kevinf80 Posted November 20, 2013 ID:755812 Share Posted November 20, 2013 Thank you for the update and the info, never realized only XP pro came with Tasklist.exe. There is also an app called Process Explorer that does more or less the same, maybe easier. Download from here: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx Unzip to your Desktop, double click to run. It should open with Services.exe already expanded, if not do that by select the plus sign (+) at the side. Look for svchost entry that is using excessive CPU. Expand that entry if possible. left click on the problem entry > select > file > save. Save to Desktop or a folder of your choice. Post to next reply Link to post Share on other sites More sharing options...
morkie Posted November 20, 2013 Author ID:755903 Share Posted November 20, 2013 Kevin,Here is the PID that has been slowing the PC to a crawl. PID.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 20, 2013 ID:755905 Share Posted November 20, 2013 We will have to drag this a bit further, can you d/l "Process Explorer" from link in my last reply, unzip to your Desktop then run it. Expand svchost that has the PID you quote, look at the services and note the specific one that causes the high CPU usage... Kevin Link to post Share on other sites More sharing options...
morkie Posted November 20, 2013 Author ID:755914 Share Posted November 20, 2013 Can't figure out how to expand service with high CPU in order to see the indivdual services withih it and their CPU usage. richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 20, 2013 ID:755985 Share Posted November 20, 2013 Some entries of svchost cannot be expanded, dont dwell here. Run Process Explorer, let it sit running until you see the CPU rise, now select File > Save > save to desktop or folder of your choice, post that log, I believe it will show all entries and readings, maybe we can tell from that log... Link to post Share on other sites More sharing options...
morkie Posted November 20, 2013 Author ID:756030 Share Posted November 20, 2013 Here it is,richie Hardware Interrupts and DPCs.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 20, 2013 ID:756076 Share Posted November 20, 2013 Unfortunately that does not show what we need to see, In the log the top entry for svchost appears to be using 99% If you select (left click) to highlight (blue) then move cursor away. Now move cursor back hover over that svchost does a window open and identify a specific service? I attach image to show an example, you will see the svchost entry I highlighted, then with cursor moved away then back it opens a window with the service name..... Link to post Share on other sites More sharing options...
morkie Posted November 20, 2013 Author ID:756132 Share Posted November 20, 2013 Yes, I can do that but it doesn't show how much CPU usage each one is using that's associated with that service host. richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 20, 2013 ID:756142 Share Posted November 20, 2013 How many services are attributed to that specific svchost entry, Link to post Share on other sites More sharing options...
morkie Posted November 20, 2013 Author ID:756149 Share Posted November 20, 2013 28.Post #52 has them listed in the PID.txt attachment. richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 21, 2013 ID:756165 Share Posted November 21, 2013 Sigh... just what you need to see. Regarding the service named "Browser" can you open services.msc scroll to that service, right click > select "Properties" > "Dependencies" > are there any dependencies listed. Also what is the shown path to its executable... Link to post Share on other sites More sharing options...
morkie Posted November 21, 2013 Author ID:756171 Share Posted November 21, 2013 There is no service named "Browser". richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 21, 2013 ID:756176 Share Posted November 21, 2013 mmm it shows in the list of services specific to problem svchost you listed in reply#52.... OK run Process Explorer one more time, double click on the problem svchost, A new window should open. Select the "services" tab. The listed services should populate. You should be able to see the service name, display name and path. Can you see what path is listed against "browser" Can you also post a screen shot of that window Link to post Share on other sites More sharing options...
morkie Posted November 21, 2013 Author ID:756187 Share Posted November 21, 2013 C:\Windows\System32\Browser.dll Link to post Share on other sites More sharing options...
