svchost consuming CPU even after boot-up

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?
 
MG said:
I've read many posts regarding the lengthy start-up issues
associated with svchost and MS updates - mine appears somewhat
different. After booting up, and after all services have started,
my machine runs through cycles of CPU - viewed on Task Manager
these spkies are typically around 40% of CPU, sometimes higher, and
are occurring on a very consistent cycle, around every 6-8 seconds.
This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see
that these processes running are within svchost.exe and/or
services.exe. I've tried shutting down everything that is in my
startup and the problem still exists. This cycling of CPU goes on
non-stop, all the time. As it eats CPU on these cycles, other
processes are now affected - example, a full virus scan now takes
about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down.
I'm running XP Home/SP2 and have applied all updates automatically.
Any ideas?

MG,

If you are going to repost the same question you have had going for 8+ days
now in microsoft.public.windowsupdate with many responses and many things
tried - it would be in your favor as well as everyone elses to at least make
note that this has been posted elsewhere and they can review what has been
attempted here:

http://groups.google.com/group/micr...6d3b71d1636?lnk=st&q=&rnum=1#5f4b36d3b71d1636

After all - you did not change the subject nor the body of the message to
reflect anything tried (knowing what doesn't work is as important in
troubleshooting as finding what does.)
 
There are many ways you can discover what processes are being hosted by
svchost. My favorite way is also the simplest: it uses the Help and
Support Center. Start Help and Support and select 'Use tools to view
your computer information..." then choose 'Advanced system information'
and select 'View running services'. This shows you all running services,
including those running behind svchost. If any of those services look
unfamiliar you can run a web search to find out what they do, and that
can help you uncover malicious software.

Another elegant method is offered by the File Research Center
(http://www.fileresearchcenter.com/). Click on "Do you know what's
running on YOUR computer?"
 
Well thank you so much for your help. I'm on this forum becasue I'm not a
technical guru. I happen to have an issue that I've posted on more forums
than I care to mention, I've followed endless ideas and thoughts, and spent
many hours reading other posts, all to no avail. So I guess I could have had
everyone who wanted to help trudge down that incredibly long path of attempts
which didn't work. Quite simply, I wanted some fresh ideas, and if they
happened to be things I've already tried, I simply would have let them know.
At least the rest of the respondents have attempted to help me in some way
rather than provide me a lesson on process.
 
Thanks for the response - there are many processes running under svchost -
I'll continue to research. Question - is there any way you know of to look
more granularly at the processes running under svchost? Using Process
Explorer, I've been able to look within svchost, and can see a number of
threads which are consuming CPU, on the exact same cycle as I see via my Task
manager performance graph. This graph, by the way, looks very much like an
EKG, evenly spaced spikes of CPU, every 6-8 seconds, going up to 40% CPU or
higher. This goes on all the time, even with nothing open on my machine.

What I've not been able to determine is just what is kicking off those
threads. Is there any way you know to be able to determine what starts them?
 
MG said:
I've read many posts regarding the lengthy start-up issues
associated with svchost and MS updates - mine appears somewhat
different. After booting up, and after all services have started,
my machine runs through cycles of CPU - viewed on Task Manager
these spkies are typically around 40% of CPU, sometimes higher,
and are occurring on a very consistent cycle, around every 6-8
seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can
see that these processes running are within svchost.exe and/or
services.exe. I've tried shutting down everything that is in my
startup and the problem still exists. This cycling of CPU goes on
non-stop, all the time. As it eats CPU on these cycles, other
processes are now affected - example, a full virus scan now takes
about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down.
I'm running XP Home/SP2 and have applied all updates
automatically. Any ideas?

Shenan said:
If you are going to repost the same question you have had going
for 8+ days now in microsoft.public.windowsupdate with many
responses and many things tried - it would be in your favor as
well as everyone elses to at least make note that this has been
posted elsewhere and they can review what has been attempted here:

http://groups.google.com/group/micr...6d3b71d1636?lnk=st&q=&rnum=1#5f4b36d3b71d1636

After all - you did not change the subject nor the body of the
message to reflect anything tried (knowing what doesn't work is as
important in troubleshooting as finding what does.)
Well thank you so much for your help. I'm on this forum becasue
I'm not a technical guru. I happen to have an issue that I've
posted on more forums than I care to mention, I've followed endless
ideas and thoughts, and spent many hours reading other posts, all
to no avail. So I guess I could have had everyone who wanted to
help trudge down that incredibly long path of attempts which didn't
work. Quite simply, I wanted some fresh ideas, and if they
happened to be things I've already tried, I simply would have let
them know. At least the rest of the respondents have attempted to
help me in some way rather than provide me a lesson on process.

