100% CPU usage

Recently performance of my XP PC is very bad. After booting I get: 100% CPU
usage in task manager.
Processes:

svchost.exe
system


Any ideas?



--


|\ /|
| \/ |@rk
\../
\/os

Linea Recta wrote:
Recently performance of my XP PC is very bad. After booting I get: 100%
CPU usage in task manager.
Processes:

svchost.exe
system


Any ideas?

I have a theory, but you can test it.

Svchosts are a kind of deception. They contain multiple
executables inside. Some genius did this, to make them harder
to debug. And usually, all the guilty parties (the ones that
go rogue), are kept in the same svchost. I'm convinced they
do this, just to **** us off.

In WinXP Pro, you can open a command prompt, and do

tasklist /svc

That shows running processes, as well as the contents
of a svchost container. My PID 1468 for example,
has about fifteen things in that svchost.

On WinXP Home, that command isn't available. Or so they
tell me. Instead, you can use Process Explorer, click on
a svchost (or hold your mouse over it), you can do Properties
then click the Services tab, and it'll show you a list of
items inside that svchost.

http://technet.microsoft.com/en-us/s...rnals/bb896653

The one I have my eye on, is this one. It checks, amongst
other things, the dependencies of all the potential
Windows Updates. Currently, it gets a little confused when
figuring out what to do about your copy of Internet Explorer.
And in the process, chews up a CPU core. It will release the
core in around 30 minutes. Until Windows Update is checked
again, and then it'll go nuts again. The time constant
(the delay factor), has been getting worse month by month.
At one time, the delay was 5 minutes of 100% CPU, now it's
up to 30 minutes of 100% CPU.

wuauserv Automatic Updates wuauserv.dll

*******

I got this from some Microsoft blog post.

You can split it out into its own service by running:

"sc config service type= own"

And revert it via

"sc config service type= share"

In the case of the wayward Windows Update thing, that
means I'd do one of these. Once I do this, wuauserv
is kept in its own svchost. The idea being, if
it is using CPU cycles, it's the only one inside
a separate svchost, and it's guilty as charged.

sc config wuauserv type= own

So if I do that, reboot, check which svchost is
using 100%, and I find that one with wuauserv
inside it, then wuauserv is the one doing it.

*******

If your symptoms seem to match, the current workaround
is to install a pending Internet Explorer update.
There could be a KB2888505 update waiting for you.
You could go to Windows Update, check your update
history, and see if it is already installed.

Without going to Windows update, you can also get
the update as a standalone download. These are two
I could find.

------

Use this, if you're running IE6.

"Cumulative Security Update for Internet Explorer for Windows XP (KB2888505)
This update applies to Internet Explorer 6 with the following operating systems:
* Windows XP SP3"

http://www.microsoft.com/en-us/downl....aspx?id=41064

------

Use this, if you're running IE8.

Cumulative Security Update for Internet Explorer 8 for Windows XP (KB2888505)
This update applies to Internet Explorer 8 with the following operating systems:
* Windows XP SP3

http://www.microsoft.com/en-us/downl....aspx?id=41074

------

Now, how this works, it isn't like some code in that
package, "fixes" your Windows Update. Instead, the
introduction of that patch, juggles the dependencies
enough, that the wuauserv doesn't get stuck in a loop.
I haven't read anything to convince me, we've seen the
last of this bug.

If that theory doesn't pan out, and you can't finger
that particular one, you can still use some of those
ideas to help track it down. If necessary, you could
take all fifteen services out of the "common" svchost
and make them run separately. It probably requires a
reboot, to see the new orientation (type= own).

Paul

"Linea Recta" wrote in message ...
Recently performance of my XP PC is very bad. After booting I get: 100% CPU usage in task manager.
Processes:
svchost.exe
system Any ideas?


Disk Sides Will help
And how much Free Space on it ?

