TechSpot

svchost.exe Large cpu usage / internet interference / sound interference

By xAzraelx
Jul 13, 2006
Topic Status:
Not open for further replies.
  1. Hey,

    I have a problem, and I'm hoping someone here is knowledgeable enough to help me with it. I have a single process, svchost.exe that runs extremely high ~50k kb and uses anywhere from 0-100% resources, usually on about three second intervals. It will jump from 0% to 95% in no time, and my computer will literally freeze.

    Also, when I "end process" for this particular svchost.exe, my internet (wireless linksys) will fail, shortly afterwards, but not on any specific time frame - it varies. After I delete it, and the internet fails, the connection goes to 54 mbps wireless, but doesn't transfer anything. I cannot disable/enable it, due to some glitch, and I restart the computer to resolve the issue.

    Another thing: sound. After deleting the process, the sound on video games (CS, COD2) and some movie files doesn't work. However, I can still listen to mp3s.

    This problem has been highly annoying for a couple weeks, and I'm finally taking action to do something about it. If anyone could help me, I would appreciate it a lot. Thanks!

    Will

    Attached is a HJT log, and any help with it would be awesome. Thanks..


    edit: my cpu..
    AMD Opteron 146.
    1 gig patriot ram (good timings)
    geforce 6800gs
  2. TypeX45

    TypeX45 TS Rookie Posts: 216

  3. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Hello and welcome to Techspot.

    Your HJT log is clean.

    In order to find out specific details of the svchost.exe file, download the Systernals process explorer from HERE.

    The chances are the svchost.exe entry is perfectly safe.

    Please let us know what particular process it belongs to.

    Regards Howard :wave: :wave:
  4. xAzraelx

    xAzraelx TS Rookie Topic Starter

    Ran this...it might help.

    And, to the above, basically all it told me to do was run a virus scan and block ports (and my router is NAT-enabled, so that's not a problem)

    C:\Documents and Settings\xAzraelx>tasklist /svc

    Image Name PID Services
    ========================= ====== =============================================
    System Idle Process 0 N/A
    System 4 N/A
    smss.exe 684 N/A
    csrss.exe 748 N/A
    winlogon.exe 772 N/A
    services.exe 816 Eventlog, PlugPlay
    lsass.exe 828 PolicyAgent, ProtectedStorage, SamSs
    svchost.exe 988 DcomLaunch, TermService
    svchost.exe 1056 RpcSs
    svchost.exe 1100 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
    EventSystem, FastUserSwitchingCompatibility,
    helpsvc, HidServ, Irmon, lanmanserver,
    lanmanworkstation, Netman, Nla, RasMan,
    Schedule, seclogon, SENS, SharedAccess,
    ShellHWDetection, srservice, TapiSrv,
    Themes, TrkWks, W32Time, winmgmt, wscsvc,
    wuauserv, WZCSVC
    svchost.exe 1164 Dnscache
    svchost.exe 1288 LmHosts, RemoteRegistry, SSDPSRV, WebClient
    wbload.exe 1444 N/A
    ccSetMgr.exe 1640 ccSetMgr
    ccEvtMgr.exe 1668 ccEvtMgr
    LEXBCES.EXE 1800 LexBceS
    spoolsv.exe 1832 Spooler
    LEXPPS.EXE 1864 N/A
    DefWatch.exe 1980 DefWatch
    Apache.exe 2024 ForcewareWebInterface
    MDM.EXE 212 MDM
    nSvcIp.exe 248 nSvcIp
    nSvcLog.exe 316 nSvcLog
    nvsvc32.exe 328 NVSvc
    StarWindService.exe 412 StarWindService
    svchost.exe 428 stisvc
    Rtvscan.exe 492 Symantec AntiVirus
    Apache.exe 1396 N/A
    nSvcAppFlt.exe 2712 app_filter
    litestep.exe 2864 N/A
    alg.exe 3236 ALG
    winampa.exe 2912 N/A
    gnotify.exe 2940 N/A
    NvMixerTray.exe 2996 N/A
    nTrayFw.exe 3032 N/A
    lxbkbmgr.exe 3320 N/A
    wmiprvse.exe 3244 N/A
    rundll32.exe 3340 N/A
    lxbkbmon.exe 3432 N/A
    jusched.exe 3524 N/A
    ccApp.exe 3560 N/A
    VPTray.exe 3680 N/A
    realplay.exe 3756 N/A
    AnyDVD.exe 3916 N/A
    NMBgMonitor.exe 3944 N/A
    ctfmon.exe 3956 N/A
    steam.exe 4044 N/A
    matrix.exe 3408 N/A
    wuauclt.exe 3380 N/A
    Opera.exe 6124 N/A
    winamp.exe 4684 N/A
    IEXPLORE.EXE 5092 N/A
    wmiprvse.exe 4484 N/A
    cmd.exe 4600 N/A
    tasklist.exe 4820 N/A
  5. xAzraelx