I'm sorry you believe that the people here who volunteer to help would not
do so if they had to read something. I am sorry you believe that was me
trying to teach you a lesson and not what it actually was: to help you
further by getting the people who frequent only this particular newsgroup
and not the other(s) you may have posted this to a heads up on what has been
tried and failed.

Give those who frequent the groups and volunteer their time and knowledge
without compensation a little credit. They don't help you by knowing parts
of the story. You get a fresh perspective just by posting where new people
can see it - but having these new people possibly jump to through the same
hoops you've already been through simply because you did not want to add a
tag-line of, "I have been trying to get help in
microsoft.public.windowsupdate , but we have run a little dry on ideas and I
hope someone can help me here - if you wish to see what we have done - feel
free to look:
http://groups.google.com/group/micr...6d3b71d1636?lnk=st&q=&rnum=1#5f4b36d3b71d1636
.." seems to be leaving out important information to me. I am sorry you do
not see it that way.

I see in the other thread you were requested to uninstall the McAfee
firewall.
I'll go a step further - uninstall anything McAfee related...

Once you have done that - do this (and yes - I know you have installed the
latest version of Windows Update and the patch for the SVCHOST issue
before - but this is a step-by-step thing - not just that... It just so
happens you will have to do that again at the end of the process.):

Get Dial-a-Fix:
http://wiki.djlizard.net/Dial-a-fix

Use its options to fix:
- Windows Installer
- Windows Update
- All the Registration Center options.

Turn off the "Empty System32\Catroot 2"
Do NOT do "Flush SoftwareDistribution".

Then click "GO" and wait until it is done... Reboot.

- Download/Install Windows Update v3.
http://go.microsoft.com/fwlink/?LinkID=91237
You *WILL* want to install it using the command line switch "/wuforce" right
after a reboot - immediately after logging in.

- Download/Install the 927891 patch.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7A81B0CD-A0B9-497E-8A89-404327772E5A

- Reboot.

Come back - let us know!
 
OK - first, I've gotten your point on all the volunteers, so please, no more
lectures. One thing you must also understand is for folks like me, who don't
know much about PC's, these forums at times offer lots of advice from folks,
quite honestly, that are unknowns to those of us getting the advice. So as
is the case here - I need to understand the "why" portion a bit better. Your
advice to uninstall everything McAfee - why? This is my virus protection for
my machine currently. It has also been on my machine for several years, so
why a problem now? If I uninstall, I have no virus protection - right?
McAfee was provided via my ISP, which has since change hands - Comcast to
Time Warner - so my ability to reload McAfee if I need to is not that easy.

So I'll offer a little advice of my own - it would he helpful when offering
the advice to help folks like me, which I do appreciate, is to provide a
little more of "why" we are supposed to just somewhat blindly follow the
instructions. Just as the case here, if I'm going to uninstall my virus
software, I need to know why I should just go out and do that. You should
understand that I've also spent many hours reading and following the advice
which is yet still not resolved my issue. So while I do appreciate the hours
folks like you volunteer to do this, please understand that I've gone down a
very long path so far in making changes, installing software, rebooting
gazillion times and so on. As such, I'm now seeing a another lengthy list of
tasks to perform, starting with removing my virus protection --- so I just
need to know why I would do that...
 
MG said:
I've read many posts regarding the lengthy start-up issues
associated with svchost and MS updates - mine appears somewhat
different. After booting up, and after all services have started,
my machine runs through cycles of CPU - viewed on Task Manager
these spkies are typically around 40% of CPU, sometimes higher,
and are occurring on a very consistent cycle, around every 6-8
seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can
see that these processes running are within svchost.exe and/or
services.exe. I've tried shutting down everything that is in my
startup and the problem still exists. This cycling of CPU goes on
non-stop, all the time. As it eats CPU on these cycles, other
processes are now affected - example, a full virus scan now takes
about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down.
I'm running XP Home/SP2 and have applied all updates
automatically. Any ideas?

