High CPU SVCHOST

[Jim Willeke]

We have a high powered notebook and in the last few days it has been so
un-responsive that it is un-usable.

The system:
-- System Information Dell M1730
Microsoft® Windows Vista™ Ultimate (build 6001) SP 1.0
Architecture: X86; Language: English

CPU 0: Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz
Percentage of Memory in Use: 32%
Physical Memory (total/avail): 3261.14 MiB / 2190.07 MiB
Pagefile Memory (total/avail): 6717.31 MiB / 5716.6 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1914.43 MiB

C: is Fixed (NTFS) - 360.05 GiB total, 208.14 GiB free.
D: is Fixed (NTFS) - 10 GiB total, 5.82 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ARRAY - 372.61 GiB - 4 partitions
\PARTITION0 - Unknown - 70.57 MiB
\PARTITION1 - Installable File System - 10 GiB - D:
\PARTITION2 (bootable) - Installable File System - 360.05 GiB - C:
\PARTITION3 - Extended w/Extended Int 13 - 2.5 GiB


The symptoms:
1 - Never below 50% utilization
2 - System very un-responsive (Open notepad takes several minutes)
3 - No Issue in safe mode (Even when network enabled)
4 - No Issue if NOT connected to network.
5 - CA-Security says it found and cleaned 30 items on start-up (tracking
cookies)
7 - svchost process shows 50%+ Utilization and shows it contains the
following:
- AeLookupSvc C:\windows\system32\aelupsvc.dll
- Appindo C:\windows\system32\appinfo.dll
- BITS C:\windows\system32\qmgr.dll
- EapHost C:\windows\system32\eapsvc.dll
- gpsvc C:\windows\system32\gpsvc.dll
- IKEEXT C:\ikeext.dll
- iphlpsvc C:\windows\system32\???
- LanmanServer C:\windows\system32\srvsvc.dll
- MMCSS C:\windows\system32\mmscc.dll
- ProfSvc C:\windows\system32\profsvc.dll
- RasMan C:\windows\system32\rasman.dll
- Schedule C:\windows\system32\schedsvc.dll
- seclogon C:\windows\system32\seclogon.dll
- SENS C:\windows\system32\sens.dll
- ShellHWDetction C:\windows\system32\shsvcs.dll
- Themes C:\windows\system32\shsvcs.dll
- Winmgmt C:\windows\system32\WMIsvc.dll
- wuauserv C:\windows\system32\wuueng.dll
- TaskEng.exe
- TaskEng.exe
- TaskEng.exe
- TaskEng.exe
- GoogleUpdate.exe

Any ideas?
Thanks
-jim

 

[Chuck]

I'd suspect GoogleUpdate.exe

 

[Jevon]

Jim,

I'd also check out the C:\ikeext.dll file - it ought to be in the System32
folder, not the root of C:

Non-SP1 details are available here:
http://www.greatis.com/vista/DLL/i/ikeext.dll.htm
I don't know what the size/version should be for SP1 x86 - I run x64 (for
which the File version is 6.0.6001.18000, the Product version is the same as
the page above).

There should be a C:\Windows\System32\ikeext.dll file as well as the one in
C:\ikeext.dll - if their details differ, run a thorough spyware sweep as
it's possible you have malware installed.

Jevon