On Wed, 11 Dec 2013 18:14:58 -0500, Paul wrote:
Svchosts are a kind of deception. They contain multiple
executables inside. Some genius did this, to make them harder
to debug. And usually, all the guilty parties (the ones that
go rogue), are kept in the same svchost. I'm convinced they
do this, just to **** us off.

It for efficiency, but yes, it does make things much more complicated and
annoying when something goes wrong.

I wonder if I could use a copy of the svchost.exe but with different name,
in order to isolate a service in its own process.
For example, for the dnscache service, make a copy of "svchost.exe" as
"svchost_dnscache.exe". Then change the dnscache's service configuration to
point to "svchost_dnscache.exe" instead of "svchost.exe". Of course, keeping
all the command line parameters intact.

Linea Recta wrote:
Recently performance of my XP PC is very bad. After booting I get: 100%
CPU usage in task manager.
Processes:

svchost.exe
system

Any ideas?

Better look for a trojan, virus, rootkit, slug, malware.

JJ wrote:
On Wed, 11 Dec 2013 18:14:58 -0500, Paul wrote:
Svchosts are a kind of deception. They contain multiple
executables inside. Some genius did this, to make them harder
to debug. And usually, all the guilty parties (the ones that
go rogue), are kept in the same svchost. I'm convinced they
do this, just to **** us off.

It for efficiency, but yes, it does make things much more complicated and
annoying when something goes wrong.

I wonder if I could use a copy of the svchost.exe but with different name,
in order to isolate a service in its own process.
For example, for the dnscache service, make a copy of "svchost.exe" as
"svchost_dnscache.exe". Then change the dnscache's service configuration to
point to "svchost_dnscache.exe" instead of "svchost.exe". Of course, keeping
all the command line parameters intact.

I think I've seen that idea mentioned in the past.

By sheer luck, one of the two bookmarks I've got,
contains a similar idea. All I've ever done,
is the "sc config" thing, long enough to
confirm who is the guilty party.

http://blogs.msdn.com/b/spatdsg/arch...-services.aspx

http://support.microsoft.com/kb/934650

Paul

"Paul" schreef in bericht
...
Linea Recta wrote:
Recently performance of my XP PC is very bad. After booting I get: 100%
CPU usage in task manager.
Processes:

svchost.exe
system


Any ideas?

I have a theory, but you can test it.

Svchosts are a kind of deception. They contain multiple
executables inside. Some genius did this, to make them harder
to debug. And usually, all the guilty parties (the ones that
go rogue), are kept in the same svchost. I'm convinced they
do this, just to **** us off.

In WinXP Pro, you can open a command prompt, and do

tasklist /svc

That shows running processes, as well as the contents
of a svchost container. My PID 1468 for example,
has about fifteen things in that svchost.

On WinXP Home, that command isn't available. Or so they
tell me. Instead, you can use Process Explorer, click on
a svchost (or hold your mouse over it), you can do Properties
then click the Services tab, and it'll show you a list of
items inside that svchost.

http://technet.microsoft.com/en-us/s...rnals/bb896653

The one I have my eye on, is this one. It checks, amongst
other things, the dependencies of all the potential
Windows Updates. Currently, it gets a little confused when
figuring out what to do about your copy of Internet Explorer.
And in the process, chews up a CPU core. It will release the
core in around 30 minutes. Until Windows Update is checked
again, and then it'll go nuts again. The time constant
(the delay factor), has been getting worse month by month.
At one time, the delay was 5 minutes of 100% CPU, now it's
up to 30 minutes of 100% CPU.

wuauserv Automatic Updates wuauserv.dll

*******

I got this from some Microsoft blog post.

You can split it out into its own service by running:

"sc config service type= own"

And revert it via

"sc config service type= share"

In the case of the wayward Windows Update thing, that
means I'd do one of these. Once I do this, wuauserv
is kept in its own svchost. The idea being, if
it is using CPU cycles, it's the only one inside
a separate svchost, and it's guilty as charged.

sc config wuauserv type= own

So if I do that, reboot, check which svchost is
using 100%, and I find that one with wuauserv
inside it, then wuauserv is the one doing it.

