 100% CPU. Using system internals process
> explorer it's the network service containing crytsvc, dnscach, KtmRm,
> NlaSvc,
> Tapisrv and Termservice.
>
> Looking inside the thread that is using the CPU is ntdll.dll
>
> I've ran all virus and spyware checkers I can and all show no problems. I've
> booted in safe mode and cleared all the softwaredistribution folder. The
> slow
> running does not affect safe mode but as the service is not started no
> great
> surprise. Windows Update doesn't work in safe mode either, thanks
> Microsoft.
>
> I tried to update AVG virus checker but it wanted KB929547 applied so I
> downloaded it and tried to run but after several hours all I got was
> install
> failed with 0x800706bb
>
> Any ideas??
>



 
Reply With Quote
 
propman
Guest
Posts: n/a

 
      05-22-2008
AJR wrote:
> take a look at http://blogs.technet.com/markrussinovich/rss.xml
>
> Scroll down for Mark's post on solving CPU spikces.
>
>


Thanks for posting the link....haven't had the time to do an in depth
read but it's a topic I've been meaning to explore and so am sure the
information will come in real handy.... :-)
 
Reply With Quote
 
Russell Jesson
Guest
Posts: n/a

 
      05-22-2008
Thanks for the suggestions no solution yet but more information.

The sysinternals process explorer has shown it’s a single thread causing the
problem and it’s identified as ntdll.dll!RtlUserThreadStart Killing this
thread fixes the problem but it returns on a reboot or possibly restart of
the service(s) I’ve only tried cryptsvc so far but that causes the problem to
reoccur.

Tried the Kernrate as suggested and it is showing ntkrnlpa with fltmgr
second but the first it 80% the second was 4%.

Looking at the stack information from process explorer I see top of the list
ntkrnlpa.exe!KiUnexpectedInterrupt+0x40

Also I’ve updated all the drivers on the system and anything else I can
think of with no effect.


"AJR" wrote:

> take a look at http://blogs.technet.com/markrussinovich/rss.xml
>
> Scroll down for Mark's post on solving CPU spikces.
>
>
> "Russell Jesson" <Russell > wrote in message
> news:65C38F6B-2BFD-4874-86FC-...
> > Vista Basic Machine started running very slowly and when I looked in Task
> > Manager svchost.exe was using a 100% CPU. Using system internals process
> > explorer it's the network service containing crytsvc, dnscach, KtmRm,
> > NlaSvc,
> > Tapisrv and Termservice.
> >
> > Looking inside the thread that is using the CPU is ntdll.dll
> >
> > I've ran all virus and spyware checkers I can and all show no problems. I've
> > booted in safe mode and cleared all the softwaredistribution folder. The
> > slow
> > running does not affect safe mode but as the service is not started no
> > great
> > surprise. Windows Update doesn't work in safe mode either, thanks
> > Microsoft.
> >
> > I tried to update AVG virus checker but it wanted KB929547 applied so I
> > downloaded it and tried to run but after several hours all I got was
> > install
> > failed with 0x800706bb
> >
> > Any ideas??
> >

>
>
>

 
Reply With Quote
 
Mikey2OZ
Guest
Posts: n/a

 
      05-25-2008
I'm running Windows Server 2008 AD on my laptop that I use an an Instructors server in the classroom. I've left it on for a couple of days, and this morning, all 4GBs of RAM were used and my CPUs were sitting on 100%.&nbsp; I brought up Process Explorer and checked. Under a scvhost.exe, there were over 600 taskeng.exe jobs scheduled.&nbsp; I open up the object, and there are two ntdll.dll!RtlUserThreadStart threads.&nbsp; I tried to get the laptop to reboot,&nbsp;but apparently my RAM crashed into the virtual memory and went BSOD.When I reboot, there are not tasks scheduled.&nbsp;&nbsp; After a few hours, there are a couple of dozen. Then there is more and more.&nbsp; It's been about 12 hours since I rebooted, and I have about 130 taskeng.exe jobs pending.Any Ideas?


Post Originated from Vista Support Forums
 
Reply With Quote
 
Russell Jesson
Guest
Posts: n/a

 
      05-28-2008
Follow up to the problem.

The only way of fixing it was to do a total re-install of Vista. Once that
was done and all the updates applied and applications re-installed the
machine runs without problems.

