[pcgraphicsguru]

For a while now my PC has been sluggish with "services.exe" running at 50% CPU usage. The problem is absolutely not a virus - I've run numerous scans with multiple virus programs and even had a second level troubleshooter from Vipre look at my PC remotely and (after an hour or so of looking at everything we could think of) pronounce it clean of viruses. I ran Process Explorer which breaks down all the services running under services.exe but doesn't show which one is using the CPU cycles so I killed all services one at a time till I finally killed enough to cause my PC to reboot. CPU usage was still 50% right up to the last one so no luck there. Finally I found that if I booted to safe mode, the problem didn't occur so I used msconfig to narrow things down. And the culprit turned out to be the "Plug and Play" service. If I leave everything enabled normally but kill that one service and reboot, services.exe shows 0% in task manager and the idle process is where it should be in the 95-99% range. My question now is, how do I narrow down things further to figure out what is causing the Plug and Play service to bog down my PC so much?

FYI, I'm running Windows XP SP3 with all the latest updates. My CPU is dual-core which I suspect is why services.exe (with Plug and Play enabled) sits at 50% CPU usage (most of the time exactly at 50.0%) - I think it is just taking up all the cycles of one core. In any case, SOMETHING is running that shouldn't be or is looking for something that it never can find or something. Possibly it is an incomplete install (or uninstall) or maybe a bad or incompatible driver - who knows (but with "Plug and Play" not running, I can't run device manager). So I'm looking for a troubleshooting procedure to take this further.

Tech Support Guy System Info Utility version 1.0.0.1
OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz, x86 Family 6 Model 15 Stepping 6
Processor Count: 2
RAM: 2046 Mb
Graphics Card:
Hard Drives: C: Total - 610477 MB, Free - 10587 MB;
Motherboard: ASUSTeK Computer INC., P5WDG2 WS PRO, Rev 1.xx, MB-1234567890
Antivirus: AVG Anti-Virus Free Edition 2011, Updated: Yes, On-Demand Scanner: Disabled

[Phantom010]

Installed any new hardware lately?

[pcgraphicsguru]

Have I installed anything new lately?

No, actually. But then I've been living with this problem for a while and can't pinpoint exactly when it started happening. For a while I had been doing some things in the background (audio / video file format conversions to set up a media server) and at first just figured it was those tasks making my PC sluggish. Once I realized that it was more than that, I started trying to figure out the cause (starting with assuming it was some sort of virus or malware so that took a while to finally conclude that it wasn't), so it has taken me a while to narrow down the problem to the Plug and Play service. Meanwhile I have work to do - email to handle and word processing tasks all of which don't take THAT much CPU time so I have been able to get by while taking time out from that every so often to try and track down the problem. But I really do need to get this fixed so have started to put more time into it lately and have at least made SOME progress.

More specifically regarding I/O, the PC in question attaches to a wired home network where I have an HP network printer (relatively new but the problem was happening before that was installed), several NAS boxes serving as backup storage / media servers, plus several other networked computers that I transfer files to and from (one Vista, one Windows 7 and one XP). Locally on this PC I have two nVidia graphics cards with a total of 3 displays (one is portrait mode so there is special software installed for that) and on-board audio plus USB connections to a lot of different things (all of which I've had for a long time): a mouse, a scanner, several digital camera charging cradles, an iPhone, several different universal remote controls of different types that connect via USB for programming, and a UPB adapter (Universal Powerline Bus) that I use to program my home automation lighting (USB interface). Then there are various flash drives I've plugged in from time to time (all new the first time I plugged them in) and possibly a few other things I've forgotten, none of which are attached currently. So I need some way to narrow things down to a more specific culprit.

It looks like without the Plug and Play service enabled on boot that I can't run Device Manager so I guess I'm just going to have to re-enable Plug and Play and start re-installing device drivers, hoping I get lucky and that is actually the problem. But that seems kind of hit and miss so I wanted to see if anyone had a better way of going about the troubleshooting that would be more methodical and more likely to narrow things down to the specific cause. Is there something like msconfig for I/O where I can force the system to only load specific drivers? I don't know what all the Plug and Play service does so I need to do more research on that as well.

[Phantom010]

A lot of devices depend on the Plug-and-Play service. You've got a lot of stuff on that computer. I think it'll be a long process of elimination...