    xAzraelx TS Rookie Topic Starter

    Didn't see your post in time :) Here's the process(es):

    svchost.exe 1100
    AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
    EventSystem, FastUserSwitchingCompatibility,
    helpsvc, HidServ, Irmon, lanmanserver,
    lanmanworkstation, Netman, Nla, RasMan,
    Schedule, seclogon, SENS, SharedAccess,
    ShellHWDetection, srservice, TapiSrv,
    Themes, TrkWks, W32Time, winmgmt, wscsvc,
    wuauserv, WZCSVC

    edit: But see, this just recently started happening. If it had been happening for a while, I would believe it legit. But I've had the computer since I built it for about 7 months...and no problems until this.

    edit 2:

    one second, getting right image...
    here it is:
    [​IMG]



    And no, I don't remember anything specific...there has been quite a bit changing.
  6. TypeX45

    TypeX45 TS Rookie Posts: 216

    Do you remember any changes you made in the last few days since this has been happening
  7. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Try doing a system restore to before the problem occured. See if that helps any.


    Regards Howard :)
  8. xAzraelx

    xAzraelx TS Rookie Topic Starter

    I honestly would, but as you can see by the screenie...I've jumped my computer around a lot, and I have no clue where to begin. I'm currently googling, asking around, etc, in search of a better alternative, because I don't want to lose what's already been done to solve a pet peeve. Hoping another idea / person with a similar experiance will come up.

    But thanks!

    William
  9. xAzraelx

    xAzraelx TS Rookie Topic Starter

    Any other suggestions? Or, if at all possible...could someone help me figure out WHICH service in svchost.exe is causing so much memory loss, so I can identify it?

    Code:
    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.
    
