PCbanter

PCbanter (http://www.pcbanter.net/index.php)
-   Performance and Maintainance of XP (http://www.pcbanter.net/forumdisplay.php?f=19)
-   -   SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed) (http://www.pcbanter.net/showthread.php?t=427634)

Philip Herlihy April 14th 04 10:40 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
(Thanks for looking!)

I have a friend's machine (running XP Home, fully patched) which is unusably
slow. I can see that LSASS.exe together with one instance of SVCHOST.exe
are effectively using all CPU resources. I've run updated versions of:
# Norton Antivirus
# McAfee Stinger
# Panda Online scan
# Trend Micro Online scan
# Adaware
# Spybot
... and although a few nasties were removed, the problem remains.

I've downloaded the (excellent) Process Explorer from Sysinternals.com.
I've found that if I suspend that one SVCHOST instance, the LSASS process
goes quiet. Looking inside the SVCHOST I can see that the thread
TERMSRV.dll appears to be accounting for the activity, and if I selectively
kill that thread, the machine goes back to normal.

I've studied the registry keys:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
... but my untutored eye can't spot anything wrong.

A typical stack trace of the TERMSRV thread is:
ntdll.dll+0x8090304
RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
RPCRT4.dll!NdrContextHandleInitialize+0x82e
RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
RPCRT4.dll!I_RpcSendReceive+0x1f
ADVAPI32.dll!LsaRetrievePrivateData+0xdf
termsrv.dll+0x201d9
termsrv.dll+0x20428
termsrv.dll+0xd1fc
kernel32.dll!RegisterWaitForInputIdle+0x43

I thought I was a smart geezer, but this one has me beaten. Next step is a
format and reinstall, unless someone has an idea.

--
####################
## PH, London
####################



Carey Frisch [MVP] April 14th 04 10:45 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Install the following patch:

Windows XP Patch: Remote Assistance
http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

-------------------------------------------------------------------------------------------

"Philip Herlihy" wrote in message:
...

| (Thanks for looking!)
|
| I have a friend's machine (running XP Home, fully patched) which is unusably
| slow. I can see that LSASS.exe together with one instance of SVCHOST.exe
| are effectively using all CPU resources. I've run updated versions of:
| # Norton Antivirus
| # McAfee Stinger
| # Panda Online scan
| # Trend Micro Online scan
| # Adaware
| # Spybot
| .. and although a few nasties were removed, the problem remains.
|
| I've downloaded the (excellent) Process Explorer from Sysinternals.com.
| I've found that if I suspend that one SVCHOST instance, the LSASS process
| goes quiet. Looking inside the SVCHOST I can see that the thread
| TERMSRV.dll appears to be accounting for the activity, and if I selectively
| kill that thread, the machine goes back to normal.
|
| I've studied the registry keys:
| # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
| # HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
| .. but my untutored eye can't spot anything wrong.
|
| A typical stack trace of the TERMSRV thread is:
| ntdll.dll+0x8090304
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
| RPCRT4.dll!NdrContextHandleInitialize+0x82e
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
| RPCRT4.dll!I_RpcSendReceive+0x1f
| ADVAPI32.dll!LsaRetrievePrivateData+0xdf
| termsrv.dll+0x201d9
| termsrv.dll+0x20428
| termsrv.dll+0xd1fc
| kernel32.dll!RegisterWaitForInputIdle+0x43
|
| I thought I was a smart geezer, but this one has me beaten. Next step is a
| format and reinstall, unless someone has an idea.
|
| --
| ####################
| ## PH, London
| ####################
|
|

Carey Frisch [MVP] April 14th 04 10:45 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Install the following patch:

Windows XP Patch: Remote Assistance
http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

-------------------------------------------------------------------------------------------

"Philip Herlihy" wrote in message:
...