[pcgraphicsguru]

Still haven't gotten any help on HOW to do that, but decided to start by updating all my drivers. I was finally able to update everything but had some issues. The primary one was that Device Manager was showing a "Plug and Play Monitor" with a yellow question mark. When I tried to "update driver", it acted like it was starting to do that but never finished (left it overnight, no progress and the task was taking 0% CPU) so I finally killed the process, rebooted and tried to "uninstall" the driver but same result, just hung and never finished. So I tried one of the Driver Updater apps - Driver Reviver - which said that driver was out of date. I downloaded the updated driver and clicked "install" and the same thing happened - I got "Starting to install the driver -Plug and Play Monitor", then nothing ever happened after that - left it to run overnight (11 hours), no progress and using no CPU cycles (I could still do other things - it was just that process that was making no progress). BUT, after killing the process and rebooting, doing another scan showed that the driver was up to date (!). Device manager showed that device as disabled with a red x but clicking "enable" enabled it just fine (the display has worked perfectly all through all of these steps). So now there appear to be no driver issues, everything shows as up to date. BUT, services.exe is still eating CPU cycles and in fact the problem is worse - now it takes 70-80% CPU instead of 50% which obviously is really killing my productivity.

I would feel much more comfortable if I could remove that "Plug and Play Monitor" driver completely plus all traces of it and let the system detect it all over again and install a clean driver. Does anyone know how to do that? I'd also like to remove drivers for some devices that show as "unplugged" that I never intend to plug in again - a number of the "driver updater" programs find these somehow even though they don't show in Device Manager. I've downloaded a number of "scan-only" trial versions of these programs and they all seem to mostly agree on what they find.

One other thing I've done is to run a command line tool called "System File Checker". I ran "sfc /scannow" and it reported no problems. SFC supposedly scans all protected system files to "verify the correct version". I don't know what else, if anything, it does (check file CRC for example?) to see if the file is corrupted.

I really don't want to have to reinstall windows and then have to reinstall all my apps and even more of a concern, my boot "drive" is a RAID array and I don't want to lose my user files by trying to do a repair install for example and having the RAID driver get messed up. Does anyone know of a reasonably safe procedure for doing a repair without screwing up my RAID array?

[Phantom010]

Have you tried unplugging your numerous USB devices one by one, to hopefully find one causing the issue? I've even seen faulty USB ports causing that type of problem.

[pcgraphicsguru]

I didn't have all that many devices plugged in, just that over time I HAVE plugged in devices that are no longer plugged in (they show as unplugged in the driver scanners I've used). But I detached everything anyway except keyboard and mouse (external hubs etc) and it made no difference. I've since gone through my system and removed / uninstalled some of the unused devices through various means (mostly devices I don't even have any more) and it hasn't changed anything (and I've also uninstalled a lot of apps I wasn't using and that made no difference either). All my drivers are up to date and all my attached devices are working fine. Microsoft update also says everything is up to date. So I'm pretty mystified. I can't think of anything else to try to figure out where the CPU cycles are being used. One thing I might try is an XP "Repair Install" and hope it doesn't screw up my RAID array. The guy who set up my PC originally gave me a CD he'd made with the same version of Windows XP that I have (32-bit XP Pro) with the RAID drivers included so I shouldn't have to do anything but boot from that CD. Supposedly a repair install will "retain all my data and settings" although I'm not sure what all I'll have to reinstall. I'm still looking at the implications.

[KilroyMax]

I just experienced this on one of the computers I manage. On that computer, it had not happened before that the user knew of, and they would DEFINITELY notice. I went through normal troubleshooting, closing each application one at a time with no change. In the interest of solving the problem quickly (hopefully) I did a cold boot. Everything came back OK.
I suspect that a LCD monitor driver disk I had just used was the problem. I haven't tested that problem and I really don't intend to. I just add it to my notes.
I did find a reference to the problem in Windows 2000 which suggests to install the latest service pack. It also has a link to the hot fix (for windows 2K). Maybe the hotfix will work on XP, or perhaps you can open it and see what it changes and ry to interpolate that for XP. Here is the link http://support.microsoft.com/kb/328885
Good Luck
KilroyMax

[pcgraphicsguru]

I finally solved it. I have two identical nVidia GeForce 8600 GTS graphics cards in the system and 3 monitors: 2 monitors connected to the 1st display adapter and 1 monitor connected to the 2nd (with the second output of that display adapter not connected). The single monitor on the 2nd display adapter has been working fine but kept showing up as disabled in Device Manager. I'd enable it and it would show as enabled but after a reboot the next time I opened Device Manager it would show as disabled again (red x). The display is an LG "Flatron" W2353VP and had no "driver" or monitor information file that I was ever able to find - the documentation just said to use the standard plug and play driver. But trying to uninstall the driver Windows was assigning to it would just hang. So I finally just unplugged that display and rebooted and the problem went away! Of course then I was down to 2 displays, but at least then I knew the cause. So I tried reconnecting the monitor and the problem reappeared (verifying that was indeed the culprit and not something else that coincidentally changed). Then I tried moving that monitor to the other output of the two outputs on that display adapter. And (after a reboot) magically the problem went away! The two outputs are supposedly identical, but apparently they aren't. I'll try to turn in a bug report to nVidia.