Shenan said:
If you are going to repost the same question you have had going
for 8+ days now in microsoft.public.windowsupdate with many
responses and many things tried - it would be in your favor as
well as everyone elses to at least make note that this has been
posted elsewhere and they can review what has been attempted here:

http://groups.google.com/group/micr...6d3b71d1636?lnk=st&q=&rnum=1#5f4b36d3b71d1636

After all - you did not change the subject nor the body of the
message to reflect anything tried (knowing what doesn't work is as
important in troubleshooting as finding what does.)
Well thank you so much for your help. I'm on this forum becasue
I'm not a technical guru. I happen to have an issue that I've
posted on more forums than I care to mention, I've followed endless
ideas and thoughts, and spent many hours reading other posts, all
to no avail. So I guess I could have had everyone who wanted to
help trudge down that incredibly long path of attempts which didn't
work. Quite simply, I wanted some fresh ideas, and if they
happened to be things I've already tried, I simply would have let
them know. At least the rest of the respondents have attempted to
help me in some way rather than provide me a lesson on process.

Shenan said:
I'm sorry you believe that the people here who volunteer to help would not
do so if they had to read something. I am sorry you believe that was me
trying to teach you a lesson and not what it actually was: to help you
further by getting the people who frequent only this particular newsgroup
and not the other(s) you may have posted this to a heads up on what has
been
tried and failed.

Give those who frequent the groups and volunteer their time and knowledge
without compensation a little credit. They don't help you by knowing
parts
of the story. You get a fresh perspective just by posting where new
people
can see it - but having these new people possibly jump to through the same
hoops you've already been through simply because you did not want to add a
tag-line of, "I have been trying to get help in
microsoft.public.windowsupdate , but we have run a little dry on ideas and
I
hope someone can help me here - if you wish to see what we have done -
feel
free to look:
http://groups.google.com/group/micr...6d3b71d1636?lnk=st&q=&rnum=1#5f4b36d3b71d1636
.." seems to be leaving out important information to me. I am sorry you
do
not see it that way.

I see in the other thread you were requested to uninstall the McAfee
firewall.
I'll go a step further - uninstall anything McAfee related...

Once you have done that - do this (and yes - I know you have installed the
latest version of Windows Update and the patch for the SVCHOST issue
before - but this is a step-by-step thing - not just that... It just so
happens you will have to do that again at the end of the process.):

Get Dial-a-Fix:
http://wiki.djlizard.net/Dial-a-fix

Use its options to fix:
- Windows Installer
- Windows Update
- All the Registration Center options.

Turn off the "Empty System32\Catroot 2"
Do NOT do "Flush SoftwareDistribution".

Then click "GO" and wait until it is done... Reboot.

- Download/Install Windows Update v3.
http://go.microsoft.com/fwlink/?LinkID=91237
You *WILL* want to install it using the command line switch "/wuforce"
right
after a reboot - immediately after logging in.

- Download/Install the 927891 patch.
http://www.microsoft.com/downloads/details.aspx?FamilyId=7A81B0CD-A0B9-497E-8A89-404327772E5A

- Reboot.

Come back - let us know!
OK - first, I've gotten your point on all the volunteers, so please, no
more
lectures. One thing you must also understand is for folks like me, who
don't
know much about PC's, these forums at times offer lots of advice from
folks,
quite honestly, that are unknowns to those of us getting the advice. So
as
is the case here - I need to understand the "why" portion a bit better.
Your
advice to uninstall everything McAfee - why? This is my virus protection
for
my machine currently. It has also been on my machine for several years,
so
why a problem now? If I uninstall, I have no virus protection - right?
McAfee was provided via my ISP, which has since change hands - Comcast to
Time Warner - so my ability to reload McAfee if I need to is not that
easy.