| (Thanks for looking!)
|
| I have a friend's machine (running XP Home, fully patched) which is unusably
| slow. I can see that LSASS.exe together with one instance of SVCHOST.exe
| are effectively using all CPU resources. I've run updated versions of:
| # Norton Antivirus
| # McAfee Stinger
| # Panda Online scan
| # Trend Micro Online scan
| # Adaware
| # Spybot
| .. and although a few nasties were removed, the problem remains.
|
| I've downloaded the (excellent) Process Explorer from Sysinternals.com.
| I've found that if I suspend that one SVCHOST instance, the LSASS process
| goes quiet. Looking inside the SVCHOST I can see that the thread
| TERMSRV.dll appears to be accounting for the activity, and if I selectively
| kill that thread, the machine goes back to normal.
|
| I've studied the registry keys:
| # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
| # HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
| .. but my untutored eye can't spot anything wrong.
|
| A typical stack trace of the TERMSRV thread is:
| ntdll.dll+0x8090304
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
| RPCRT4.dll!NdrContextHandleInitialize+0x82e
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
| RPCRT4.dll!I_RpcSendReceive+0x1f
| ADVAPI32.dll!LsaRetrievePrivateData+0xdf
| termsrv.dll+0x201d9
| termsrv.dll+0x20428
| termsrv.dll+0xd1fc
| kernel32.dll!RegisterWaitForInputIdle+0x43
|
| I thought I was a smart geezer, but this one has me beaten. Next step is a
| format and reinstall, unless someone has an idea.
|
| --
| ####################
| ## PH, London
| ####################
|
|

Philip Herlihy April 14th 04 11:09 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Thanks, Carey. I'm very grateful for the suggestion, but it didn't work.
The machine has XP Home with SP1 (I should have specified this) and the
patch is apparently pre-SP1 (an error-message said it could only be applied
if no SPs were already there.

I'm becoming increasingly resigned to a re-format and install, but my
relatively untechnical friend will lose heaps of settings, passwords and so
on. :-(

--
####################
## PH, London
####################
"Carey Frisch [MVP]" wrote in message
...
Install the following patch:

Windows XP Patch: Remote Assistance

http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

--------------------------------------------------------------------------

-----------------

"Philip Herlihy" wrote in message:
...

| (Thanks for looking!)
|
| I have a friend's machine (running XP Home, fully patched) which is

unusably
| slow. I can see that LSASS.exe together with one instance of

SVCHOST.exe
| are effectively using all CPU resources. I've run updated versions of:
| # Norton Antivirus
| # McAfee Stinger
| # Panda Online scan
| # Trend Micro Online scan
| # Adaware
| # Spybot
| .. and although a few nasties were removed, the problem remains.
|
| I've downloaded the (excellent) Process Explorer from Sysinternals.com.
| I've found that if I suspend that one SVCHOST instance, the LSASS

process
| goes quiet. Looking inside the SVCHOST I can see that the thread
| TERMSRV.dll appears to be accounting for the activity, and if I

selectively
| kill that thread, the machine goes back to normal.
|
| I've studied the registry keys:
| # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
| # HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\SvcHost
| .. but my untutored eye can't spot anything wrong.
|
| A typical stack trace of the TERMSRV thread is:
| ntdll.dll+0x8090304
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
| RPCRT4.dll!NdrContextHandleInitialize+0x82e
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
| RPCRT4.dll!I_RpcSendReceive+0x1f
| ADVAPI32.dll!LsaRetrievePrivateData+0xdf
| termsrv.dll+0x201d9
| termsrv.dll+0x20428
| termsrv.dll+0xd1fc
| kernel32.dll!RegisterWaitForInputIdle+0x43
|
| I thought I was a smart geezer, but this one has me beaten. Next step

is a
| format and reinstall, unless someone has an idea.
|
| --
| ####################
| ## PH, London
| ####################
|
|




Philip Herlihy April 14th 04 11:10 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Thanks, Carey. I'm very grateful for the suggestion, but it didn't work.
The machine has XP Home with SP1 (I should have specified this) and the
patch is apparently pre-SP1 (an error-message said it could only be applied
if no SPs were already there.

I'm becoming increasingly resigned to a re-format and install, but my
relatively untechnical friend will lose heaps of settings, passwords and so
on. :-(

--
####################
## PH, London
####################
"Carey Frisch [MVP]" wrote in message
...
Install the following patch:

Windows XP Patch: Remote Assistance

http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

--------------------------------------------------------------------------

-----------------

"Philip Herlihy" wrote in message:
...