Obviously there was some sort of corruption somewhere but there was no
malware detected anywhere on the system. The only two items that may be
related was there were some dodgy MP3 played which may have automatically
downloaded a codec containing malware. Also the system was reporting traced
of having Norton installed and to my knowledge it had never been near the
system.

"Russell Jesson" wrote:

> Vista Basic Machine started running very slowly and when I looked in Task
> Manager svchost.exe was using a 100% CPU. Using system internals process
> explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
> Tapisrv and Termservice.
>
> Looking inside the thread that is using the CPU is ntdll.dll
>
> I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
> booted in safe mode and cleared all the softwaredistribution folder. The slow
> running does not affect safe mode but as the service is not started no great
> surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.
>
> I tried to update AVG virus checker but it wanted KB929547 applied so I
> downloaded it and tried to run but after several hours all I got was install
> failed with 0x800706bb
>
> Any ideas??
>

 
Reply With Quote
 
Jason
Guest
Posts: n/a

 
      05-28-2008
It's typical for a virus to inject itself into a svchost process. I would do a full scan/reinstall.


Post Originated from Vista Support Forums
 
Reply With Quote
 
Sean Baltzar
Guest
Posts: n/a

 
      06-29-2011

Hi dudes.

Im realy not anything near a pro or anything when it comes to computers but i have solved the problem with the "ntdll dll RtlUserThreadStart" thingy. I unistalled the printer it was a hp deskjet something.

Best regards Sean

Oooh, i just noticed this is an realy old thread . Hope someone that need some help with svchost going bonkers notice this post.

> On Wednesday, May 21, 2008 7:57 AM Russell Jesso wrote:


> Vista Basic Machine started running very slowly and when I looked in Task
> Manager svchost.exe was using a 100% CPU. Using system internals process
> explorer it’s the network service containing crytsvc, dnscach, KtmRm, NlaSvc,
> Tapisrv and Termservice.
>
> Looking inside the thread that is using the CPU is ntdll.dll
>
> I’ve ran all virus and spyware checkers I can and all show no problems. I’ve
> booted in safe mode and cleared all the softwaredistribution folder. The slow
> running does not affect safe mode but as the service is not started no great
> surprise. Windows Update doesn't work in safe mode either, thanks Microsoft.
>
> I tried to update AVG virus checker but it wanted KB929547 applied so I
> downloaded it and tried to run but after several hours all I got was install
> failed with 0x800706bb
>
> Any ideas??



>> On Wednesday, May 21, 2008 10:23 AM Stephen Caudill wrote:


>> For what it's worth, I had the same problem about a month ago. It was
>> svchost.exe that was spiking the CPU. Did some trial and error with
>> services and couldn't nail it down. It lasted about 2 weeks
>> (intermittently) and has now not reared its ugly head for a couple of
>> weeks now.
>>
>> I think I read somewhere that it was a conflict with the virus app? I'm
>> using eTrust. Not sure, but possibly an update fixed it? Good luck!
>> -scaudill
>>
>>
>>
>> Russell Jesson wrote:



>>> On Wednesday, May 21, 2008 10:47 AM RussellJesso wrote:


>>> I just swapped from AVG7.5 to 8.0 and problem is still there However making
>>> some progress as if I look at the Process explorer properties for svchost the
>>> thread it reports is ntdll.dll!RtlUserThreadStart and suspending this makes
>>> the machine usable. So I’ve been trying various things to no effect to help
>>> the problem.
>>>
>>> The AVG8 scan finds nothing.
>>>
>>> Currently uninstalling Windows Live xxxx as there are reports, all be it old
>>> ones, that this can cause problems and I’m also in the process of getting the
>>> flashplayer update as this was also mentioned.
>>>
>>> However even with the CPU down very low (with thread suspended) the Windows
>>> Installer crawls along, well uninstalling in this case.
>>> I’ll keep looking and report back on findings.
>>>
>>>
>>> "Stephen Caudill" wrote:



>>>> On Wednesday, May 21, 2008 6:24 PM AJR wrote:


>>>> take a look at http://blogs.technet.com/markrussinovich/rss.xml
>>>>
>>>> Scroll down for Mark's post on solving CPU spikces.