So I'll offer a little advice of my own - it would he helpful when
offering
the advice to help folks like me, which I do appreciate, is to provide a
little more of "why" we are supposed to just somewhat blindly follow the
instructions. Just as the case here, if I'm going to uninstall my virus
software, I need to know why I should just go out and do that. You should
understand that I've also spent many hours reading and following the
advice
which is yet still not resolved my issue. So while I do appreciate the
hours
folks like you volunteer to do this, please understand that I've gone down
a
very long path so far in making changes, installing software, rebooting
gazillion times and so on. As such, I'm now seeing a another lengthy list
of
tasks to perform, starting with removing my virus protection --- so I just
need to know why I would do that...

It is not a lecture - it is common courtesy and helpful advice on how to get
the best answers to *your* problems.

McAfee and other antivirus applications - particular McAfee and Norton - are
particularly intrusive and install themselves into many places and ways that
cause your system resources to be taxed more than normal. Just because you
have used McAfee for 'years' does not mean that some round of updates, some
virus definition or something else it automatically updated (or you manually
updated) could not have conflicted with other software on your computer or
just be 'defective'. You lose nothing but time uninstalling it - and you
have been working on this for over 11 days - so that is obviously not a
concern at this juncture.

I seldom recommend the McAfee line of products or the Norton line of home
products for home machine virus protection because of their track record. I
do not speak out against them - but I give many free options that are as
good or better and generally use less system resources in doing their jobs.

The fact is - you could be infested with all sorts of malware and not know
it right now. The problem may/may not be related to McAfee. It could be a
hardware issue even. What is being attempted in this conversation and the
other thread you started is to get you to perform simple troubleshooting
steps to eliminate what isn't the problem. You are the ONLY ONE who can see
your system and we are left only with your descriptions and our knowledge of
other issues similar to yours we have either personally solved and/or done
the research for you and read about and are passing on to you by means of
getting you to eliminate possibilities...

So the short answer is that we cannot figure out what is wrong without
eliminating what *might* be the cause one possibility at a time. McAfee has
been known to cause performance issues... Eliminate that by uninstalling
it. Windows update and mal-registered DLLs and bum installs have been known
to cause issues - eliminate that next. After that - people may ask you more
questions about your system - asking for installation list, process lists,
startup lists, etc... However - it all depends on you working with us in
trying to figure this out - otherwise, you aren't asking for help - you are
just waiting for someone to give you the final answer. ;-)

If you want a suggestion for a better antivirus:

( Good Comparison Page for AV software: http://www.av-comparatives.org/ )

AVG Anti-Virus System (Free and up)
http://free.grisoft.com/

eset NOD32 (~$39.00 and up)
http://www.eset.com/products/

Kaspersky Anti-Virus (~$39.95 and up)
http://www.kaspersky.com/kav6

Trend Micro (~$44.95 and up)
http://www.trendmicro.com/en/products/desktop/tav/
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

avast! (Free and up)
http://www.avast.com/

AntiVir (Free and up)
http://www.free-av.com/

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/products/antivirus2007.htm
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

Those are semi-"in the order" I would personally recommend them.

If you would like to scan your computer for spyware completely - to
eliminate that possibility:

SuperAntiSpyware (Free and up)
http://www.superantispyware.com/

Lavasoft AdAware (Free and up)
http://www.lavasoft.de/products/ad-aware_se_personal.php
(How-to: http://snipurl.com/atdn )

Spybot Search and Destroy (Free!)
http://www.safer-networking.net/en/download/
(How-to: http://snipurl.com/atdk )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html
(How-to: http://snipurl.com/ate6 )

A least get the freeware version of the first, update and perform a full
scan. It will take a while - but that is one of the better/more complete
antispyware applications in my opinion and should cover most things you
might possibly have.

You say you have 'ran all the checks for viruses and spyware' --> but
without details, we don't know if you have used any of the online virus
scanners (to eliminate yours being corrupted and not catching the issue) or
if you have used some of the tools we would in cleaning up your machine if
you were to bring it to us and pay one of us as a customer...
 
MG

Do you shutdown your computer after use or leave it on 24/7?

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?

How large is your hard disk and how much free space. Right click on
your C drive in Windows and select Properties to get this information.

What is your CPU processor speed? How much RAM memory? Right click on
your My Computer icon on your Desktop and select Properties to get
this information.

You need to identify which application is generating excessive use
of svchost.exe. Process Explorer provides more information than Task
Manager.

Download Process Explorer.