| (Thanks for looking!)
|
| I have a friend's machine (running XP Home, fully patched) which is

unusably
| slow. I can see that LSASS.exe together with one instance of

SVCHOST.exe
| are effectively using all CPU resources. I've run updated versions of:
| # Norton Antivirus
| # McAfee Stinger
| # Panda Online scan
| # Trend Micro Online scan
| # Adaware
| # Spybot
| .. and although a few nasties were removed, the problem remains.
|
| I've downloaded the (excellent) Process Explorer from Sysinternals.com.
| I've found that if I suspend that one SVCHOST instance, the LSASS

process
| goes quiet. Looking inside the SVCHOST I can see that the thread
| TERMSRV.dll appears to be accounting for the activity, and if I

selectively
| kill that thread, the machine goes back to normal.
|
| I've studied the registry keys:
| # HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
| # HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\SvcHost
| .. but my untutored eye can't spot anything wrong.
|
| A typical stack trace of the TERMSRV thread is:
| ntdll.dll+0x8090304
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
| RPCRT4.dll!NdrContextHandleInitialize+0x82e
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
| RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
| RPCRT4.dll!I_RpcSendReceive+0x1f
| ADVAPI32.dll!LsaRetrievePrivateData+0xdf
| termsrv.dll+0x201d9
| termsrv.dll+0x20428
| termsrv.dll+0xd1fc
| kernel32.dll!RegisterWaitForInputIdle+0x43
|
| I thought I was a smart geezer, but this one has me beaten. Next step

is a
| format and reinstall, unless someone has an idea.
|
| --
| ####################
| ## PH, London
| ####################
|
|




Quaoar April 15th 04 02:50 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Philip Herlihy wrote:
Thanks, Carey. I'm very grateful for the suggestion, but it didn't
work. The machine has XP Home with SP1 (I should have specified this)
and the patch is apparently pre-SP1 (an error-message said it could
only be applied if no SPs were already there.

I'm becoming increasingly resigned to a re-format and install, but my
relatively untechnical friend will lose heaps of settings, passwords
and so on. :-(

Install the following patch:

Windows XP Patch: Remote Assistance


http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

---------------------------------------------------------------------

-----
-----------------

"Philip Herlihy" wrote in message:
...

(Thanks for looking!)

I have a friend's machine (running XP Home, fully patched) which is
unusably slow. I can see that LSASS.exe together with one instance
of SVCHOST.exe are effectively using all CPU resources. I've run
updated versions of: # Norton Antivirus
# McAfee Stinger
# Panda Online scan
# Trend Micro Online scan
# Adaware
# Spybot
.. and although a few nasties were removed, the problem remains.

I've downloaded the (excellent) Process Explorer from
Sysinternals.com. I've found that if I suspend that one SVCHOST
instance, the LSASS process goes quiet. Looking inside the SVCHOST
I can see that the thread TERMSRV.dll appears to be accounting for
the activity, and if I selectively kill that thread, the machine
goes back to normal.

I've studied the registry keys:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SvcHost .. but my untutored eye can't spot
anything wrong.

A typical stack trace of the TERMSRV thread is:
ntdll.dll+0x8090304
RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
RPCRT4.dll!NdrContextHandleInitialize+0x82e
RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
RPCRT4.dll!I_RpcSendReceive+0x1f
ADVAPI32.dll!LsaRetrievePrivateData+0xdf
termsrv.dll+0x201d9
termsrv.dll+0x20428
termsrv.dll+0xd1fc
kernel32.dll!RegisterWaitForInputIdle+0x43

I thought I was a smart geezer, but this one has me beaten. Next
step is a format and reinstall, unless someone has an idea.

--
####################
## PH, London
####################


What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



Quaoar April 15th 04 02:50 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Philip Herlihy wrote:
Thanks, Carey. I'm very grateful for the suggestion, but it didn't
work. The machine has XP Home with SP1 (I should have specified this)
and the patch is apparently pre-SP1 (an error-message said it could
only be applied if no SPs were already there.

I'm becoming increasingly resigned to a re-format and install, but my
relatively untechnical friend will lose heaps of settings, passwords
and so on. :-(

Install the following patch:

Windows XP Patch: Remote Assistance


http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

---------------------------------------------------------------------

-----
-----------------

"Philip Herlihy" wrote in message:
...

(Thanks for looking!)

I have a friend's machine (running XP Home, fully patched) which is
unusably slow. I can see that LSASS.exe together with one instance
of SVCHOST.exe are effectively using all CPU resources. I've run
updated versions of: # Norton Antivirus
# McAfee Stinger
# Panda Online scan
# Trend Micro Online scan
# Adaware
# Spybot
.. and although a few nasties were removed, the problem remains.

