svchost still consuming CPU after boot

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

"MG" <> wrote in message
news:8A7781C6-074E-409C-AEA5-...
> I've read many posts regarding the lengthy start-up issues associated with
> svchost and MS updates - mine appears somewhat different. After booting
> up,
> and after all services have started, my machine runs through cycles of
> CPU -
> viewed on Task Manager these spkies are typically around 40% of CPU,
> sometimes higher, and are occurring on a very consistent cycle, around
> every
> 6-8 seconds. This happens even with nothing open on my machine.
>
> I've run all the scans to check for viruses and spyware. I can see that
> these processes running are within svchost.exe and/or services.exe. I've
> tried shutting down everything that is in my startup and the problem still
> exists. This cycling of CPU goes on non-stop, all the time. As it eats
> CPU
> on these cycles, other processes are now affected - example, a full virus
> scan now takes about twice as long as it used to. As there are tons of
> tasks
> running within svchost, I have no idea how to narrow this down. I'm
> running
> XP Home/SP2 and have applied all updates automatically. Any ideas?
>
The most usual cause recently for the 100% svchost usage is
a problem with the Windows Update Service which is fixed by upgrading to the
Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
here:
http://download.windowsupdate.com/v7...gent30-x86.exe
and installing the updated KB927891 hotfix, here:
http://support.microsoft.com/?kbid=927891 for a complete fix.
--
In the case that you are seeing associated with the DNS Client, I would
suspect a long known issue that occurs when using a HOSTS file for ad
blocking. See the discussion here:
http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,
then it's normally best to just Disable the DNS Client Service.

Kayman wrote:

>
> "MG" <> wrote in message
> news:8A7781C6-074E-409C-AEA5-...
>
>> I've read many posts regarding the lengthy start-up issues associated
>> with
>> svchost and MS updates - mine appears somewhat different. After
>> booting up,
>> and after all services have started, my machine runs through cycles of
>> CPU -
>> viewed on Task Manager these spkies are typically around 40% of CPU,
>> sometimes higher, and are occurring on a very consistent cycle, around
>> every
>> 6-8 seconds. This happens even with nothing open on my machine.
>>
>> I've run all the scans to check for viruses and spyware. I can see that
>> these processes running are within svchost.exe and/or services.exe. I've
>> tried shutting down everything that is in my startup and the problem
>> still
>> exists. This cycling of CPU goes on non-stop, all the time. As it
>> eats CPU
>> on these cycles, other processes are now affected - example, a full virus
>> scan now takes about twice as long as it used to. As there are tons
>> of tasks
>> running within svchost, I have no idea how to narrow this down. I'm
>> running
>> XP Home/SP2 and have applied all updates automatically. Any ideas?
>>
> The most usual cause recently for the 100% svchost usage is
> a problem with the Windows Update Service which is fixed by upgrading to
> the
> Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
> here:
> http://download.windowsupdate.com/v7...gent30-x86.exe
>
> and installing the updated KB927891 hotfix, here:
> http://support.microsoft.com/?kbid=927891 for a complete fix.
> --
> In the case that you are seeing associated with the DNS Client, I would
> suspect a long known issue that occurs when using a HOSTS file for ad
> blocking. See the discussion here:
> http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,
> then it's normally best to just Disable the DNS Client Service.
>

Is Spybot installed and is the Immunize feature Enabled ? This will also
cause DNS client side issues.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

I went through the agent update - indicated that I already had that version
in place. I also applied the hotfix indicated. Neither of these had any
impact on my issue.