>>>>> On Wednesday, May 21, 2008 8:02 PM propman wrote:


>>>>> AJR wrote:
>>>>>
>>>>> Thanks for posting the link....have not had the time to do an in depth
>>>>> read but it is a topic I have been meaning to explore and so am sure the
>>>>> information will come in real handy.... :-)



>>>>>> On Thursday, May 22, 2008 5:02 AM RussellJesso wrote:


>>>>>> Thanks for the suggestions no solution yet but more information.
>>>>>>
>>>>>> The sysinternals process explorer has shown it’s a single thread causing the
>>>>>> problem and it’s identified as ntdll.dll!RtlUserThreadStart Killing this
>>>>>> thread fixes the problem but it returns on a reboot or possibly restart of
>>>>>> the service(s) I’ve only tried cryptsvc so far but that causes the problem to
>>>>>> reoccur.
>>>>>>
>>>>>> Tried the Kernrate as suggested and it is showing ntkrnlpa with fltmgr
>>>>>> second but the first it 80% the second was 4%.
>>>>>>
>>>>>> Looking at the stack information from process explorer I see top of the list
>>>>>> ntkrnlpa.exe!KiUnexpectedInterrupt+0x40
>>>>>>
>>>>>> Also I’ve updated all the drivers on the system and anything else I can
>>>>>> think of with no effect.
>>>>>>
>>>>>>
>>>>>> "AJR" wrote:



>>>>>>> On Sunday, May 25, 2008 3:33 AM Mikey2OZ wrote:


>>>>>>> I'm running Windows Server 2008 AD on my laptop that I use an an Instructors server in the classroom. I've left it on for a couple of days, and this morning, all 4GBs of RAM were used and my CPUs were sitting on 100%.&nbsp; I brought up Process Explorer and checked. Under a scvhost.exe, there were over 600 taskeng.exe jobs scheduled.&nbsp; I open up the object, and there are two ntdll.dll!RtlUserThreadStart threads.&nbsp; I tried to get the laptop to reboot,&nbsp;but apparently my RAM crashed into the virtual memory and went BSOD.When I reboot, there are not tasks scheduled.&nbsp;&nbsp; After a few hours, there are a couple of dozen. Then there is more and more.&nbsp; It's been about 12 hours since I rebooted, and I have about 130 taskeng.exe jobs pending.Any Ideas?
>>>>>>>
>>>>>>>
>>>>>>> Post Originated from Vista Support Forums



>>>>>>>> On Wednesday, May 28, 2008 4:37 AM RussellJesso wrote:


>>>>>>>> Follow up to the problem.
>>>>>>>>
>>>>>>>> The only way of fixing it was to do a total re-install of Vista. Once that
>>>>>>>> was done and all the updates applied and applications re-installed the
>>>>>>>> machine runs without problems.
>>>>>>>>
>>>>>>>> Obviously there was some sort of corruption somewhere but there was no
>>>>>>>> malware detected anywhere on the system. The only two items that may be
>>>>>>>> related was there were some dodgy MP3 played which may have automatically
>>>>>>>> downloaded a codec containing malware. Also the system was reporting traced
>>>>>>>> of having Norton installed and to my knowledge it had never been near the
>>>>>>>> system.
>>>>>>>>
>>>>>>>> "Russell Jesson" wrote:



>>>>>>>>> On Wednesday, May 28, 2008 11:34 AM Jason wrote:


>>>>>>>>> it is typical for a virus to inject itself into a svchost process. I would do a full scan/reinstall.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Post Originated from Vista Support Forums




 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows Update / Microsoft Update / svchost / Autoupdate / 100% CPU Patrick Hopp Windows Update 7 04-23-2007 03:26 PM
svchost.exe - 100% CPU usage, and 100 MB memory usage. bildos Windows Server 3 01-31-2007 10:09 PM
Windows Update Service (svchost.exe) use 100% of CPU Gerhard Wilfinger Windows Update 12 12-01-2006 06:39 AM
svchost keeps running CPU at 100% when at Windows Update site, MB of usage jumps from 50 to 95 randomly Cymbal Man Freq. Windows Update 0 11-06-2006 10:31 PM
Windows Update causes svchost.exe 100% CPU tjwib Windows Update 5 01-13-2005 09:32 PM