I've downloaded the (excellent) Process Explorer from
Sysinternals.com. I've found that if I suspend that one SVCHOST
instance, the LSASS process goes quiet. Looking inside the SVCHOST
I can see that the thread TERMSRV.dll appears to be accounting for
the activity, and if I selectively kill that thread, the machine
goes back to normal.

I've studied the registry keys:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SvcHost .. but my untutored eye can't spot
anything wrong.

A typical stack trace of the TERMSRV thread is:
ntdll.dll+0x8090304
RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
RPCRT4.dll!NdrContextHandleInitialize+0x82e
RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
RPCRT4.dll!I_RpcSendReceive+0x1f
ADVAPI32.dll!LsaRetrievePrivateData+0xdf
termsrv.dll+0x201d9
termsrv.dll+0x20428
termsrv.dll+0xd1fc
kernel32.dll!RegisterWaitForInputIdle+0x43

I thought I was a smart geezer, but this one has me beaten. Next
step is a format and reinstall, unless someone has an idea.

--
####################
## PH, London
####################


What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



Quaoar April 15th 04 02:50 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Philip Herlihy wrote:
Thanks, Carey. I'm very grateful for the suggestion, but it didn't
work. The machine has XP Home with SP1 (I should have specified this)
and the patch is apparently pre-SP1 (an error-message said it could
only be applied if no SPs were already there.

I'm becoming increasingly resigned to a re-format and install, but my
relatively untechnical friend will lose heaps of settings, passwords
and so on. :-(

Install the following patch:

Windows XP Patch: Remote Assistance


http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

---------------------------------------------------------------------

-----
-----------------

"Philip Herlihy" wrote in message:
...

(Thanks for looking!)

I have a friend's machine (running XP Home, fully patched) which is
unusably slow. I can see that LSASS.exe together with one instance
of SVCHOST.exe are effectively using all CPU resources. I've run
updated versions of: # Norton Antivirus
# McAfee Stinger
# Panda Online scan
# Trend Micro Online scan
# Adaware
# Spybot
.. and although a few nasties were removed, the problem remains.

I've downloaded the (excellent) Process Explorer from
Sysinternals.com. I've found that if I suspend that one SVCHOST
instance, the LSASS process goes quiet. Looking inside the SVCHOST
I can see that the thread TERMSRV.dll appears to be accounting for
the activity, and if I selectively kill that thread, the machine
goes back to normal.

I've studied the registry keys:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SvcHost .. but my untutored eye can't spot
anything wrong.

A typical stack trace of the TERMSRV thread is:
ntdll.dll+0x8090304
RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
RPCRT4.dll!NdrContextHandleInitialize+0x82e
RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
RPCRT4.dll!I_RpcSendReceive+0x1f
ADVAPI32.dll!LsaRetrievePrivateData+0xdf
termsrv.dll+0x201d9
termsrv.dll+0x20428
termsrv.dll+0xd1fc
kernel32.dll!RegisterWaitForInputIdle+0x43

I thought I was a smart geezer, but this one has me beaten. Next
step is a format and reinstall, unless someone has an idea.

--
####################
## PH, London
####################


What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



Quaoar April 15th 04 02:51 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Philip Herlihy wrote:
Thanks, Carey. I'm very grateful for the suggestion, but it didn't
work. The machine has XP Home with SP1 (I should have specified this)
and the patch is apparently pre-SP1 (an error-message said it could
only be applied if no SPs were already there.

I'm becoming increasingly resigned to a re-format and install, but my
relatively untechnical friend will lose heaps of settings, passwords
and so on. :-(

Install the following patch:

Windows XP Patch: Remote Assistance


http://www.microsoft.com/downloads/d...A-9A33857ECEBA

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/\

---------------------------------------------------------------------

-----
-----------------

"Philip Herlihy" wrote in message:
...

(Thanks for looking!)

I have a friend's machine (running XP Home, fully patched) which is
unusably slow. I can see that LSASS.exe together with one instance
of SVCHOST.exe are effectively using all CPU resources. I've run
updated versions of: # Norton Antivirus
# McAfee Stinger
# Panda Online scan
# Trend Micro Online scan
# Adaware
# Spybot
.. and although a few nasties were removed, the problem remains.