"MowGreen [MVP]" wrote:

> Kayman wrote:
>
> >
> > "MG" <> wrote in message
> > news:8A7781C6-074E-409C-AEA5-...
> >
> >> I've read many posts regarding the lengthy start-up issues associated
> >> with
> >> svchost and MS updates - mine appears somewhat different. After
> >> booting up,
> >> and after all services have started, my machine runs through cycles of
> >> CPU -
> >> viewed on Task Manager these spkies are typically around 40% of CPU,
> >> sometimes higher, and are occurring on a very consistent cycle, around
> >> every
> >> 6-8 seconds. This happens even with nothing open on my machine.
> >>
> >> I've run all the scans to check for viruses and spyware. I can see that
> >> these processes running are within svchost.exe and/or services.exe. I've
> >> tried shutting down everything that is in my startup and the problem
> >> still
> >> exists. This cycling of CPU goes on non-stop, all the time. As it
> >> eats CPU
> >> on these cycles, other processes are now affected - example, a full virus
> >> scan now takes about twice as long as it used to. As there are tons
> >> of tasks
> >> running within svchost, I have no idea how to narrow this down. I'm
> >> running
> >> XP Home/SP2 and have applied all updates automatically. Any ideas?
> >>
> > The most usual cause recently for the 100% svchost usage is
> > a problem with the Windows Update Service which is fixed by upgrading to
> > the
> > Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
> > here:
> > http://download.windowsupdate.com/v7...gent30-x86.exe
> >
> > and installing the updated KB927891 hotfix, here:
> > http://support.microsoft.com/?kbid=927891 for a complete fix.
> > --
> > In the case that you are seeing associated with the DNS Client, I would
> > suspect a long known issue that occurs when using a HOSTS file for ad
> > blocking. See the discussion here:
> > http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,
> > then it's normally best to just Disable the DNS Client Service.
> >
>
> Is Spybot installed and is the Immunize feature Enabled ? This will also
> cause DNS client side issues.
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>

"MG" <> wrote in message
news:33BF0D3B-53B3-4DF7-97E3-...
>I went through the agent update - indicated that I already had that version
> in place. I also applied the hotfix indicated. Neither of these had any
> impact on my issue.
>
Tricky one.
Download Process Explorer:
http://www.microsoft.com/technet/sys...sExplorer.mspx
You've got to do some reading. Try to identify the item which is causing
your high cpu usage, and post to forum http://forum.sysinternals.com/ or
this ng.
Good luck

I repeat:

Is Spybot installed and is the Immunize feature Enabled ? This will also
cause DNS client side issues and a spike in CPU useage.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


MG wrote:

> I went through the agent update - indicated that I already had that version
> in place. I also applied the hotfix indicated. Neither of these had any
> impact on my issue.
>
> "MowGreen [MVP]" wrote:
>
>
>>Kayman wrote:
>>
>>
>>>"MG" <> wrote in message
>>>news:8A7781C6-074E-409C-AEA5-...
>>>
>>>
>>>>I've read many posts regarding the lengthy start-up issues associated
>>>>with
>>>>svchost and MS updates - mine appears somewhat different. After
>>>>booting up,
>>>>and after all services have started, my machine runs through cycles of
>>>>CPU -
>>>>viewed on Task Manager these spkies are typically around 40% of CPU,
>>>>sometimes higher, and are occurring on a very consistent cycle, around
>>>>every
>>>>6-8 seconds. This happens even with nothing open on my machine.
>>>>
>>>>I've run all the scans to check for viruses and spyware. I can see that
>>>>these processes running are within svchost.exe and/or services.exe. I've
>>>>tried shutting down everything that is in my startup and the problem
>>>>still
>>>>exists. This cycling of CPU goes on non-stop, all the time. As it
>>>>eats CPU
>>>>on these cycles, other processes are now affected - example, a full virus
>>>>scan now takes about twice as long as it used to. As there are tons
>>>>of tasks
>>>>running within svchost, I have no idea how to narrow this down. I'm
>>>>running
>>>>XP Home/SP2 and have applied all updates automatically. Any ideas?
>>>>
>>>
>>>The most usual cause recently for the 100% svchost usage is
>>>a problem with the Windows Update Service which is fixed by upgrading to
>>>the
>>>Windows Update Agent 3.0, v. 7.0.6000.374, for 32 bit machines is available
>>>here:
>>>http://download.windowsupdate.com/v7...gent30-x86.exe
>>>
>>>and installing the updated KB927891 hotfix, here:
>>>http://support.microsoft.com/?kbid=927891 for a complete fix.
>>>--
>>>In the case that you are seeing associated with the DNS Client, I would
>>>suspect a long known issue that occurs when using a HOSTS file for ad
>>>blocking. See the discussion here:
>>>http://www.mvps.org/winhelp2002/hosts.htm . If you are using a HOSTS file,
>>>then it's normally best to just Disable the DNS Client Service.
>>>
>>
>>Is Spybot installed and is the Immunize feature Enabled ? This will also
>>cause DNS client side issues.
>>
>>MowGreen [MVP 2003-2007]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>