For further information about Process Explorer see here:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

To ascertain which service is causing the problem select the svchost
producing the high CPU usage, right click, select Properties,
Services. Note there are the full names and some explanation of what
each service does.

You will find further information on Services here:
http://majorgeeks.com/page.php?id=12

To trace the particular Service involved you need to turn off each
service in turn and then restore it noting what effect it has on CPU
usage. However, you need to take care and watch what other Services
are dependent on that service. When you click on the Dependencies
tab allow it a little time to display the information.

It would be helpful if you could post the Command Line of the svchost
process generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.

BTW McAfee and Norton are well known for having a large footprint i.e.
placing heavy demands on the system memory and CPU.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
MG said:
I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.
Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

Does this XP Home or professional?.
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

Do you have other type of messenger installed?.

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):
http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.
Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp
To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass
 
MG

Clarification

In Process Explorer place cursor on Process, right click and select
Properties, Image.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
I'll answer the easy questions here - I obvioously have some work to do on
the processes and I'll get back to you on that. See below

Gerry said:
MG

Do you shutdown your computer after use or leave it on 24/7? I shut down every night .

Try Ctrl+Alt+Delete to select Task Manager and click the Performance
Tab. Under Commit Charge what is the Total, the Limit and the Peak?
Total - 494600
Limit - 1135188
Peak - 593136
How large is your hard disk and how much free space. Right click on
your C drive in Windows and select Properties to get this information.
Total - 74.5 GB
Available - 39GB
What is your CPU processor speed? How much RAM memory? Right click on
your My Computer icon on your Desktop and select Properties to get
this information.
Processor - 1.7GHz
RAM - 768 MB
 
No problems obvious from that information.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
Just send me an email with the header scvhost.exe , you dn't need to say or
write anything other than this, that if you wish?.

MG said:
Sorry - I am not following what you want me to do with your last request..

nass said:
Hi Mike,
Could you e-mail me please with the subject in-line at:
to_you_rossatyahoodotcodotuk
Thank you.
Regards,
nass
MG said:
I originally received McAfee via my Comcast subscription - it is the full
Security Center. I subsequently converted to Time Warner for a brief amount
of time, and then converted to Verizon Fios service. Verizon offers a
different security package for free, but I did not install that. I have this
same package on other PC's in the house and they have no issue.

I uninstalled the firewall portion via add/remove programs which offered the
ability to uninstall only that feature - I did invoke Windows firewall
afterward, so perhaps I'm only 1/4 naked... I would assume that this
uninstall should have cleaned up all that was required??

I have sent my Hijackthis log to the Tweaks.com forum - there is a category
there that deals specifically with these logs - I followed all their advice
and the response was that nothing abnormal was noted in the logs.

I'll work on the other ideas as I have time.

BTW - not sure if you noted my repsonse to Gerry - asked me to isolate the
svchost via Process Explorer and then start shutting down services within.
In my repsonse you will see I was able to shut down everything except RasMan
service and still had the CPU spikes. I then used msconfig to disable RasMan
and restarted - still had CPU spikes - don't understand how that is possible.

One last question - would a memory leak manifest itself in CPU spikes?

:


HI MG,
You said you have McAfee for Years, what kind of subscription is that or
you did renew Mcafee subscription?.
I noted you mentioned to other helper that you uninstalled the Firewall
(half naked I can see you are running on the Internet?).
Did you looked in the Add/Remove programs and uninstall the old software for
the OLd ISP or the orphans left behind from incomplete uninstall?.

Send the Hijackthis to a forum for analysis, you will be surprised how many
times you stared to the log and it seem OKAY? but there is any entry or two
messing up the whole system?.
Read the Help File for Quicken and Disable Automatic Internet Connection to
the Internet and see if there is any improvement in the Svchost.exe .
First Download the Evaluation from McAffe on a CD then Disconnect from the
Internet and Uninstall the McAfee or they provide an uninstaller grab while
you are there downloading the Evaluation.
Run Disk Cleanu up and Defrag in Safe Mode, then install the New AV and see
what it will find when it update and scan for viruses, is there is any
improvement in the performance of your machine?.
Finally, You may experiencing a memory leakage, which sometimes hard to pin
point which app is causing it (need lots of monitoring) and the conclusion
could be a new clean install of the Operating system.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617
Detect Memory Leakage
http://msdn2.microsoft.com/en-us/library/ms792885.aspx
BTW there is a HotFix for memory leakage:
MFC applications leak GDI objects on computers that are running Windows XP
http://support.microsoft.com/kb/319740
Memory leak in Windows XP Tablet PC Edition
http://support.microsoft.com/kb/895953
HTH.
nass

:

Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

:



:

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts

Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.

