svchost consuming CPU even after boot-up

[Guest]

Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts

Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.

Does this XP Home or professional?. XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated

Do you have other type of messenger installed?.

No - not to my knowledge

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?

http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.

Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.

To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.

 

[Guest]

HI MG,
You said you have McAfee for Years, what kind of subscription is that or
you did renew Mcafee subscription?.
I noted you mentioned to other helper that you uninstalled the Firewall
(half naked I can see you are running on the Internet?).
Did you looked in the Add/Remove programs and uninstall the old software for
the OLd ISP or the orphans left behind from incomplete uninstall?.

Send the Hijackthis to a forum for analysis, you will be surprised how many
times you stared to the log and it seem OKAY? but there is any entry or two
messing up the whole system?.
Read the Help File for Quicken and Disable Automatic Internet Connection to
the Internet and see if there is any improvement in the Svchost.exe .
First Download the Evaluation from McAffe on a CD then Disconnect from the
Internet and Uninstall the McAfee or they provide an uninstaller grab while
you are there downloading the Evaluation.
Run Disk Cleanu up and Defrag in Safe Mode, then install the New AV and see
what it will find when it update and scan for viruses, is there is any
improvement in the performance of your machine?.
Finally, You may experiencing a memory leakage, which sometimes hard to pin
point which app is causing it (need lots of monitoring) and the conclusion
could be a new clean install of the Operating system.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617
Detect Memory Leakage
http://msdn2.microsoft.com/en-us/library/ms792885.aspx
BTW there is a HotFix for memory leakage:
MFC applications leak GDI objects on computers that are running Windows XP
http://support.microsoft.com/kb/319740
Memory leak in Windows XP Tablet PC Edition
http://support.microsoft.com/kb/895953
HTH.
nass

Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts

Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.

Does this XP Home or professional?. XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated

Do you have other type of messenger installed?.

No - not to my knowledge

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?

http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.

Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.

To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass

 

[Guest]

Hi Mike,
Could you e-mail me please with the subject in-line at:
to_you_rossatyahoodotcodotuk
Thank you.
Regards,
nass

I originally received McAfee via my Comcast subscription - it is the full
Security Center. I subsequently converted to Time Warner for a brief amount
of time, and then converted to Verizon Fios service. Verizon offers a
different security package for free, but I did not install that. I have this
same package on other PC's in the house and they have no issue.

I uninstalled the firewall portion via add/remove programs which offered the
ability to uninstall only that feature - I did invoke Windows firewall
afterward, so perhaps I'm only 1/4 naked... I would assume that this
uninstall should have cleaned up all that was required??

I have sent my Hijackthis log to the Tweaks.com forum - there is a category
there that deals specifically with these logs - I followed all their advice
and the response was that nothing abnormal was noted in the logs.

I'll work on the other ideas as I have time.

BTW - not sure if you noted my repsonse to Gerry - asked me to isolate the
svchost via Process Explorer and then start shutting down services within.
In my repsonse you will see I was able to shut down everything except RasMan
service and still had the CPU spikes. I then used msconfig to disable RasMan
and restarted - still had CPU spikes - don't understand how that is possible.

One last question - would a memory leak manifest itself in CPU spikes?

HI MG,
You said you have McAfee for Years, what kind of subscription is that or
you did renew Mcafee subscription?.
I noted you mentioned to other helper that you uninstalled the Firewall
(half naked I can see you are running on the Internet?).
Did you looked in the Add/Remove programs and uninstall the old software for
the OLd ISP or the orphans left behind from incomplete uninstall?.

Send the Hijackthis to a forum for analysis, you will be surprised how many
times you stared to the log and it seem OKAY? but there is any entry or two
messing up the whole system?.
Read the Help File for Quicken and Disable Automatic Internet Connection to
the Internet and see if there is any improvement in the Svchost.exe .
First Download the Evaluation from McAffe on a CD then Disconnect from the
Internet and Uninstall the McAfee or they provide an uninstaller grab while
you are there downloading the Evaluation.
Run Disk Cleanu up and Defrag in Safe Mode, then install the New AV and see
what it will find when it update and scan for viruses, is there is any
improvement in the performance of your machine?.
Finally, You may experiencing a memory leakage, which sometimes hard to pin
point which app is causing it (need lots of monitoring) and the conclusion
could be a new clean install of the Operating system.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617
Detect Memory Leakage
http://msdn2.microsoft.com/en-us/library/ms792885.aspx
BTW there is a HotFix for memory leakage:
MFC applications leak GDI objects on computers that are running Windows XP
http://support.microsoft.com/kb/319740
Memory leak in Windows XP Tablet PC Edition
http://support.microsoft.com/kb/895953
HTH.
nass

Not sure I've been able to address all your ideas - pretty overwhelming.
Please look at my commecnts below. Thanks for your efforts.

:



:

I've read many posts regarding the lengthy start-up issues associated with
svchost and MS updates - mine appears somewhat different. After booting up,
and after all services have started, my machine runs through cycles of CPU -
viewed on Task Manager these spkies are typically around 40% of CPU,
sometimes higher, and are occurring on a very consistent cycle, around every
6-8 seconds. This happens even with nothing open on my machine.