*******

If your symptoms seem to match, the current workaround
is to install a pending Internet Explorer update.
There could be a KB2888505 update waiting for you.
You could go to Windows Update, check your update
history, and see if it is already installed.

Without going to Windows update, you can also get
the update as a standalone download. These are two
I could find.

------

Use this, if you're running IE6.

"Cumulative Security Update for Internet Explorer for Windows XP
(KB2888505)
This update applies to Internet Explorer 6 with the following operating
systems:
* Windows XP SP3"

http://www.microsoft.com/en-us/downl....aspx?id=41064

------

Use this, if you're running IE8.

Cumulative Security Update for Internet Explorer 8 for Windows XP
(KB2888505)
This update applies to Internet Explorer 8 with the following operating
systems:
* Windows XP SP3

http://www.microsoft.com/en-us/downl....aspx?id=41074

------

Now, how this works, it isn't like some code in that
package, "fixes" your Windows Update. Instead, the
introduction of that patch, juggles the dependencies
enough, that the wuauserv doesn't get stuck in a loop.
I haven't read anything to convince me, we've seen the
last of this bug.

If that theory doesn't pan out, and you can't finger
that particular one, you can still use some of those
ideas to help track it down. If necessary, you could
take all fifteen services out of the "common" svchost
and make them run separately. It probably requires a
reboot, to see the new orientation (type= own).

Paul



hi Paul,


I have been trying hard this evening to implement your ideas, but I can
hardly get things moving at all on the mentioned computer and am now mailing
from another computer. I did manage to run process explorer, but sadly the
list of services can't be saved in any sensible way, so I saved a
screenshot.
wuauserv was one of the services. While working I saw the yellow update
shield on the task bar dissapearing and reappearing and stuck again on 8% so
I suppose it is an update issue (again).

I'll see what I can do because I can hardly get anything moving with the OS
going nuts. Very annoying.


Thanks for reply.


--


|\ /|
| \/ |@rk
\../
\/os

At last I succeeded in performing the 9 MS security updates, which seem to
have resolved the 100% CPU usage problem. For now...



--


|\ /|
| \/ |@rk
\../
\/os

Linea Recta wrote:
At last I succeeded in performing the 9 MS security updates, which seem to
have resolved the 100% CPU usage problem. For now...

So it's probably the same problem I was seeing.

As far as I know, the problem isn't fixed, so
expect it to show up again.

Paul

The updates Paul notes have fixed all that I have run across.

If you want to see what is in the one that is hanging up you could
download and run "service host viewer". You'll have to match up on the
amount of memory used to get to the right one.

"Paul" schreef in bericht
...
Linea Recta wrote:
At last I succeeded in performing the 9 MS security updates, which seem
to have resolved the 100% CPU usage problem. For now...

So it's probably the same problem I was seeing.

As far as I know, the problem isn't fixed, so
expect it to show up again.



Still running fine and this evening again: another update (small, no reboot)



--


|\ /|
| \/ |@rk
\../
\/os

Linea Recta wrote:
"Paul" schreef in bericht
...
Linea Recta wrote:
At last I succeeded in performing the 9 MS security updates, which seem
to have resolved the 100% CPU usage problem. For now...
So it's probably the same problem I was seeing.

As far as I know, the problem isn't fixed, so
expect it to show up again.



Still running fine and this evening again: another update (small, no reboot)


The next time an Internet Explorer security update is offered,
we'll check this again :-)

Paul

On 12/13/2013 11:58 AM PT, Paul typed:

The next time an Internet Explorer security update is offered,
we'll check this again :-)

Did MS say they fixed it in December 2013 updates?
--
"Many ants kill a camel." --Turkish
/\___/\ Ant(Dude) @ http://antfarm.ma.cx (Personal Web Site)
/ /\ /\ \ Ant's Quality Foraged Links: http://aqfl.net
| |o o| |
\ _ / If crediting, then use Ant nickname and AQFL URL/link.
( ) If e-mailing, then axe ANT from its address if needed.
Ant is currently not listening to any songs on this computer.