kevinf80 Posted November 21, 2013 ID:756193 Share Posted November 21, 2013 From what I can see those entries look legit, I guess the only way forward is to check each entry at VirusTotal by navigational path, see what comes back.... Upload a File to VirustotalGo to http://www.virustotal.com/ Click the Choose file button Navigate to the file path address goes here or just copy/paste it in. Click the Scan it tab If you get a message saying File has already been analyzed: click Reanalyze file now Copy and paste the results back here please. Repeat the above steps for all files listed Maybe we could also have a corrupt service, that could be checked by running sfc /scannow at a command promt, you would need a Windows XP installation CD with Service Pack 3 (SP3) because that is the service pack level of your system, Windows will more than likely ask for that CD during a run of System File Checker Link to post Share on other sites More sharing options...
morkie Posted November 21, 2013 Author ID:756423 Share Posted November 21, 2013 Well, that was a fun morning. All 28 files checked out ok when analyzed at virustotal. Also, the sfc scan did not find any corrupt system files. richie Link to post Share on other sites More sharing options...
morkie Posted November 21, 2013 Author ID:756425 Share Posted November 21, 2013 Well, that was a fun morning. All the files checked out OK at Virustotal. I noticed that 3 of the processes use the same file it is a "shsvcs.dll" file.The SFC scan did not find any corrupt system files. richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 21, 2013 ID:756492 Share Posted November 21, 2013 That file is related to Shell Hardware Detection, this provides control of AutoPlay. See if disabling that service makes any difference. Open services.msc as you`ve done previously, in the services list scroll to "Shell Hardware Detection" right click on that service and select "Properties" In the new window "Stop" that service, next change its start up type from "Automatic" to "Manual". Select "Apply" then OK. Close out those windows then re-boot, does that make any difference.... Link to post Share on other sites More sharing options...
morkie Posted November 21, 2013 Author ID:756515 Share Posted November 21, 2013 No difference.richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 21, 2013 ID:756564 Share Posted November 21, 2013 The only option left is to run your PC in Normal mode, wait until you get hit with the CPU issue. Now access the services window and turn off each of the attributed services that you know maybe having an impact from your list in reply #52 Sooooh from the run box type services.msc tap enter to open the services window. Now just a matter of left click on each service in turn, select "Stop".if CPU does not change, start that back up and move to the next one... I give the display names for the first few, needs more research to find the rest... Browser = Computer BrowserAudioSrv = Windows AudioCryptSvc = Cryptographic ServicesDhcp = DHCP ClientERSvc = Windows Error Reporting Service Link to post Share on other sites More sharing options...
Maurice Naggar Posted November 24, 2013 ID:757487 Share Posted November 24, 2013 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Maurice Naggar Posted November 24, 2013 ID:757556 Share Posted November 24, 2013 Topic re-opened by request. Link to post Share on other sites More sharing options...
morkie Posted November 24, 2013 Author ID:757557 Share Posted November 24, 2013 Hi again Kevin,I could not find several of the services in the list, they are......EventSystemlanmanserverlanmanworkstationNetman,RasMan,Schedule,SENS,SharedAccess,TapiSrv,TrkWks,W32Time,wscsvc,wuauserv,The others had no effect when shut down.richie Link to post Share on other sites More sharing options...
kevinf80 Posted November 24, 2013 ID:757598 Share Posted November 24, 2013 Here are display names for the list you post: EventSystem = Com + EventSystemlanmanserver = Serverlanmanworkstation = WorkStationNetman, = Network ConnectionsRasMan, = Remote Access Connection ManagerSchedule, = Task SchedulerSENS, = System Event Notification SystemSharedAccess, = Internet Connection SharingTapiSrv, = TelephonyTrkWks, = Distributed Link Tracking ClientW32Time, = Windows Timewscsvc, = Security Centerwuauserv, = Windows Update Link to post Share on other sites More sharing options...
morkie Posted November 25, 2013 Author ID:757822 Share Posted November 25, 2013 Hi Kevin, TapiSrv, = Telephony service gave me an error msg, "could not stop error 1503" I could not find 2 of the services,SharedAccess, = Internet Connection Sharingwuauserv, = Windows Update richie Link to post Share on other sites More sharing options...
Recommended Posts