Does this XP Home or professional?.
XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated

Do you have other type of messenger installed?.

No - not to my knowledge

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?
http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.

Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.

To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass
 
For the record, I started this search for a solution back on July 26 via a
site called Tweaks.com. My post was under the name "XP is driving itself"
under the Hijack This section of that site - in case you want to view that
thread as well. In general, this site provides a list of things to do before
you first post - here is that list:
2) Setup and scan with Ad-Aware SE 1.06 EXACTLY as shown HERE.

3) Setup and scan with Spybot Search & Destroy 1.4 EXACTLY as shown HERE.

4) Download and run CWShredder 2.19.

5) Install and run CrapCleaner, it's an excellent FREE tool to clean out
temporary, and junk files.

6) Unless you are already using Kaspersky Antivirus (i.e. if you are using
Norton, McAfee, TrendMicro etc.) then please do a FREE online virus scan from
Kaspersky Labs FREE Online Virus Scan, make sure to check the option to use
the EXTENDED DATABASE!

NOTE: The online virus scanner will not remove the malware from your machine
if it finds it - installing our software is required to do this. You try our
antivirus software (full product) for FREE by downloading and installing a
free trial, or you can purchase our products in the estore.


7) Download AVG Anti-Spyware 7.5 and set it up and scan exactly as shown
HERE. Please post a copy of the report when posting your HijackThis log.

8) It is a good idea to run the WinSock XP Fix, this will reset your Winsock
driver which some malware corrupts (if you run this you will have to redo any
internet connection tweaks you may have previously set).

9) Once you have properly cleaned your pc please install SpywareBlaster
3.5.1 to help prevent future infections.

10) Install ALL of the latest Windows Updates, (we highly recommend
including Service Pack 2).

In short, as a result of this effort, here is what I've downloaded and
scanned with:
ComboFix
Sybot Search and Destroy
Ad-Aware 2007
Registry Fix
CCleaner
Kaspersky - used the free scan - nothing found
AVG Anti Spyware

So it's been way more than 11 days - and just like tonight, I've spent
another 3+ hours following lots of ideas. So yes, I'm pretty fried from
looking at screen after screen and posting replies. I really do appreciate
all the ideas from those like your self, but my endurance is really wearing
thin on this one. I probably will try to uninstall McAfee - if I do, what
would you recommend to replace it?
 
MG said:
I'm obviously unable to decipher your email address - tried 2 values - both
returned as undeliverable

to_you_rossatyahoo.co.uk replace at with @ this for the bot to swallow.
Also all underscore not (-) it is ( _ ) between to, you ,ross
 
I'm obviously unable to decipher your email address - tried 2 values - both
returned as undeliverable

nass said:
Just send me an email with the header scvhost.exe , you dn't need to say or
write anything other than this, that if you wish?.

MG said:
Sorry - I am not following what you want me to do with your last request..

nass said:
Hi Mike,
Could you e-mail me please with the subject in-line at:
to_you_rossatyahoodotcodotuk
Thank you.
Regards,
nass
:

I originally received McAfee via my Comcast subscription - it is the full
Security Center. I subsequently converted to Time Warner for a brief amount
of time, and then converted to Verizon Fios service. Verizon offers a
different security package for free, but I did not install that. I have this
same package on other PC's in the house and they have no issue.

I uninstalled the firewall portion via add/remove programs which offered the
ability to uninstall only that feature - I did invoke Windows firewall
afterward, so perhaps I'm only 1/4 naked... I would assume that this
uninstall should have cleaned up all that was required??

I have sent my Hijackthis log to the Tweaks.com forum - there is a category
there that deals specifically with these logs - I followed all their advice
and the response was that nothing abnormal was noted in the logs.

I'll work on the other ideas as I have time.

