1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

SVCHOST.EXE Eating ~70% Resources

Discussion in 'Windows XP' started by bwu_83, Oct 12, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. bwu_83

    bwu_83 Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    6
    Hi, this is my first post on here. I was trying to troubleshoot the problem myself, but could not find a solution. Everytime I start my computer (P3 933 Mhz, 256mb Ram, Windows XP Pro) I find that roughly 70% of the resources are being used by a svchost.exe process. IT is only using roughly 13-16k of memory in the task manager list under processes, however. I know this is eating the resources because when I end this particular service, the CPU usage drops to between 0-3%. I tried following some other threads on here but could not really do much with them.

    I have downloaded ad-aware 6.0 with the updates and used Spy-bot to delete all the spyware they have found, but it still is doing this. The only way I have around it is ending the process (which also happens to run my sound devices or something because I get no sound when this process ends). I have done a tasklist /svc in the command prompt and here are the results:

    Image Name PID Services
    ========================= ====== =============================================
    System Idle Process 0 N/A
    System 4 N/A
    smss.exe 392 N/A
    csrss.exe 476 N/A
    winlogon.exe 500 N/A
    services.exe 544 Eventlog, PlugPlay
    lsass.exe 556 PolicyAgent, ProtectedStorage, SamSs
    svchost.exe 724 RpcSs
    svchost.exe 776 AudioSrv, BITS, Browser, CryptSvc, Dhcp,
    dmserver, ERSvc, EventSystem,
    FastUserSwitchingCompatibility,
    lanmanserver, lanmanworkstation, Netman,
    Nla, Schedule, seclogon, SENS,
    ShellHWDetection, TermService, Themes,
    TrkWks, uploadmgr, W32Time, winmgmt, wuauserv
    svchost.exe 840 Dnscache
    svchost.exe 852 LmHosts, RemoteRegistry, SSDPSRV, WebClient
    spoolsv.exe 984 Spooler
    svchost.exe 1212 stisvc
    explorer.exe 1504 N/A
    point32.exe 1684 N/A
    jusched.exe 1692 N/A
    mmtask.exe 1708 N/A
    mm_server.exe 1736 N/A
    CTHELPER.EXE 1752 N/A
    mmdiag.exe 1788 N/A
    aim.exe 924 N/A
    IEXPLORE.EXE 1040 N/A
    telnet.exe 184 N/A
    cmd.exe 2004 N/A
    tasklist.exe 192 N/A
    wmiprvse.exe 1660 N/A

    The particular process that is eating the resouces is PID 776:

    svchost.exe 776 AudioSrv, BITS, Browser, CryptSvc, Dhcp,
    dmserver, ERSvc, EventSystem,
    FastUserSwitchingCompatibility,
    lanmanserver, lanmanworkstation, Netman,
    Nla, Schedule, seclogon, SENS,
    ShellHWDetection, TermService, Themes,
    TrkWks, uploadmgr, W32Time, winmgmt,

    I don't really know what this stuff is, so I don't know how to remedy the problem. Any help would be appreciated.

    This problem starts once I log into windows, I dont have to run anything before it occurs. I have no real programs starting with windows.
     
  2. mobo

    mobo

    Joined:
    Feb 23, 2003
    Messages:
    16,274
    You have some uglies running there. download Adaware , scan for as well as download all updates then scan and fix all it finds. Then download Hijack this , unzip it, do a scan and save the log. Copy and paste that log here.
     
  3. bwu_83

    bwu_83 Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    6
    I ran ad-aware again, with new updates, and it still only found cookies, which I have removed. That didn't solve the problem though, with CPU usage still up at 70% or so.

    I ran Hijack and this is the log file:
    Logfile of HijackThis v1.97.3
    Scan saved at 10:51:35 PM, on 10/12/2003
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
    C:\WINDOWS\System32\CTHELPER.EXE
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\GMud\Gmud32.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe
    C:\Program Files\Hijack This\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: AIM (HKLM)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37846.904375
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/mail/ymmapi.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - https://rr.esecurecare.net/rnt/rnl/java/RntX.cab


    Thanks for the speedy reply ...
     
  4. mobo

    mobo

    Joined:
    Feb 23, 2003
    Messages:
    16,274
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
     
  5. mobo

    mobo

    Joined:
    Feb 23, 2003
    Messages:
    16,274
    The xp processes are listed as svhost .exe. There are a lot of processes running on defaule which can be shut down to help out your system. Those processes are in control panel/administrative tools/services. Compare this list to those services to see which are safe for you to shut down...
     
  6. bwu_83

    bwu_83 Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    6
    What is updreg.exe and what is it used for?

    Also, why would one of these windows processes all of a sudden start doing this ... I dont believe it was doing this when I reformated my computer like 2 weeks ago ...
     
  7. mobo

    mobo

    Joined:
    Feb 23, 2003
    Messages:
    16,274
    Sound Blaster update reminder in your running processes...
     
  8. bwu_83

    bwu_83 Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    6
    I tried stopping all the running processes in the services one at a time, but none of them shot down my CPU usage. The only way that it seems to go down is by ending the processes through program manager, when i end the svchost.exe.

    I'm utterly stumped.

    I went through that website that you posted and I still can't seem to find the problem here. This is very frustrating.
     
  9. bwu_83

    bwu_83 Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    6
    Do you happen to know what lanmanserver and lanmanworkstation services are?

    And which services they are listed under on the services thing in administrative tools?
     
  10. mobo

    mobo

    Joined:
    Feb 23, 2003
    Messages:
    16,274
    Not sure.
     
  11. bwu_83

    bwu_83 Thread Starter

    Joined:
    Oct 12, 2003
    Messages:
    6
    I guess until someone can figure something else out I will have to resort to ending the process when I start windows, and restarting the windows audio service manually.

    Thanks for your help anyways Mobo.

    Patience is appreciated.
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/171514

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice