svchost.exe Large cpu usage / internet interference / sound interference

[xAzraelx]

Hey,

I have a problem, and I'm hoping someone here is knowledgeable enough to help me with it. I have a single process, svchost.exe that runs extremely high ~50k kb and uses anywhere from 0-100% resources, usually on about three second intervals. It will jump from 0% to 95% in no time, and my computer will literally freeze.

Also, when I "end process" for this particular svchost.exe, my internet (wireless linksys) will fail, shortly afterwards, but not on any specific time frame - it varies. After I delete it, and the internet fails, the connection goes to 54 mbps wireless, but doesn't transfer anything. I cannot disable/enable it, due to some glitch, and I restart the computer to resolve the issue.

Another thing: sound. After deleting the process, the sound on video games (CS, COD2) and some movie files doesn't work. However, I can still listen to mp3s.

This problem has been highly annoying for a couple weeks, and I'm finally taking action to do something about it. If anyone could help me, I would appreciate it a lot. Thanks!

Will

Attached is a HJT log, and any help with it would be awesome. Thanks..


edit: my cpu..
AMD Opteron 146.
1 gig patriot ram (good timings)
geforce 6800gs

 

[TypeX45]

Check this out bro it might help:

http://ask-leo.com/svchost_and_svchostexe_crashs_cpu_maximization_viruses_exploits_and_more.html

 

[howard_hopkinso]

Hello and welcome to Techspot.

Your HJT log is clean.

In order to find out specific details of the svchost.exe file, download the Systernals process explorer from HERE.

The chances are the svchost.exe entry is perfectly safe.

Please let us know what particular process it belongs to.

Regards Howard :wave: :wave:

 

[xAzraelx]

Ran this...it might help.

And, to the above, basically all it told me to do was run a virus scan and block ports (and my router is NAT-enabled, so that's not a problem)

C:\Documents and Settings\xAzraelx>tasklist /svc

Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 684 N/A
csrss.exe 748 N/A
winlogon.exe 772 N/A
services.exe 816 Eventlog, PlugPlay
lsass.exe 828 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 988 DcomLaunch, TermService
svchost.exe 1056 RpcSs
svchost.exe 1100 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, HidServ, Irmon, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1164 Dnscache
svchost.exe 1288 LmHosts, RemoteRegistry, SSDPSRV, WebClient
wbload.exe 1444 N/A
ccSetMgr.exe 1640 ccSetMgr
ccEvtMgr.exe 1668 ccEvtMgr
LEXBCES.EXE 1800 LexBceS
spoolsv.exe 1832 Spooler
LEXPPS.EXE 1864 N/A
DefWatch.exe 1980 DefWatch
Apache.exe 2024 ForcewareWebInterface
MDM.EXE 212 MDM
nSvcIp.exe 248 nSvcIp
nSvcLog.exe 316 nSvcLog
nvsvc32.exe 328 NVSvc
StarWindService.exe 412 StarWindService
svchost.exe 428 stisvc
Rtvscan.exe 492 Symantec AntiVirus
Apache.exe 1396 N/A
nSvcAppFlt.exe 2712 app_filter
litestep.exe 2864 N/A
alg.exe 3236 ALG
winampa.exe 2912 N/A
gnotify.exe 2940 N/A
NvMixerTray.exe 2996 N/A
nTrayFw.exe 3032 N/A
lxbkbmgr.exe 3320 N/A
wmiprvse.exe 3244 N/A
rundll32.exe 3340 N/A
lxbkbmon.exe 3432 N/A
jusched.exe 3524 N/A
ccApp.exe 3560 N/A
VPTray.exe 3680 N/A
realplay.exe 3756 N/A
AnyDVD.exe 3916 N/A
NMBgMonitor.exe 3944 N/A
ctfmon.exe 3956 N/A
steam.exe 4044 N/A
matrix.exe 3408 N/A
wuauclt.exe 3380 N/A
Opera.exe 6124 N/A
winamp.exe 4684 N/A
IEXPLORE.EXE 5092 N/A
wmiprvse.exe 4484 N/A
cmd.exe 4600 N/A
tasklist.exe 4820 N/A

 

[xAzraelx]

Didn't see your post in time Here's the process(es):

svchost.exe 1100
AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, HidServ, Irmon, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC

edit: But see, this just recently started happening. If it had been happening for a while, I would believe it legit. But I've had the computer since I built it for about 7 months...and no problems until this.

edit 2:

one second, getting right image...
here it is:

And no, I don't remember anything specific...there has been quite a bit changing.

 

[TypeX45]

Do you remember any changes you made in the last few days since this has been happening

 

[howard_hopkinso]

Try doing a system restore to before the problem occured. See if that helps any.


Regards Howard

 

[xAzraelx]

I honestly would, but as you can see by the screenie...I've jumped my computer around a lot, and I have no clue where to begin. I'm currently googling, asking around, etc, in search of a better alternative, because I don't want to lose what's already been done to solve a pet peeve. Hoping another idea / person with a similar experiance will come up.

But thanks!

William

 

[xAzraelx]

Any other suggestions? Or, if at all possible...could someone help me figure out WHICH service in svchost.exe is causing so much memory loss, so I can identify it?