    C:\Documents and Settings\xAzraelx>TASKLIST /svc
    
    Image Name                   PID Services
    ========================= ====== =============================================
    System Idle Process            0 N/A
    System                         4 N/A
    smss.exe                     476 N/A
    csrss.exe                    532 N/A
    winlogon.exe                 556 N/A
    services.exe                 600 Eventlog, PlugPlay
    lsass.exe                    612 PolicyAgent, ProtectedStorage, SamSs
    svchost.exe                  772 DcomLaunch, TermService
    svchost.exe                  840 RpcSs
    [b]svchost.exe                  884 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
                                     EventSystem, FastUserSwitchingCompatibility,
                                     helpsvc, HidServ, Irmon, lanmanserver,
                                     lanmanworkstation, Netman, Nla, RasMan,
                                     Schedule, seclogon, SENS, SharedAccess,
                                     ShellHWDetection, srservice, TapiSrv,
                                     Themes, TrkWks, W32Time, winmgmt, wscsvc,
                                     wuauserv, WZCSVC[/b]
    svchost.exe                  952 Dnscache
    svchost.exe                  988 LmHosts, RemoteRegistry, SSDPSRV, WebClient
    ccSetMgr.exe                1184 ccSetMgr
    wbload.exe                  1240 N/A
    ccEvtMgr.exe                1280 ccEvtMgr
    LEXBCES.EXE                 1408 LexBceS
    spoolsv.exe                 1432 Spooler
    LEXPPS.EXE                  1476 N/A
    DefWatch.exe                1588 DefWatch
    Apache.exe                  1624 ForcewareWebInterface
    MDM.EXE                     1668 MDM
    nSvcIp.exe                  1700 nSvcIp
    nSvcLog.exe                 1756 nSvcLog
    nvsvc32.exe                 1780 NVSvc
    StarWindService.exe         1824 StarWindService
    svchost.exe                 1856 stisvc
    Rtvscan.exe                 1872 Symantec AntiVirus
    Apache.exe                   912 N/A
    litestep.exe                2832 N/A
    nSvcAppFlt.exe              2920 app_filter
    alg.exe                     3252 ALG
    winampa.exe                 3796 N/A
    gnotify.exe                 3816 N/A
    NvMixerTray.exe             3824 N/A
    nTrayFw.exe                 3832 N/A
    lxbkbmgr.exe                3920 N/A
    rundll32.exe                3932 N/A
    lxbkbmon.exe                3940 N/A
    wmiprvse.exe                3952 N/A
    jusched.exe                 3972 N/A
    ccApp.exe                   3988 N/A
    VPTray.exe                  4052 N/A
    realplay.exe                 252 N/A
    AnyDVD.exe                   448 N/A
    NMBgMonitor.exe              444 N/A
    ctfmon.exe                   412 N/A
    steam.exe                    500 N/A
    reader_sl.exe                204 N/A
    Xfire.exe                   3144 N/A
    wmiprvse.exe                3244 N/A
    matrix.exe                  3280 N/A
    wuauclt.exe                 2828 N/A
    cmd.exe                     4200 N/A
    tasklist.exe                5136 N/A
    
    I'm pretty sure it's the bolded svchost.exe, but I don't know how to find out the "PID" so I can identify it. And, if that happens to be the culprit, how do I go about finding out which service is causing the issues (the memory loss)

    Thanks!
  10. Mr Grim

    Mr Grim TS Rookie

    You're right it is that one, if you run Process Explorer you'll find the problem points to NTDLL.dll running the processor quite high. a lot of forums point to the Windows Update service, however in my case, this is already disabled. one thing that was running was his Infra Red Monitor, which I have disabled, wether this will fix it or not I doubt supremely, but I'm starting to clutch at straws now...
    a friend advises it could the be task scheduling service....
    but yes that is the same process as I am having problems with on a machine, on a fresh build, all drivers installed etc.. I also note you're on a Laptop :)
    I hope someone finds a fix!!!
  11. LookinAround

    LookinAround TechSpot Chancellor Posts: 8,372   +167

    Welcome to TechSpot Mr Grim

    Can offer you fresh hope at your specific problem (even tho you happened across and answered a thread on the topic that's 2 years old ;) )

    Please re-post your specific problem in a new thread of your own. Be sure to include your system spec info in your Profile. Be certain to include your Windows OS and service pack release.

    Then use Process Explorer to list the services (not the dll's just yet) in the svchost that's giving you problems.
     
  12. Mr Grim

    Mr Grim TS Rookie

    I would, however I am actually on a servicedesk :) So the machine's differ in spec etc... that I work on. and for client confidentiality I can't really post too much :)

    it is exactly the same problem as posted above however...
  13. LookinAround

    LookinAround TechSpot Chancellor Posts: 8,372   +167

    New service packs have been released for both XP and Vista within the last two years. That in addition to other variables you'll have to appreciate the fact that is very low probability of identical to a 2 year old problem.

    You may not want to offer system reports with IDs but there's no confidentiality involved with releasing a commercially available parts list. In any event, please appreciate my reluctance to do analysis on the only technical details and specs now 2 years old and belonging to someone else's post. Sorry.

    But my suggestion....

    1. Again, use process explorer and identify the services running in svchost.
    2. That alone might provide info. But you can also find the symbol table that matches your Operating System spec (it's available online and from Microsoft. but can't help u find an unknown symbol table for an unspecified operating system environment.)
    3. Run process explorer again, load the symbol table and then look at the process properties of svchost in question, click the Thread tab. Look at the number of context switches occurring to determine which thread (should point to the service) that's running/how often/and with what regularity to help pin point.

    g'luck
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.