"MG" <> schrieb:

>I went through the agent update - indicated that I already had that version
> in place. I also applied the hotfix indicated. Neither of these had any
> impact on my issue.

Do you have any Personal Firewall software installed? If true, try
a "netsh winsock reset" to be entered under "Run" in the Start menu,
hit [Enter] or click on "OK" and reboot Windows afterwards.

Bye,
Freudi

In reply to the last 3 posts - I do have a personal firewall - McAfee - I did
run the executable and rebooted - no difference.

I did recently run Spybot but have not set it up to do anything else. My
problem existed long before installing Spybot on my machine.

I have run Process Explorer on my machine. I'll attach here what I see -
basically, you can see the svchost.exe and services.exe are casuing the CPU
spikes - multiple occurrences are running - by the way, the spikes appear to
be perfectly timed in rythm, consistently 5-6 seconds apart. If I leave task
manager open for a while, I sometimes notice the spikes go up to close to
100% and then back down to 0 - at other times, the spikes are not as high.
They are, however, VERY consistent in their spacing 5-6 seconds apart. If
you look at the CPU usage history on task manager, it looks just like a heart
beat chart...

With process explorer, I see threads being created, but don't know what is
kicking them off, nor know how to determine. Here is what I see - first the
thread:

Kernal32.dll! CreateThread+0x22

Within this thread:

ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

There are multiple threads with the Kernal... info being created, and I can
see they are the threads consuming CPU. The info above is what I see within
the thread - I've posted this on other forums but it doesn't seem to mean
anything to anyone. Sure hope this helps.

"Ottmar Freudenberger" wrote:

> "MG" <> schrieb:
>
> >I went through the agent update - indicated that I already had that version
> > in place. I also applied the hotfix indicated. Neither of these had any
> > impact on my issue.
>
> Do you have any Personal Firewall software installed? If true, try
> a "netsh winsock reset" to be entered under "Run" in the Start menu,
> hit [Enter] or click on "OK" and reboot Windows afterwards.
>
> Bye,
> Freudi
>

"MG" <> schrieb:

> In reply to the last 3 posts - I do have a personal firewall - McAfee - I did
> run the executable and rebooted - no difference.

Hm, would you mind uninstalling the Personal Firewall cr^H^H and
enabling the Windows Firewall instead at least for test purposes?

> I did recently run Spybot but have not set it up to do anything else. My
> problem existed long before installing Spybot on my machine.

How long does the problem exists approximately?

Bye,
Freudi

Are you referring to simply turning off the McAfee fiewall as opposed to
uninstalling it? I did turn it off to see what happened - no change.

As for this issue - it has been present since the early part of this year -
somewhere around March or April.

"Ottmar Freudenberger" wrote:

> "MG" <> schrieb:
>
> > In reply to the last 3 posts - I do have a personal firewall - McAfee - I did
> > run the executable and rebooted - no difference.
>
> Hm, would you mind uninstalling the Personal Firewall cr^H^H and
> enabling the Windows Firewall instead at least for test purposes?
>
> > I did recently run Spybot but have not set it up to do anything else. My
> > problem existed long before installing Spybot on my machine.
>
> How long does the problem exists approximately?
>
> Bye,
> Freudi
>