I never did try the Windows XP Repair Install and now I don't have to. Prior to finding the problem I'd disconnected all the other plug and play (USB) devices on my PC except for my keyboard and mouse (and the monitors that are connected via the display adapters) and figured out how to remove some drivers that were no longer needed (unplugged USB devices that were never going to be plugged in again) and that didn't help. I also had run the Wise Registry Cleaner which found a LOT of problems and fixed them and that didn't help either. And Windows had all updates installed. I find it interesting that all my drivers were up to date, all devices worked and the problem remained. But in spite of that it turned out to be a driver issue after all.

[Phantom010]

Glad you found a solution!

However, my advice is to stay as far away as you possibly can from Registry Cleaners! You'll only end up crippling programs and the operating system beyond repair. These programs are completely useless and will delete not only what THEY think must go but also legitimate files still in use.

Keep in mind that they will always find "errors" to fix, even on a fresh Windows installation!

Why I Don’t Use Registry Cleaners

Registry Cleaners and System Tweaking Tools

http://www.bleepingcomputer.com/forums/topic347491.html/page__p__1932993

http://forums.techguy.org/windows-xp/997274-registry-got-messed-up-advanced.html

[pcgraphicsguru]

Regarding registry cleaners, I've read the links you provided and I understand your concern (and I wouldn't recommend that people use any program when they don't know what they are doing or what the program does), however, I personally have not had any bad experiences with the registry cleaners I've used. I've used Fix-It Tools for years and years with absolutely no problems ever. For the last several years almost the only feature in it that I've used is the registry cleaner. Windows has this annoying habit of adding every file I've ever accessed to the registry and if I drag a file to the trash the entry is still there (yet another bug in Windows - don't get me started). And I do a LOT of file manipulation (thousands of files added and deleted every week) so that is a real problem. So I run Fix-It tools every several months to clean out all those useless entries, otherwise my registry would get HUGE. In this case I hadn't run it in a long time so was concerned that the registry had gotten big enough to cause my performance loss but more concerned that there could be junk left over from previous installs and uninstalls and that one of those was causing the problem I was experiencing. So in spite of your concern about registry cleaners (and I'm sure there are bad ones out there), in my opinion registry cleaners are a requirement for some types of issues. But in this case I didn't trust ANYTHING so had uninstalled it relatively early in the debug process (didn't make any difference). So with that out of my system temporarily, I looked to see if there were any reasonable free alternatives (that would possibly take different approach and find something Fix-It Tools hadn't) and found Wise Registry Cleaner. When the first half dozen reviews I read didn't have anything bad to say (and the ones I read said it was relatively safe plus I couldn't find any bad reviews), I decided to take the chance and let it do a scan. I've used PCs a lot for a long time (from before the PC existed actually back before Bill Gates ripped off CPM to create DOS - hey I've looked at the kernel code and internal file structures of both - all he did was convert 8-bit 8080/Z80-based CPM to 16-bit for 8086, but that's another subject). All I'm saying is that I know what to look for and what to let the registry cleaner do and what to not let it do. Wise didn't have anything in the list that looked suspicious, I did a full registry backup before letting it clean anything and I haven't had any problems since. The only issue is that you have to be careful during install and uncheck the box where it wants to install the ASK toolbar. Irritating but not unexpected for a free program - I understand that they have to pay for it somehow. But it didn't ask me for money to complete the cleaning step - I'm immediately suspicious of anything that does that.

Oh, and to anyone else reading this, don't fall for the DoubleMySpeed.com B.S. That IS a scam, no question.

Anyway, if I want to uninstall an app that I'm concerned about, it doesn't appear in the "Add or Remove Programs" list and there is no uninstall app either installed with it or available on the author's web site, what do you recommend to get rid of it? If I delete the files from the Program Files folder at minimum there are still going to be traces left in the registry and I would think most registry cleaners would at least find and remove the links to missing files. In this case, I'll use a registry cleaner I trust and then look for indications of unwanted things still running by looking at processes and services and autostarted programs (using "Autostart & Process Viewer" and "Process Explorer"). Is there anything else I should be looking at?

[Phantom010]

If you know EXACTLY what you're deleting with Registry Cleaners, or looking for specific files to remove, I guess you can run those programs at your own risk. They are never to be run blindly.

Then again, do we ever know what to delete from a program we haven't created? Unless you're having trouble with the leftovers from an uninstalled program, it's best to leave them alone. If you don't run Registry Cleaners, you won't notice the leftovers...