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\xAzraelx>TASKLIST /svc

Image Name                   PID Services
========================= ====== =============================================
System Idle Process            0 N/A
System                         4 N/A
smss.exe                     476 N/A
csrss.exe                    532 N/A
winlogon.exe                 556 N/A
services.exe                 600 Eventlog, PlugPlay
lsass.exe                    612 PolicyAgent, ProtectedStorage, SamSs
svchost.exe                  772 DcomLaunch, TermService
svchost.exe                  840 RpcSs
[b]svchost.exe                  884 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
                                 EventSystem, FastUserSwitchingCompatibility,
                                 helpsvc, HidServ, Irmon, lanmanserver,
                                 lanmanworkstation, Netman, Nla, RasMan,
                                 Schedule, seclogon, SENS, SharedAccess,
                                 ShellHWDetection, srservice, TapiSrv,
                                 Themes, TrkWks, W32Time, winmgmt, wscsvc,
                                 wuauserv, WZCSVC[/b]
svchost.exe                  952 Dnscache
svchost.exe                  988 LmHosts, RemoteRegistry, SSDPSRV, WebClient
ccSetMgr.exe                1184 ccSetMgr
wbload.exe                  1240 N/A
ccEvtMgr.exe                1280 ccEvtMgr
LEXBCES.EXE                 1408 LexBceS
spoolsv.exe                 1432 Spooler
LEXPPS.EXE                  1476 N/A
DefWatch.exe                1588 DefWatch
Apache.exe                  1624 ForcewareWebInterface
MDM.EXE                     1668 MDM
nSvcIp.exe                  1700 nSvcIp
nSvcLog.exe                 1756 nSvcLog
nvsvc32.exe                 1780 NVSvc
StarWindService.exe         1824 StarWindService
svchost.exe                 1856 stisvc
Rtvscan.exe                 1872 Symantec AntiVirus
Apache.exe                   912 N/A
litestep.exe                2832 N/A
nSvcAppFlt.exe              2920 app_filter
alg.exe                     3252 ALG
winampa.exe                 3796 N/A
gnotify.exe                 3816 N/A
NvMixerTray.exe             3824 N/A
nTrayFw.exe                 3832 N/A
lxbkbmgr.exe                3920 N/A
rundll32.exe                3932 N/A
lxbkbmon.exe                3940 N/A
wmiprvse.exe                3952 N/A
jusched.exe                 3972 N/A
ccApp.exe                   3988 N/A
VPTray.exe                  4052 N/A
realplay.exe                 252 N/A
AnyDVD.exe                   448 N/A
NMBgMonitor.exe              444 N/A
ctfmon.exe                   412 N/A
steam.exe                    500 N/A
reader_sl.exe                204 N/A
Xfire.exe                   3144 N/A
wmiprvse.exe                3244 N/A
matrix.exe                  3280 N/A
wuauclt.exe                 2828 N/A
cmd.exe                     4200 N/A
tasklist.exe                5136 N/A

I'm pretty sure it's the bolded svchost.exe, but I don't know how to find out the "PID" so I can identify it. And, if that happens to be the culprit, how do I go about finding out which service is causing the issues (the memory loss)

Thanks!

 

[Mr Grim]

You're right it is that one, if you run Process Explorer you'll find the problem points to NTDLL.dll running the processor quite high. a lot of forums point to the Windows Update service, however in my case, this is already disabled. one thing that was running was his Infra Red Monitor, which I have disabled, wether this will fix it or not I doubt supremely, but I'm starting to clutch at straws now...
a friend advises it could the be task scheduling service....
but yes that is the same process as I am having problems with on a machine, on a fresh build, all drivers installed etc.. I also note you're on a Laptop
I hope someone finds a fix!!!

 

[LookinAround]

You're right it is that one, if you run Process Explorer you'll find the problem points to NTDLL.dll running the processor quite high. a lot of forums point to the Windows Update service, however in my case, this is already disabled. one thing that was running was his Infra Red Monitor, which I have disabled, wether this will fix it or not I doubt supremely, but I'm starting to clutch at straws now...
a friend advises it could the be task scheduling service....
but yes that is the same process as I am having problems with on a machine, on a fresh build, all drivers installed etc.. I also note you're on a Laptop
I hope someone finds a fix!!!

Welcome to TechSpot Mr Grim

Can offer you fresh hope at your specific problem (even tho you happened across and answered a thread on the topic that's 2 years old )

Please re-post your specific problem in a new thread of your own. Be sure to include your system spec info in your Profile. Be certain to include your Windows OS and service pack release.

Then use Process Explorer to list the services (not the dll's just yet) in the svchost that's giving you problems.

 

[Mr Grim]

I would, however I am actually on a servicedesk So the machine's differ in spec etc... that I work on. and for client confidentiality I can't really post too much

it is exactly the same problem as posted above however...

 

[LookinAround]

New service packs have been released for both XP and Vista within the last two years. That in addition to other variables you'll have to appreciate the fact that is very low probability of identical to a 2 year old problem.

You may not want to offer system reports with IDs but there's no confidentiality involved with releasing a commercially available parts list. In any event, please appreciate my reluctance to do analysis on the only technical details and specs now 2 years old and belonging to someone else's post. Sorry.

But my suggestion....

1. Again, use process explorer and identify the services running in svchost.
2. That alone might provide info. But you can also find the symbol table that matches your Operating System spec (it's available online and from Microsoft. but can't help u find an unknown symbol table for an unspecified operating system environment.)
3. Run process explorer again, load the symbol table and then look at the process properties of svchost in question, click the Thread tab. Look at the number of context switches occurring to determine which thread (should point to the service) that's running/how often/and with what regularity to help pin point.

g'luck