I've run all the scans to check for viruses and spyware. I can see that
these processes running are within svchost.exe and/or services.exe. I've
tried shutting down everything that is in my startup and the problem still
exists. This cycling of CPU goes on non-stop, all the time. As it eats CPU
on these cycles, other processes are now affected - example, a full virus
scan now takes about twice as long as it used to. As there are tons of tasks
running within svchost, I have no idea how to narrow this down. I'm running
XP Home/SP2 and have applied all updates automatically. Any ideas?

HI MG,
I gone through your Past thread, but believe me you didn't do yourself a
favour by not answering the helper there.
First MowGreen asked you do you have Spybot or any other Software installed,
you didn't answer I don't know why?.

I thought I had responded to all posts

Come to your issue please read these steps according the Event Viewer Log
you posted, if there are any other error, please feel free to share it with
us here!.

answer In-line under each error : <= read the whole post then perform the
steps>
1 = mrtRate service failed to start due to the following error: The system
cannot find the file
specified.
QuickBooks Pro 2002 or 2004 by any chance?,If you do then proceed with
these steps below:
disabling Quicken's Background Downloading do this:

1- Start QuickBooks 200? application.
2- Then On the Edit menu click Options then select Internet Options.
3- On the Internet Options Select Don't use Background Downloading then
click [OK], does it help?.
open run command and type in:
services.msc click [OK]
Locate the service and disable it or set it to Manual
To disable Quicken's Background Downloading driver:
http://web.intuit.com/support/quicken/99/win/6173.html
In the Open box, type regedt32, and then click [OK].
Locate this Key and you can see the service there:
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName
= "mrtRate.exe"

"STOP 0x9f" in Ntoskrnl.exe When Shutting Down or Restarting Computer
http://support.microsoft.com/default.aspx?scid=kb;[LN];245835

I am running Quicken Deluxe 2007 - I do not see the Edit/Options presented
via that tool. It appears the above relate to Quicken 99 or 2000, from what
I can see.

2 = Management service terminated with the following error: The specified
module
could not be found.
Open the services control panel and start these services:
Service Status StartUp type
Server Started Automatically
Terminal Services Started Manual
Remote Procedure Call Runtime (RPC) started Auto

All the above are configured as indicated.

Does this XP Home or professional?.
XP Home
Adding or removing a program may generate Event ID 7023
http://support.microsoft.com/kb/328213

3= d:\qxp_slp\com\com1x\src\event s\tier1\eventsystemobj.cpp.
Open a run command and type in:
services.msc click [OK]
Make sure this service started Manual or Auto
Service Status
StartUp type
COM+ Event System Started Manual
Background Intelligent Transfer Started Manual
Messenger
Disabled

All above are configured as indicated

Do you have other type of messenger installed?.

No - not to my knowledge

4= ntoskrnl.exe+0x4856
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

The above beside a debugger dump, it could be a bad RAM, try to test the RAM
and switch them around.
Run the Chkdsk, or System File Checker (sfc):

I ran Chkdsk - no issues noted. I did upgrade my memory middle of last
year. I have a Dell which uses the R-Dram memory - so expensive I purchased
from ebay. I've not noted any issues with this memory, and again, my CPU
issue started some time this year, not last year. Would the Chkdsk note any
issues here?
http://www.microsoft.com/resources/...ddocs/en-us/system_file_checker.mspx?mfr=true
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

If the above did not help, try to send back with the list of start up
programs, services.

I've tried disabling everything in my startup list with no impact to my
problem.

Also it is best if you uninstall McAfee and the rest of software from the
Old ISP and run disk clean up then defrag in safe mode, you can get a free 30
days with McAfee then if you liked and thing worked okay you can renew:
http://download.mcafee.com/eval/evaluate2.asp

I'm really reluctant to uninstall McAfee - I've had it for years - my issue
started some time this year - unfortunately, I cannot recall any event of
note which might have changed on my machine. However, adding McAfee was not
one of those. I did switch from Time Warner to Verizon Fios service earlier
this year. Not sure if that could have had any bearing.

To be sure try this extra step:
Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:

I've used Hijackthis, presented the logs and followed all guideance provided
- conclusion was that I had no form of malware present on my machine.

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.
HTH.
nass

 

[Guest]

FYI - per my previous email - looks like perhaps you've found something! I
uninstalled Windows Defender, AVG and Adware Alerter. On top of that I also
uninstalled the Google and Yahoo toolbars. After doing that, I still had my
CPU spikes. I then uninstalled AOL as I have never used it. This uninstall
requested a restart - after restart, my CPU spikes have almost totally
disappeared!! I'm still seeing a little activity, but nothing above 5% CPU.
Thanks so much for your continued suggestions and assistance!

 

[ptmx2]

sir, your patience is remarkable. i notice that your 'informed' responder
appears to have Not responded to your last and most decisive and
consequential remarks.