I've downloaded the (excellent) Process Explorer from
Sysinternals.com. I've found that if I suspend that one SVCHOST
instance, the LSASS process goes quiet. Looking inside the SVCHOST
I can see that the thread TERMSRV.dll appears to be accounting for
the activity, and if I selectively kill that thread, the machine
goes back to normal.

I've studied the registry keys:
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SvcHost .. but my untutored eye can't spot
anything wrong.

A typical stack trace of the TERMSRV thread is:
ntdll.dll+0x8090304
RPCRT4.dll!I_RpcTransGetThreadEvent+0x9d7
RPCRT4.dll!I_RpcTransGetThreadEvent+0x147b
RPCRT4.dll!NdrContextHandleInitialize+0x82e
RPCRT4.dll!I_RpcTransGetThreadEvent+0x5d0
RPCRT4.dll!I_RpcTransGetThreadEvent+0x557
RPCRT4.dll!I_RpcTransGetThreadEvent+0x3bc
RPCRT4.dll!I_RpcTransGetThreadEvent+0x2f6
RPCRT4.dll!I_RpcTransGetThreadEvent+0x26f
RPCRT4.dll!I_RpcSendReceive+0x1f
ADVAPI32.dll!LsaRetrievePrivateData+0xdf
termsrv.dll+0x201d9
termsrv.dll+0x20428
termsrv.dll+0xd1fc
kernel32.dll!RegisterWaitForInputIdle+0x43

I thought I was a smart geezer, but this one has me beaten. Next
step is a format and reinstall, unless someone has an idea.

--
####################
## PH, London
####################


What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



Philip Herlihy April 15th 04 02:58 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
"Quaoar" wrote in message
...
What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



I've gazed at the startup list but I haven't tried selectively unchecking
them. Part of the problem is that the thing can take an hour to boot, it's
so slow! It'll take me several days. I'll ponder whether I can face it...



--
####################
## PH, London
####################



Philip Herlihy April 15th 04 02:58 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
"Quaoar" wrote in message
...
What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



I've gazed at the startup list but I haven't tried selectively unchecking
them. Part of the problem is that the thing can take an hour to boot, it's
so slow! It'll take me several days. I'll ponder whether I can face it...



--
####################
## PH, London
####################



Philip Herlihy April 15th 04 02:58 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
"Quaoar" wrote in message
...
What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



I've gazed at the startup list but I haven't tried selectively unchecking
them. Part of the problem is that the thing can take an hour to boot, it's
so slow! It'll take me several days. I'll ponder whether I can face it...



--
####################
## PH, London
####################



Philip Herlihy April 15th 04 03:00 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
"Quaoar" wrote in message
...
What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



I've gazed at the startup list but I haven't tried selectively unchecking
them. Part of the problem is that the thing can take an hour to boot, it's
so slow! It'll take me several days. I'll ponder whether I can face it...



--
####################
## PH, London
####################



Rocket J. Squirrel April 15th 04 03:00 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Quaoar's advice is the only way for you to determine whether something being
run at startup is the cause of your problem. You need to follow that advice
no matter how long it takes.

Rocky

"Philip Herlihy" wrote in message
...
"Quaoar" wrote in message
...
What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



I've gazed at the startup list but I haven't tried selectively unchecking
them. Part of the problem is that the thing can take an hour to boot,

it's
so slow! It'll take me several days. I'll ponder whether I can face

it...



--
####################
## PH, London
####################





Rocket J. Squirrel April 15th 04 03:00 PM

SVCHOST & LSASS hogging CPU, no virus found. I'm completely stuck! (detailed)
 
Quaoar's advice is the only way for you to determine whether something being
run at startup is the cause of your problem. You need to follow that advice
no matter how long it takes.

Rocky

"Philip Herlihy" wrote in message
...
"Quaoar" wrote in message
...
What is being run at startup as indicated in msconfig/startup tab? Can
you track the source of this problem by selectively unchecking the
startups one at a time?

Q



I've gazed at the startup list but I haven't tried selectively unchecking
them. Part of the problem is that the thing can take an hour to boot,

it's
so slow! It'll take me several days. I'll ponder whether I can face

it...



--
####################
## PH, London
####################






All times are GMT +1. The time now is 09:50 PM.

Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright © 2004 - 2006 PCbanter
Comments are property of their posters