BTW - not sure if you noted my repsonse to Gerry - asked me to isolate the
svchost via Process Explorer and then start shutting down services within.
In my repsonse you will see I was able to shut down everything except RasMan
service and still had the CPU spikes. I then used msconfig to disable RasMan
and restarted - still had CPU spikes - don't understand how that is possible.

One last question - would a memory leak manifest itself in CPU spikes?

:


HI MG,
You said you have McAfee for Years, what kind of subscription is that or
you did renew Mcafee subscription?.
I noted you mentioned to other helper that you uninstalled the Firewall
(half naked I can see you are running on the Internet?).
Did you looked in the Add/Remove programs and uninstall the old software for
the OLd ISP or the orphans left behind from incomplete uninstall?.

Send the Hijackthis to a forum for analysis, you will be surprised how many
times you stared to the log and it seem OKAY? but there is any entry or two
messing up the whole system?.
Read the Help File for Quicken and Disable Automatic Internet Connection to
the Internet and see if there is any improvement in the Svchost.exe .
First Download the Evaluation from McAffe on a CD then Disconnect from the
Internet and Uninstall the McAfee or they provide an uninstaller grab while
you are there downloading the Evaluation.
Run Disk Cleanu up and Defrag in Safe Mode, then install the New AV and see
what it will find when it update and scan for viruses, is there is any
improvement in the performance of your machine?.
Finally, You may experiencing a memory leakage, which sometimes hard to pin
point which app is causing it (need lots of monitoring) and the conclusion
could be a new clean install of the Operating system.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617
Detect Memory Leakage
http://msdn2.microsoft.com/en-us/library/ms792885.aspx
BTW there is a HotFix for memory leakage:
MFC applications leak GDI objects on computers that are running Windows XP
http://support.microsoft.com/kb/319740
Memory leak in Windows XP Tablet PC Edition
http://support.microsoft.com/kb/895953
HTH.
nass

:

Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

:



:

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts

Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.

Does this XP Home or professional?.
XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated

Do you have other type of messenger installed?.

No - not to my knowledge

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?
http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.

Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.

To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass
 
Sorry - I am not following what you want me to do with your last request..

nass said:
Hi Mike,
Could you e-mail me please with the subject in-line at:
to_you_rossatyahoodotcodotuk
Thank you.
Regards,
nass
MG said:
I originally received McAfee via my Comcast subscription - it is the full
Security Center. I subsequently converted to Time Warner for a brief amount
of time, and then converted to Verizon Fios service. Verizon offers a
different security package for free, but I did not install that. I have this
same package on other PC's in the house and they have no issue.

I uninstalled the firewall portion via add/remove programs which offered the
ability to uninstall only that feature - I did invoke Windows firewall
afterward, so perhaps I'm only 1/4 naked... I would assume that this
uninstall should have cleaned up all that was required??

I have sent my Hijackthis log to the Tweaks.com forum - there is a category
there that deals specifically with these logs - I followed all their advice
and the response was that nothing abnormal was noted in the logs.

I'll work on the other ideas as I have time.

BTW - not sure if you noted my repsonse to Gerry - asked me to isolate the
svchost via Process Explorer and then start shutting down services within.
In my repsonse you will see I was able to shut down everything except RasMan
service and still had the CPU spikes. I then used msconfig to disable RasMan
and restarted - still had CPU spikes - don't understand how that is possible.

One last question - would a memory leak manifest itself in CPU spikes?

nass said:
HI MG,
You said you have McAfee for Years, what kind of subscription is that or
you did renew Mcafee subscription?.
I noted you mentioned to other helper that you uninstalled the Firewall
(half naked I can see you are running on the Internet?).
Did you looked in the Add/Remove programs and uninstall the old software for
the OLd ISP or the orphans left behind from incomplete uninstall?.