In message , Paul in Houston TX
writes:
Linea Recta wrote:
Recently performance of my XP PC is very bad. After booting I get:
100% CPU usage in task manager.
Processes:
svchost.exe
system
Any ideas?

Better look for a trojan, virus, rootkit, slug, malware.

I had this - for something like two to four weeks - and it went away.

It _wasn't_ those two processes: in fact it wasn't any obvious culprit.

I don't _think_ it was malware - I did full scans, but also my router's
light wasn't constantly flashing so I hadn't been pwned as part of a
botnet (and my ISP didn't complain), and there's nothing unusual on my
credit card statement for the period it was happening.

It wasn't the commonest problem which googling suggested, which is
indexing (?) large video files to extract an icon or something for them
- I don't have lots of such anyway, and my icon for them is the VLC cone
anyway.

My disc light wasn't on a lot, and SMART and other tests reported
nothing amiss.

I don't _think_ it was the update thing you're discussing - from what
you're saying that eventually resolves after 30 minutes; I was getting
it for as I say many days. (And I don't think I have automatic updates
turned on anyway.)

The weird thing is that it didn't actually seem to affect performance
much: it was almost as if the "System Idle process" was just being
replaced by one of the other processes. I initially noticed that I was
at 100% CPU usage (single core here) when checking Firefox's memory
usage, as it tends to be a bit of a memory hog, and also a CPU hog once
it's been up a while. But basically, although some process I was running
- often Firefox, but others too, such as explorer - showed up as 100%
(or 75%, or whatever was necessary to "take up the slack" when something
else was doing something) CPU, much like the System Idle process does -
but when I wanted to do something, I usually got CPU time back.

There _was_ a further symptom: whatever explorer windows (not IE - I
tend not to use that) I had open would at random intervals (at least I
didn't figure out any trigger) close, apart from one, whose focus would
be on My Computer. This _was_ a pain, since the news/email client I use
(Turnpike) operates as an explorer shell extension (a decision the
designers eventually came to regret, but it's abandonware now anyway),
which meant I lost my place in newsgroups, and also any news post or
email I was in the middle of composing (and no, it didn't appear in the
drafts "folder"); that _was_ annoying.

But, as I say, it all went away as mysteriously as it came: one day I
noticed I hadn't had any explorer-closes for a while, and looked and CPU
usage wasn't quite at 100%, I closed Firefox, and CPU usage went back
down to its usual around 8 to 14%, and the system has behaved since.
(CPU usage now 100% and PF 1.18 GB, but that's probably because I have
Firefox open with 47 tabs; system still responsive. Hang on, I'll close
F: yes, it's settled down at 7 to 25% and 706 MB. While the oddness was
occurring, if I closed Firefox, IIRR I got the memory back, but the CPU
usage stayed at 100%, something else - probably explorer - taking the
rest).

I _think_ I did try in safe mode and it wasn't any different, but I
can't remember now.

I do have Process Lasso running, one of the effects of which is - if I
understand it correctly! - to prevent any process taking so much of the
CPU that the system becomes unusable in terms of responsiveness; maybe
if I hadn't, it would have been worse.

All very odd!
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Veni, Vidi, Vera (I came, I saw, we'll meet again) - Mik from S+AS Limited
), 1998

On Fri, 13 Dec 2013 19:49:51 +0100, "Linea Recta" wrote:


Still running fine and this evening again: another update (small, no reboot)

Similar issues here. I notice that recent updates have switched of the BITS entry in Admininstrative
Tools, Services. This small update didn't, but other updates have. I have found switching BITS back
on and setting it to Automatic mode seems to help, although I admit this might just be a
coincidence.