svchost freezing my system

[tshad]

On my XP SP2, I have been having problem with my system where it would run
fine for a
while than seem to freeze.

I was able to find out that in the task manager sorted by CPU that
svchost.exe would be at the top of list using about 6 megs of memory. I
found that if I ended that process the system would work fine.

I used Process Explorer to find out what svchost.exe belonged to.

It does show me that svchost.exe pid 232 was spawned from a service (716).

The ProcEx shows me that that service is owned by Microsoft but not what the
service is, but it is under Winlogon.exe and is taking around 95% of the
machine. Not sure
what the difference is between the red and the green on the cpu usage graph
but it is showing between 94-97%.

The private bytes is showing about 95 percent yellow an 5.3 MB

The task manager shows it at 5,716K (5.7MB) - not sure if this is related.

I/O bytes is 0.

There is a NetLogon service but that isn't started

What would cause this?

In a few minutes, I will need to reboot the machine if I don't end the
process.

This happens everytime I start the machine.

So the only thing I can do is remember to go directly to the Task manager,
sort by CPU and it will ALWAYS be the one on top. I then end the process.
The system works fine from that point on.

Obviously, this is not supposed to happen, but I can't seem to find out what
is causing WinLogon.exe to do that or what svclogon is doing.

I'd appreciate any help on this as I have been trying to find an answer for
weeks on this.

Thanks,

Tom

 

[Gerry]

It would be helpful if you could post the Command Line of the svchost
process generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.

Please note PID numbers vary by machine and session so quoting them is
not helpful.

We exchanged posts on this issue last August. Did you ever follow up
one of my other suggestions to post a copy of a HijackThis log to a
forum specialising in these logs?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[tshad]

It would be helpful if you could post the Command Line of the svchost
process generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.

Command line is
C:\WINDOWS\system32\svchost.exe -k HPService

I assume this has something to do with my HP Printer.

Also I saw Parent:
services.exe(716)

Its command line is:
C:\WINDOWS\system32\services.exe

And its Parent is:
winlogon.exe(672)

Please note PID numbers vary by machine and session so quoting them is not
helpful.

I know, but I was just putting everything I saw in Process Explorer.

We exchanged posts on this issue last August. Did you ever follow up one
of my other suggestions to post a copy of a HijackThis log to a forum
specialising in these logs?

Actually, I don't remember this one. But I don't think I did. I probably
found the problem since I have only had this particular problem for the last
few weeks or so.

Thanks,

Tom

 

[tshad]

Found the problem.

The problem was with a service called HP Network Services Support. This
service apparently discovers and monitors the state and the configuration of
the HP devices attached to the network. If the IP address of the device (in
my case a printer) changes you won't be able to connect and this service, I
assume, tracks it by the netbios name and reconfigures your system with the
new IP address.

There is another service called HP Cue DeviceDiscovery Service which I
assume does the same type of thing.

The service I was having a problem with seems to have been generated by the
Network Services Support service. I couldn't just stop it as it gave me an
error and wouldn't stop but if I disabled it and restarted the system the
service is gone and my machine works fine.

I assume this is a bug as I can't see why HP would write a service that
would use 90+% of your cpu all the time.

Thanks,

Tom

The

 

[Gerry]

Found this thread, which seems to relate to your problem:
http://forums12.itrc.hp.com/service...47627+1200162438018+28353475&threadId=1177917

and this:
http://forums12.itrc.hp.com/service...47627+1200162795650+28353475&threadId=1101413

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerry]

Tom

We seem to have reached the same conclusion by different routes. Please
see my earlier post.


--
Regards.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[tshad]

Tom

We seem to have reached the same conclusion by different routes. Please
see my earlier post.

Yes, it appears we did.

I noticed that there are many people with the same problem. Different
printers and even some different drivers (most with the HP Network Services
Support). I noticed that the service programs are slightly different but
the problems are the same.

Also, this seems to have been around for a year or so and HP still hasn't
resolved the issue (and obviously doesn't care) as people have called them
about the issue. I also don't like HP software but their printers are
pretty good. I normally turn their software off.

I had thought this was a Norton Antivirus problem but knew that wasn't the
case when I uninstalled the program and still had the problem.

Luckily, I statically set my Printers' IP. I am not sure how people that
let DHCP assign the IP's would solve this problem.

Thanks,

Tom