Send the Hijackthis to a forum for analysis, you will be surprised how many
times you stared to the log and it seem OKAY? but there is any entry or two
messing up the whole system?.
Read the Help File for Quicken and Disable Automatic Internet Connection to
the Internet and see if there is any improvement in the Svchost.exe .
First Download the Evaluation from McAffe on a CD then Disconnect from the
Internet and Uninstall the McAfee or they provide an uninstaller grab while
you are there downloading the Evaluation.
Run Disk Cleanu up and Defrag in Safe Mode, then install the New AV and see
what it will find when it update and scan for viruses, is there is any
improvement in the performance of your machine?.
Finally, You may experiencing a memory leakage, which sometimes hard to pin
point which app is causing it (need lots of monitoring) and the conclusion
could be a new clean install of the Operating system.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617
Detect Memory Leakage
http://msdn2.microsoft.com/en-us/library/ms792885.aspx
BTW there is a HotFix for memory leakage:
MFC applications leak GDI objects on computers that are running Windows XP
http://support.microsoft.com/kb/319740
Memory leak in Windows XP Tablet PC Edition
http://support.microsoft.com/kb/895953
HTH.
nass

:

Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

:



:

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts

Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.

Does this XP Home or professional?.
XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated

Do you have other type of messenger installed?.

No - not to my knowledge

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?
http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.

Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.

To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass
 
OK - I went in to Process Explorer, selcted one of the svchost tasks, and
then started shutting down processes within. I ws able to shut down
everything except RasMan. I verified via Starter that all hte processes
other than that had been stopped. Even with ONLY RasMan running, I was still
seeing the CPU usage. So - before restarting, I went in via msconfig and
unselected RasMan. After booting up, I could see that RasMan was stopped,
but - I'm still seeing the CPU usage. All this makes no sense to me as it
appeared I had previously shut doen everything except RasMan and still saw my
issue. Then was able to stop that process on start up and still saw the
issue......
 
I originally received McAfee via my Comcast subscription - it is the full
Security Center. I subsequently converted to Time Warner for a brief amount
of time, and then converted to Verizon Fios service. Verizon offers a
different security package for free, but I did not install that. I have this
same package on other PC's in the house and they have no issue.

I uninstalled the firewall portion via add/remove programs which offered the
ability to uninstall only that feature - I did invoke Windows firewall
afterward, so perhaps I'm only 1/4 naked... I would assume that this
uninstall should have cleaned up all that was required??

I have sent my Hijackthis log to the Tweaks.com forum - there is a category
there that deals specifically with these logs - I followed all their advice
and the response was that nothing abnormal was noted in the logs.

I'll work on the other ideas as I have time.

BTW - not sure if you noted my repsonse to Gerry - asked me to isolate the
svchost via Process Explorer and then start shutting down services within.
In my repsonse you will see I was able to shut down everything except RasMan
service and still had the CPU spikes. I then used msconfig to disable RasMan
and restarted - still had CPU spikes - don't understand how that is possible.

One last question - would a memory leak manifest itself in CPU spikes?

nass said:
HI MG,
You said you have McAfee for Years, what kind of subscription is that or
you did renew Mcafee subscription?.
I noted you mentioned to other helper that you uninstalled the Firewall
(half naked I can see you are running on the Internet?).
Did you looked in the Add/Remove programs and uninstall the old software for
the OLd ISP or the orphans left behind from incomplete uninstall?.

Send the Hijackthis to a forum for analysis, you will be surprised how many
times you stared to the log and it seem OKAY? but there is any entry or two
messing up the whole system?.
Read the Help File for Quicken and Disable Automatic Internet Connection to
the Internet and see if there is any improvement in the Svchost.exe .
First Download the Evaluation from McAffe on a CD then Disconnect from the
Internet and Uninstall the McAfee or they provide an uninstaller grab while
you are there downloading the Evaluation.
Run Disk Cleanu up and Defrag in Safe Mode, then install the New AV and see
what it will find when it update and scan for viruses, is there is any
improvement in the performance of your machine?.
Finally, You may experiencing a memory leakage, which sometimes hard to pin
point which app is causing it (need lots of monitoring) and the conclusion
could be a new clean install of the Operating system.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617
Detect Memory Leakage
http://msdn2.microsoft.com/en-us/library/ms792885.aspx
BTW there is a HotFix for memory leakage:
MFC applications leak GDI objects on computers that are running Windows XP
http://support.microsoft.com/kb/319740
Memory leak in Windows XP Tablet PC Edition
http://support.microsoft.com/kb/895953
HTH.
nass

MG said:
Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

nass said:
:

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts
Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.
2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.
Does this XP Home or professional?. XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated
Do you have other type of messenger installed?.

No - not to my knowledge
4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?
http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.
Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.
To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass
 
Back
Top