svchost rpc call hogs the cpu

[StoneCherub]

I have read the other threads on this problem but none of the suggestions, as
I understand them, work to solve my problem.

Acer Travelmate 2450 XP-Pro SP3 patched to 1/24
Zone alarm firewall, Sunbelt Vipre av/am signatures to 1/24
OS installed more than 2 years ago and worked as well as could be expected.

The problem showed up when a re-boot hung showing desk-top icons but no
taskbar. The next re-boot ran verrry sloooly as did a re re boot into safe
mode. Process explorer showed two instances of svchost, the second hogging
the cpu. The offending thread start address is:
ADVAPI.dll!CryptVerifySignatureW+0x17 which is apparently part of rpcss.
Killing that instance kills the computer.

I did transfer the dll from my desk machine but that did not work.

I have already spent more time troubleshooting this than I would have
re-installing the OS (they DO rot) so, if nobody can suggest a quick fix for
this, that's what I'll do.

 

[JS]

A recent release of Zone Alarm (Version 8.x) was know to cause problems such
as slow performance and shutdown.
Check ZA to see if they have a fix available.

 

[AJR]

Several instances of svchost are usually runing concurrently - svchost acts
as a "host" - and may contain several running processes- of which any one
may be consuming CPU time. Perfornance/Resource Monitor may indicate
specific process. Another alternative is to use "Process Explorer" av
available from Microsoft Sysinternals.

 

[SC Tom]

That problem with ZA was fixed in the last 2 releases. The most current is
8.0.059.000. Make sure you have that release and that will take care of your
problem if ZA is indeed causing it.

SC Tom

 

[Bob Lucas]

The latest Zone Alarm release is 8.0.065.000.

None of the Zone Alarm 8.0.xxx.xxx releases have triggered
problems on my computers.

 

[SC Tom]

The latest Zone Alarm release is 8.0.065.000.

None of the Zone Alarm 8.0.xxx.xxx releases have triggered problems on my
computers.

Where did you find that release? No matter where I look on their site, all I
can find is what I already have, .059.

Thanks,
SC Tom

 

[Bob Lucas]

I am pretty sure it was offered to me by ZoneAlarm as an
essential update (Pop-up box). I saved the download to my hard
drive (My Downloads).

The installation file is zaSetup_80_065_000_en.exe.

The file size is 27,121 KB and File Properties describe it as
ZoneAlarm [Regular]-1025-English.

The file date is 5 December 2008. However, that might be the
date I downloaded it. The digital signature from Check Point
Software Technologies Ltd is timed at 17:43:25 on 9 November
2008. The signature does have a valid Verisign certificate.

Incidentally, I use the free ZoneAlarm Firewall only. I did not
pay for the complete package. You might have a different
version, if you are using a subscription version of the software.

 

[SC Tom]

I am pretty sure it was offered to me by ZoneAlarm as an essential update
(Pop-up box). I saved the download to my hard drive (My Downloads).

The installation file is zaSetup_80_065_000_en.exe.

The file size is 27,121 KB and File Properties describe it as ZoneAlarm
[Regular]-1025-English.

The file date is 5 December 2008. However, that might be the date I
downloaded it. The digital signature from Check Point Software
Technologies Ltd is timed at 17:43:25 on 9 November 2008. The signature
does have a valid Verisign certificate.

Incidentally, I use the free ZoneAlarm Firewall only. I did not pay for
the complete package. You might have a different version, if you are
using a subscription version of the software.

That may be what it is. No matter which paid version I check on their site,
it lists .059 as the latest and greatest. But when I check to see what
version is available for the freebie, it doesn't show anything, just wants
to download a setup file. There will probably be another subscription
release soon it there aren't too many complaints from the free users about
..065
SC Tom